search

NoMoreFood / putty-cac

Windows Secure Shell Client With Support For Smart Cards, Certificates, & FIDO Keys
470 stars 43 forks source link

Enhancement request: Hint support #136

Closed work-bw closed 1 week ago

work-bw commented 1 month ago

Is it possible to add hint support? I was hoping to use a specific cert with a specific username hint and have that hint passed to putty-gen instead of the cert. However in the window that pops up with putty-gen I can only enter a PIN. It would be nice if the window included a hint field but if that's too hard to implement maybe on the Connection / SSH / Certificate screen the user could hard code a hint to the saved session. If it already exists somewhere please point me to it. Thanks.

Brian

NoMoreFood commented 1 month ago

I guess I don't understand what you're asking. What's the purpose of the hint? You should already know what certificate / card and PIN is associated with whatever you are connecting to.

work-bw commented 1 month ago

A username hint informs the program (putty-cac) which account the user is trying to log in with if the certificate is associated with multiple accounts. I don't need hint support if there is a 1:1 mapping between a certificate and a userid. But if I have a cert that maps to multiple users, then I can use a hint to tell the program which user I want to use when the cert is presented to the program. If using a cert that maps to multiple users is just not possible and can only be done with a 1:1 mapping that's fine. I just wanted to ask. Thanks.

NoMoreFood commented 3 weeks ago

If you connection profile has a certificate associated with it, it will that public key to the SSH server which of course then has to be in ~/.ssh/authorized_keys. If you also have pageant running, it will still prefer the certificate identified in the connection profile.

I guess I'm still not sure what problem we are trying to solve here. Are saying you just wish the PIN field would display the certificate CN or something along those lines? If so, the Cert Auth Prompting feature might satisfy your use case.

NoMoreFood commented 1 week ago

Closing due to non-responsiveness. Will re-open if the requestor responds (or somebody else can help me understand what they are asking for).