Proto changes for supporting HSM in Windows Desktop and Database access w/AD (#55428)

* Proto changes for HSM support in AD

* Database CRLDomain

* Update api/proto/teleport/legacy/types/events/events.proto

Co-authored-by: Zac Bergquist <[email protected]>

* Split ID to domain and type

---------

Co-authored-by: Zac Bergquist <[email protected]>

api/proto/teleport/legacy/client/proto/authservice.proto

@@ -1089,7 +1089,14 @@ message DatabaseCertRequest {
   Extensions CertificateExtensions = 6 [(gogoproto.jsontag) = "certificate_extensions"];
 
   // CRLEndpoint is a certificate revocation list distribution point. Required for Windows smartcard certs.
-  string CRLEndpoint = 7 [(gogoproto.jsontag) = "crl_endpoint"];
+  // DEPRECATED: use CRLDomain instead.
+  string CRLEndpoint = 7 [
+    (gogoproto.jsontag) = "crl_endpoint",
+    deprecated = true
+  ];
+
+  // CRLDomain is the Active Directory domain where CRLs are published.
+  string CRLDomain = 8 [(gogoproto.jsontag) = "crl_domain"];
 }
 
 // DatabaseCertResponse contains the signed certificate.
@@ -1635,9 +1642,12 @@ message WindowsDesktopCertRequest {
   // CSR is the request to sign in PEM format.
   bytes CSR = 1;
   // CRLEndpoint is the address of the CRL for this certificate.
-  string CRLEndpoint = 2;
+  // DEPRECATED: use CRLDomain instead.
+  string CRLEndpoint = 2 [deprecated = true];
   // TTL is the certificate validity period.
   int64 TTL = 3 [(gogoproto.casttype) = "Duration"];
+  // CRLDomain is the Active Directory domain where CRLs are published.
+  string CRLDomain = 4;
 }
 
 // WindowsDesktopCertResponse contains the signed Windows RDP certificate.

api/proto/teleport/legacy/types/events/events.proto

@@ -3956,6 +3956,19 @@ message CertificateCreate {
     (gogoproto.embed) = true,
     (gogoproto.jsontag) = ""
   ];
+
+  // CertificateAuthority holds information about the issuer of the certificate.
+  CertificateAuthority CertificateAuthority = 5 [(gogoproto.jsontag) = "certificate_authority"];
+}
+
+// CertificateAuthority holds information about the issuer of the certificate.
+message CertificateAuthority {
+  // Type of the cert authority
+  string Type = 1 [(gogoproto.jsontag) = "type,omitempty"];
+  // Domain of the cert authority
+  string Domain = 2 [(gogoproto.jsontag) = "domain,omitempty"];
+  // SubjectKeyID is BASE32-encoded subject key ID from authority certificate
+  string SubjectKeyID = 3 [(gogoproto.jsontag) = "subject_key_id,omitempty"];
 }
 
 // RenewableCertificateGenerationMismatch is emitted when a renewable

api/proto/teleport/legacy/types/types.proto

@@ -1237,6 +1237,8 @@ message TLSKeyPair {
   bytes Key = 2 [(gogoproto.jsontag) = "key,omitempty"];
   // KeyType is the type of the Key.
   PrivateKeyType KeyType = 3 [(gogoproto.jsontag) = "key_type,omitempty"];
+  // CRL is an empty DER-encoded revocation list.
+  bytes CRL = 4 [(gogoproto.jsontag) = "crl"];
 }
 
 // JWTKeyPair is a PEM encoded keypair used for signing JWT tokens.

api/types/authority.go

@@ -556,6 +556,7 @@ func (k *TLSKeyPair) Clone() *TLSKeyPair {
 		KeyType: k.KeyType,
 		Key:     slices.Clone(k.Key),
 		Cert:    slices.Clone(k.Cert),
+		CRL:     slices.Clone(k.CRL),
 	}
 }
 

api/types/trust.go

@@ -18,6 +18,7 @@ package types
 
 import (
 	"fmt"
+	"slices"
 	"strings"
 	"time"
 
@@ -72,7 +73,8 @@ const (
 )
 
 // CertAuthTypes lists all certificate authority types.
-var CertAuthTypes = []CertAuthType{HostCA,
+var CertAuthTypes = []CertAuthType{
+	HostCA,
 	UserCA,
 	DatabaseCA,
 	DatabaseClientCA,
@@ -125,10 +127,8 @@ const authTypeNotSupported string = "authority type is not supported"
 
 // Check checks if certificate authority type value is correct
 func (c CertAuthType) Check() error {
-	for _, caType := range CertAuthTypes {
-		if c == caType {
-			return nil
-		}
+	if slices.Contains(CertAuthTypes, c) {
+		return nil
 	}
 
 	return trace.BadParameter("%q %s", c, authTypeNotSupported)