alknet/tasks/auth/server-auth-handler.md at f8b4fb66b3142627e3e1392afea33812cd5a7dae

Files

glm-5.1 5c820a41e9 tasks: decompose Phase 0a ADR foundation and mark prior tasks completed

Add 10 new tasks under tasks/architecture/ for Phase 0a (ADR writing):
- 9 ADR tasks (026-034) with dependency-ordered structure
- 1 review checkpoint task before Phase 0b spec writing

ADR dependency graph (3 generations):
  Gen 1 (parallel): 026, 029, 030, 031, 032, 034
  Gen 2 (depends on 029): 027, 028
  Gen 3 (depends on 027+028): 033
  Gen 4: review checkpoint

Also mark all 34 prior implementation tasks as completed — they
were finished but still showing as pending in the taskgraph.

2026-06-07 08:55:33 +00:00

2.1 KiB

Raw Blame History

id, name, status, depends_on, scope, risk, impact, level

name

status

depends_on

scope

risk

impact

level

auth/server-auth-handler

Implement server-side authentication (Ed25519 keys + OpenSSH cert-authority)

completed

auth/key-loading

auth/error-types

moderate

medium

component

implementation

Description

Implement the server-side SSH authentication logic per ADR-012:

Ed25519 public key: auth_publickey() checks presented key against the authorized set using constant-time comparison
OpenSSH certificate authority: validates presented certificate — checks CA signature, expiry, and principal restrictions (permit-port-forwarding, no-pty, source-address)

No password authentication over SSH. This is the russh::server::Handler::auth_publickey() implementation that the server handler will call.

Acceptance Criteria

crates/alknet-core/src/auth/server_auth.rs exports ServerAuthConfig and auth logic
ServerAuthConfig holds: authorized_keys: HashSet<PublicKey>, cert_authorities: Vec<CertAuthorityEntry>
ServerAuthConfig::from_keys_and_ca() constructor: loads authorized keys and cert-authority entries from provided key sources
Auth check function: given a presented key/certificate, return Accept or Reject
Ed25519 key matching uses constant-time comparison (via russh/ssh-key crate builtins)
Certificate validation checks: CA signature valid, cert not expired, principal restrictions enforced
Certificate options respected: permit-port-forwarding, no-pty, source-address
Returns AuthError::KeyRejected or AuthError::CertInvalid/CertExpired/CertPrincipalMismatch on failure
Unit tests: valid key accepted, invalid key rejected, cert-authority signed cert accepted, expired cert rejected, wrong principal rejected

References

docs/architecture/server.md — Authentication section
docs/architecture/decisions/012-auth-ed25519-and-cert-authority.md — ADR for key + cert-authority
docs/architecture/client.md — "Authentication is Ed25519 public key or OpenSSH certificate"

Notes

To be filled by implementation agent

Summary

To be filled on completion

2.1 KiB Raw Blame History