Method OnNetworkConnection

internal/authintegration/handler.go:66–104

(meta metadata.ConnectionMetadata)

}

func (h *handler) OnNetworkConnection(meta metadata.ConnectionMetadata) (
	sshserver.NetworkConnectionHandler,
	metadata.ConnectionMetadata,
	error,
) {
	var backend sshserver.NetworkConnectionHandler = nil
	var err error
	if h.backend != nil {
		backend, meta, err = h.backend.OnNetworkConnection(meta)
		if err != nil {
			return nil, meta, err
		}
	}

	authHandler := networkConnectionHandler{
		connectionID:                     meta.ConnectionID,
		ip:                               meta.RemoteAddress.IP,
		backend:                          backend,
		behavior:                         h.behavior,
		passwordAuthenticator:            h.passwordAuthenticator,
		publicKeyAuthenticator:           h.publicKeyAuthenticator,
		gssapiAuthenticator:              h.gssapiAuthenticator,
		keyboardInteractiveAuthenticator: h.keyboardInteractiveAuthenticator,
		authorizationProvider:            h.authorizationProvider,
	}

	if h.authorizationProvider != nil {
		// We inject the authz handler before the normal authentication handler in the chain as we need the authenticated metadata the handler returns.
		// Authentications request will first hit the authz handler which will pass it through to the authHandler, once it returns we can perform authorization.
		authzHandler := authzNetworkConnectionHandler{
			connectionID:          meta.ConnectionID,
			ip:                    meta.RemoteAddress.IP,
			authorizationProvider: h.authorizationProvider,
			backend:               &authHandler,
		}
		return &authzHandler, meta, nil
	}
	return &authHandler, meta, nil
}

type networkConnectionHandler struct {
	backend                          sshserver.NetworkConnectionHandler