mirror of
https://github.com/stablyai/orca.git
synced 2026-09-22 16:02:32 +00:00
0302ae86b8
* feat(ssh): support Kerberos/GSSAPI hosts via the system OpenSSH transport ssh2 has no gssapi-with-mic support, and adding it would mean forking its protocol layer plus packaging the kerberos native module for three platforms. Instead, route GSSAPI hosts through the existing system-OpenSSH transport, which delegates Kerberos (tickets, SSPI on Windows) to the platform ssh binary. Two tiers, because RHEL-family distros enable GSSAPIAuthentication globally in /etc/ssh/ssh_config and ssh -G therefore reports it for every host: - Targets whose ~/.ssh/config Host block explicitly sets GSSAPIAuthentication yes (imported as target.gssapiAuthentication) try system ssh first, falling through to ssh2 so key auth and credential prompts still work when no ticket is available. - When ssh2 exhausts key/agent auth and the ssh -G-resolved config enables GSSAPI, retry over system ssh before prompting for credentials, so Kerberos-only hosts on distro-default configs connect without a password prompt. Hosts where keys work never leave the ssh2 path. Manual targets flagged for GSSAPI pass -o GSSAPIAuthentication=yes explicitly since they bypass ssh_config. Both tiers work headless (no credential callbacks required). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ssh): harden GSSAPI transport selection (review fixes for PR #7507) Review fixes on top of the Kerberos/GSSAPI feature branch (s546126/kerberos-ssh): - HIGH: reset useSystemSshTransport on the ssh2 fall-through. doSystemSshProbe sets the flag before spawnSystemSshCommand, which throws synchronously when no system ssh binary is on PATH (outside the probe try/catch). The proactive fall-through previously reset only 2 of 3 transport fields, so exec/sftp kept routing through the failed transport - breaking GSSAPI on Windows-with-Git-ssh and headless Linux. - MEDIUM: throw a cancellation error (not the stale ssh2 authError) when a disconnect supersedes the reactive probe mid-flight, and guard connect()'s catch on disposed, so a deliberate disconnect is not overwritten with auth-failed. - MEDIUM: skip the encrypted-key passphrase prompt when the GSSAPI fallback applies, so a Kerberos ticket is tried before prompting; the general prompt still fires if the probe fails. Adds 3 mutation-verified regression tests and hardens two existing tests to assert the probe actually ran. Not connected to any PR remote. Co-authored-by: Orca <help@stably.ai> * fix(ssh): isolate GSSAPI system transport Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: s546126 <268420947+s546126@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com> Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com> Co-authored-by: Orca <help@stably.ai>
40 lines
2.1 KiB
Markdown
40 lines
2.1 KiB
Markdown
# Kerberos / GSSAPI SSH Authentication
|
|
|
|
Orca's ssh2-based SSH stack cannot speak `gssapi-with-mic` — the ssh2 library
|
|
has no GSSAPI userauth support, and adding it would mean forking ssh2's
|
|
protocol layer plus shipping the `kerberos` native module (MIT krb5 / Heimdal /
|
|
Windows SSPI) as a prebuilt Electron dependency on three platforms. Instead,
|
|
hosts that need Kerberos ride the existing **system OpenSSH transport** — the
|
|
same parallel transport already used for `ProxyCommand`/`ProxyJump` hosts —
|
|
which delegates GSSAPI, ticket lookup (`kinit` cache, Windows domain logon),
|
|
and credential delegation to the platform's own `ssh` binary on macOS, Linux,
|
|
and Windows (Win32-OpenSSH uses SSPI).
|
|
|
|
## Transport selection
|
|
|
|
Two tiers, deliberately asymmetric because RHEL-family distros ship
|
|
`GSSAPIAuthentication yes` in the global `/etc/ssh/ssh_config`, which makes
|
|
`ssh -G` report GSSAPI enabled for *every* host:
|
|
|
|
1. **Proactive** — a target with `gssapiAuthentication: true` (parsed from an
|
|
explicit `GSSAPIAuthentication yes` in the host's `~/.ssh/config` block, or
|
|
set on the target directly) tries the system-ssh probe first. If that fails
|
|
(e.g. no ticket), the connect falls through to the normal ssh2 key/agent
|
|
path where passphrase/password prompts remain available — OpenSSH semantics
|
|
allow other auth methods alongside GSSAPI.
|
|
2. **Auth-failure fallback** — when ssh2 exhausts key/agent auth and the
|
|
`ssh -G`-resolved config enables GSSAPI (`isGssapiSystemSshFallbackCandidate`
|
|
in `ssh-connection-utils.ts`), the connection retries over system ssh
|
|
*before* prompting the user for credentials. Kerberos-only hosts on
|
|
distro-default configs connect this way; hosts where keys work never leave
|
|
the ssh2 path.
|
|
|
|
Manual (non-ssh-config) targets flagged for GSSAPI get an explicit
|
|
`-o GSSAPIAuthentication=yes` in `system-ssh-args.ts`; config-backed targets
|
|
inherit the option from their own `Host` block since the system binary re-reads
|
|
ssh_config.
|
|
|
|
Both tiers work headless (`orca serve`): the system-ssh probe needs no
|
|
credential callbacks, and GSSAPI itself is non-interactive once a ticket
|
|
exists.
|