add keys-for-user subcommand to monkeysphere-authentication

This subcommand will output all valid key for a given user.  The
user's authorized_user_ids file will be read for OpenPGP user IDs, one
per line.  The ssh-formated RSA keys will be output to stdout.

Also included is a simple script that takes the user as it's one
argument and exec's this command.  This is something that would be
suitable for the proposed sshd AuthorizedKeysCommand.

5 files changed, 65 insertions, 1 deletions

diff --git a/Makefile b/Makefile
index 9f5028a..7662f7b 100755
--- a/Makefile
+++ b/Makefile
@@ -42,6 +42,7 @@ install: all installman
 	printf "Monkeysphere %s\n" $(MONKEYSPHERE_VERSION) > $(DESTDIR)$(PREFIX)/share/monkeysphere/VERSION
 	install src/monkeysphere $(DESTDIR)$(PREFIX)/bin
 	install src/monkeysphere-host src/monkeysphere-authentication $(DESTDIR)$(PREFIX)/sbin
+	install src/monkeysphere-authentication-keys-for-user $(DESTDIR)$(PREFIX)/share/monkeysphere
 	install -m 0644 src/share/common $(DESTDIR)$(PREFIX)/share/monkeysphere
 	install -m 0644 src/share/defaultenv $(DESTDIR)$(PREFIX)/share/monkeysphere
 	install -m 0755 src/share/checkperms $(DESTDIR)$(PREFIX)/share/monkeysphere
diff --git a/man/man8/monkeysphere-authentication.8 b/man/man8/monkeysphere-authentication.8
index 7c12673..e9e24b0 100644
--- a/man/man8/monkeysphere-authentication.8
+++ b/man/man8/monkeysphere-authentication.8
@@ -1,4 +1,4 @@
-.TH MONKEYSPHERE-AUTHENTICATION "8" "January 2010" "monkeysphere" "System Commands"
+.TH MONKEYSPHERE-AUTHENTICATION "8" "July 3, 2010" "monkeysphere" "System Commands"
 
 .SH NAME
 
@@ -42,6 +42,11 @@ Refresh all keys in the monkeysphere-authentication keyring.  If no
 accounts are specified, then all accounts on the system are processed.
 `r' may be used in place of `refresh\-keys'.
 .TP
+.B keys\-for\-user USER
+Output to stdout all acceptable keys for a given user.  User IDs are
+read from the user's authorized_user_ids file (see
+MONKEYSPHERE_AUTHORIZED_USER_IDS below).
+.TP
 .B add\-id\-certifier KEYID|FILE
 Instruct system to trust user identity certifications made by KEYID.
 The key ID will be loaded from the keyserver.  A file may be loaded
diff --git a/src/monkeysphere-authentication b/src/monkeysphere-authentication
index 8c58645..af8c40d 100755
--- a/src/monkeysphere-authentication
+++ b/src/monkeysphere-authentication
@@ -55,6 +55,7 @@ Monkeysphere authentication admin tool.
 subcommands:
  update-users (u) [USER]...        update user authorized_keys files
  refresh-keys (r)                  refresh keys in keyring
+ keys-for-user USER                output valid keys for user
 
  add-id-certifier (c+) KEYID|FILE  import and tsign a certification key
    [--domain (-n) DOMAIN]            limit ID certifications to DOMAIN
@@ -177,6 +178,11 @@ case $COMMAND in
 	gpg_sphere "--keyserver $KEYSERVER --refresh-keys"
 	;;
 
+    'keys-for-user')
+	source "${MASHAREDIR}/keys_for_user"
+	keys_for_user "$@"
+	;;
+
     'add-identity-certifier'|'add-id-certifier'|'add-certifier'|'c+')
 	source "${MASHAREDIR}/setup"
 	setup
diff --git a/src/monkeysphere-authentication-keys-for-user b/src/monkeysphere-authentication-keys-for-user
new file mode 100755
index 0000000..fb589ea
--- /dev/null
+++ b/src/monkeysphere-authentication-keys-for-user
@@ -0,0 +1,2 @@
+#!/usr/bin/env sh
+exec monkeysphere-authentication keys-for-user "$@"
diff --git a/src/share/ma/keys_for_user b/src/share/ma/keys_for_user
new file mode 100644
index 0000000..f48d5d3
--- /dev/null
+++ b/src/share/ma/keys_for_user
@@ -0,0 +1,50 @@
+# -*-shell-script-*-
+# This should be sourced by bash (though we welcome changes to make it POSIX sh compliant)
+
+# Monkeysphere authentication keys-for-user subcommand
+#
+# The monkeysphere scripts are written by:
+# Jameson Rollins <jrollins@finestructure.net>
+# Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+#
+# They are Copyright 2008-2010, and are all released under the GPL,
+# version 3 or later.
+
+# This command could be run as an sshd AuthorizedKeysCommand to
+# provide the authorized keys for a user, based on OpenPGP user id's
+# listed in the user's authorized_user_ids file.
+
+keys_for_user() {
+
+local uname
+local authorizedUserIDs
+local line
+local userIDs
+
+# get users from command line
+uname="$1"
+
+# path to authorized_user_ids file, translating ssh-style path
+# variables
+authorizedUserIDs=$(translate_ssh_variables "$uname" "$AUTHORIZED_USER_IDS")
+
+# exit if the authorized_user_ids file is empty
+if [ ! -s "$authorizedUserIDs" ] ; then
+    failure "authorized_user_ids file '$authorizedUserIDs' is empty or does not exist."
+fi
+
+log debug "authorized_user_ids file: $authorizedUserIDs"
+
+# check permissions on the authorized_user_ids file path
+check_key_file_permissions "$uname" "$authorizedUserIDs" || failure
+
+GNUPGHOME="$GNUPGHOME_SPHERE"
+export GNUPGHOME
+
+# extract user IDs from authorized_user_ids file
+IFS=$'\n'
+for line in $(meat "$authorizedUserIDs") ; do
+    su_monkeysphere_user ". ${SYSSHAREDIR}/common; keys_for_userid '$line'"
+done
+
+}