add signature algorithm suite to ping response (#44567)

* add signature algorithm suite to ping response * type fix Co-authored-by: Tiago Silva <[email protected]> --------- Co-authored-by: Tiago Silva <[email protected]>
gravitational · Jul 24, 2024 · bca26e0 · bca26e0
1 parent f03639b
commit bca26e0
Show file tree

Hide file tree

Showing 4 changed files with 17 additions and 2 deletions.
diff --git a/api/client/webclient/webclient.go b/api/client/webclient/webclient.go
@@ -420,6 +420,9 @@ type AuthenticationSettings struct {
 	// DefaultSessionTTL is the TTL requested for user certs if
 	// a TTL is not otherwise specified.
 	DefaultSessionTTL types.Duration `json:"default_session_ttl"`
+	// SignatureAlgorithmSuite is the configured signature algorithm suite for
+	// the cluster.
+	SignatureAlgorithmSuite types.SignatureAlgorithmSuite `json:"signature_algorithm_suite,omitempty"`
 }
 
 // LocalSettings holds settings for local authentication.

diff --git a/api/types/signaturealgorithmsuite.go b/api/types/signaturealgorithmsuite.go
@@ -22,8 +22,8 @@ import (
 
 // MarshalText marshals a SignatureAlgorithmSuite value to text. This gets used
 // by json.Marshal.
-func (s *SignatureAlgorithmSuite) MarshalText() ([]byte, error) {
-	switch *s {
+func (s SignatureAlgorithmSuite) MarshalText() ([]byte, error) {
+	switch s {
 	case SignatureAlgorithmSuite_SIGNATURE_ALGORITHM_SUITE_LEGACY:
 		return []byte("legacy"), nil
 	case SignatureAlgorithmSuite_SIGNATURE_ALGORITHM_SUITE_BALANCED_V1:

diff --git a/lib/web/apiserver.go b/lib/web/apiserver.go
@@ -1326,6 +1326,7 @@ func getAuthSettings(ctx context.Context, authClient authclient.ClientI) (webcli
 	}
 	as.LoadAllCAs = pingResp.LoadAllCAs
 	as.DefaultSessionTTL = authPreference.GetDefaultSessionTTL()
+	as.SignatureAlgorithmSuite = authPreference.GetSignatureAlgorithmSuite()
 
 	return as, nil
 }

diff --git a/lib/web/apiserver_ping_test.go b/lib/web/apiserver_ping_test.go
@@ -75,6 +75,17 @@ func TestPing(t *testing.T) {
 				webCfg, _ := cap.GetWebauthn()
 				require.NotNil(t, resp.Auth.Webauthn)
 				assert.Equal(t, webCfg.RPID, resp.Auth.Webauthn.RPID)
+
+				assert.Equal(t, types.SignatureAlgorithmSuite_SIGNATURE_ALGORITHM_SUITE_UNSPECIFIED, resp.Auth.SignatureAlgorithmSuite)
+			},
+		},
+		{
+			name: "OK signature algorithm suite",
+			spec: &types.AuthPreferenceSpecV2{
+				SignatureAlgorithmSuite: types.SignatureAlgorithmSuite_SIGNATURE_ALGORITHM_SUITE_BALANCED_V1,
+			},
+			assertResp: func(cap types.AuthPreference, resp *webclient.PingResponse) {
+				assert.Equal(t, types.SignatureAlgorithmSuite_SIGNATURE_ALGORITHM_SUITE_BALANCED_V1, resp.Auth.SignatureAlgorithmSuite)
 			},
 		},
 		{