auth.proto

syntax = "proto3";

package auth;

service AuthenticationService {
  rpc RequestUserCredential (UserCredentialRequest) returns (stream CredentialResponse) {}
}

message SshCertificateRequest {
  string public_key = 1;
}

message SshCertificate {
  string certificate = 1;
}

message SshCertificateTtl {
  string certificate_ttl = 1;
}

message ClientValidation {
  // To make it harder to simply send a URL to another user and lure them into
  // logging in with the goal of stealing their session, we do a validation
  // by querying localhost:1215. If we get back the value presented in this
  // field the request is considered to be genuine.
  string ident = 1;
}

message VaultTokenRequest {

}

// Short lived Vault token
message VaultToken {
  string token = 1;
}


// Short lived X.509 certificate with VMware attributes added
message VmwareCertificateRequest {
  string csr = 1;
}

message VmwareCertificate {
  string certificate = 1;
  repeated string ca_chain = 2;
}

// Long lived X.509 certificate to be used together with the cookie.
// Long lived since browsers are quite annoying when a new cert is installed.
message BrowserCertificateRequest {
  string csr = 1;
}

message BrowserCertificate {
  string certificate = 1;
  repeated string ca_chain = 2;
}

// Short lived X.509 certificate with Kubernetes attributes
message KubernetesCertificateRequest {
  // TODO(bluecmd): Unused due to https://github.com/hashicorp/vault/issues/4562
  string csr = 1;
}

message KubernetesCertificate {
  string certificate = 1;
  // TODO(bluecmd): Remove when https://github.com/hashicorp/vault/issues/4562 is fixed
  string private_key = 2;
  repeated string ca_chain = 3;
}

// Short lived browser cookie for authentication together with the
// BrowserCertificate. Cookie is already set by the backend in the browser if a
// user action was triggered.
message BrowserCookieRequest {
}

message BrowserCookie {
  // This is also set in the browser when the flow is completed if the user
  // was challenged.

  string name = 1;

  string value = 2;

  // DNS domain (with wildcard) that the cookie applies to
  string domain = 3;

  // Epoch timestamp in seconds
  uint64 expires = 4;
}

message UserCredentialRequest {
  ClientValidation client_validation = 1;

  SshCertificateRequest ssh_certificate_request = 2;

  VaultTokenRequest vault_token_request = 3;

  KubernetesCertificateRequest kubernetes_certificate_request = 4;

  BrowserCookieRequest browser_cookie_request = 5;

  BrowserCertificateRequest browser_certificate_request = 6;

  VmwareCertificateRequest vmware_certificate_request = 7;

  SshCertificateTtl ssh_certificate_ttl = 8;
}

message UserAction {
  // Interactive URL needs to be visited and acted on
  string url = 1;
}

message CredentialResponse {
  // If set, the user needs to do something
  UserAction required_action = 1;

  SshCertificate ssh_certificate = 2;

  VaultToken vault_token = 3;

  KubernetesCertificate kubernetes_certificate = 4;

  BrowserCookie browser_cookie = 5;

  BrowserCertificate browser_certificate = 6;

  VmwareCertificate vmware_certificate = 7;
}