Skip to content

AuthorizedPrincipalsFile behavior does not match AuthorizedKeysFile #2423

@Nnnes

Description

@Nnnes

Prerequisites

  • Write a descriptive title.
  • Make sure you are able to repro it on the latest version
  • Search the existing issues.

Steps to reproduce

The sshd_config directive AuthorizedPrincipalsFile fails to read many formats.

  1. sign a user key with a principal that is not a valid username on the server
  2. create $env:USERPROFILE\.ssh\authorized_principals on the server and add the principal
  3. make sure all other forms of authentication are disabled for that user
  4. add AuthorizedPrincipalsFile .ssh/authorized_principals to sshd_config (same format as AuthorizedKeysFile .ssh/authorized_keys)
  5. observe that logging in fails with error: Certificate does not contain an authorized principal in the sshd log

Expected behavior

`AuthorizedPrincipalsFile` has the same behavior as `AuthorizedKeysFile`

Actual behavior

The following fail:


AuthorizedPrincipalsFile .ssh/authorized_principals
AuthorizedPrincipalsFile .ssh\authorized_principals
AuthorizedPrincipalsFile %h/.ssh/authorized_principals
AuthorizedPrincipalsFile %h\.ssh\authorized_principals
AuthorizedPrincipalsFile C:\Users\%u\.ssh\authorized_principals


This one works:


AuthorizedPrincipalsFile C:/Users/%u/.ssh/authorized_principals

Error details

Environment data

PSVersion                      5.1.26100.7462
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.26100.7462
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

Version

OpenSSH_for_Windows_10.0p2 Win32-OpenSSH-GitHub, LibreSSL 4.2.0

Visuals

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions