// canLoginWithoutRBAC checks the given certificate (supplied by a connected
// client) to see if this certificate can be allowed to login as user:login
// pair to requested server.
555979
func (h *AuthHandlers) canLoginWithoutRBAC(cert *ssh.Certificate, clusterName string, teleportUser, osUser string) error {
	h.Debugf("Checking permissions for (%v,%v) to login to node without RBAC checks.", teleportUser, osUser)

	// check if the ca that signed the certificate is known to the cluster
	_, err := h.authorityForCert(services.UserCA, cert.SignatureKey)
	if err != nil {
		return trace.Wrap(err)
	}

	return nil
}
50916
func (k *KeybaseServiceBase) LoggedOut(ctx context.Context) error {
	k.log.CDebugf(ctx, "Current session logged out")
	k.setCachedCurrentSession(idutil.SessionInfo{})
	if k.config != nil {
		serviceLoggedOut(ctx, k.config)
	}
	return nil
}
878149
func (n *RequestObserver) Login(entity names.Tag, model names.ModelTag, fromController bool, userData string) {
	n.state.tag = entity.String()
	n.state.fromController = fromController
	if n.isAgent(entity) {
		n.state.agent = true
		n.state.model = model.Id()
		// Don't log connections from the controller to the model.
		if !n.state.fromController {
			n.connLogger.Infof("agent login: %s for %s", n.state.tag, n.state.model)
		}
		n.hub.Publish(apiserver.ConnectTopic, apiserver.APIConnection{
			AgentTag:        n.state.tag,
			ControllerAgent: fromController,
			ModelUUID:       model.Id(),
			ConnectionID:    n.state.id,
			UserData:        userData,
		})
	}
}
1204222
func (h *Handler) AuthenticationRedirect(w http.ResponseWriter, req *http.Request) error {
	klog.V(4).Infof("Authentication needed for %v", h.provider)

	authReq := h.client.NewAuthorizeRequest(osincli.CODE)
	h.provider.AddCustomParameters(authReq)

	state, err := h.state.Generate(w, req)
	if err != nil {
		klog.V(4).Infof("Error generating state: %v", err)
		return err
	}

	oauthURL := authReq.GetAuthorizeUrlWithParams(state)
	klog.V(4).Infof("redirect to %v", oauthURL)

	http.Redirect(w, req, oauthURL.String(), http.StatusFound)
	return nil
}
959454
func FromGatewayTokenWithoutValidation(gatewayToken string) (*GatewayClaims, error) {
	claims := &GatewayClaims{}
	return claims, fromTokenWithoutValidation(gatewayToken, claims)
}
543652
func (sc *serverConn) authPlain() error {
	m := &msg{
		header: header{
			Op: opAuthStart,
		},

		key: "PLAIN",
		val: fmt.Sprintf("\x00%s\x00%s", sc.username, sc.password),
	}

	return sc.sendRecv(m)
}
1277613
func (cmd *login) Logout(ctx context.Context) error {
	if cmd.long || cmd.clone || cmd.issue {
		return nil
	}
	return cmd.ClientFlag.Logout(ctx)
}
1340636
func (e Endpoint) urlWithoutPath() string {
	return fmt.Sprintf("%s://%s", e.scheme(), e.SocketAddress())
}
1115639
func (c *Configurator) OutgoingTLSConfigForCheck(skipVerify bool) *tls.Config {
	c.log("OutgoingTLSConfigForCheck")
	if !c.enableAgentTLSForChecks() {
		return &tls.Config{
			InsecureSkipVerify: skipVerify,
		}
	}

	config := c.commonTLSConfig(false)
	config.InsecureSkipVerify = skipVerify
	config.ServerName = c.serverNameOrNodeName()

	return config
}
48214
func fromTokenWithoutValidation(token string, claims jwt.Claims) error {
	parts := strings.Split(token, ".")
	if len(parts) != 3 {
		return errors.New("Invalid access token segments")
	}

	segment, err := jwt.DecodeSegment(parts[1])
	if err != nil {
		return err
	}

	err = json.Unmarshal(segment, claims)
	if err != nil {
		return err
	}

	return nil
}
1178667
func ConnectWithKeyTimeout(host, username, privKey string, timeout time.Duration) (*Client, error) {
	signer, err := ssh.ParsePrivateKey([]byte(privKey))
	if err != nil {
		return nil, err
	}

	authMethod := ssh.PublicKeys(signer)

	return connect(username, host, authMethod, timeout)
}
581695
func (c *Client) execWithAddrTimeout(urp bool, srv ServerInfo, timeout int, a ...interface{}) (v interface{}, err error) {
	cn, err := c.getConn(srv)
	if err != nil {
		return nil, err
	}
	cn.extendDeadline(time.Duration(timeout) * time.Second)
	defer cn.condRelease(&err)
	if urp {
		v, err = c.executeURP(cn.rw, a...)
	} else {
		v, err = c.execute(cn.rw, a...)
	}
	return v, err
}
419694
func (s *AuthServer) CreateUserWithoutOTP(token string, password string) (services.WebSession, error) {
	authPreference, err := s.GetAuthPreference()
	if err != nil {
		return nil, trace.Wrap(err)
	}
	if authPreference.GetSecondFactor() != teleport.OFF {
		return nil, trace.AccessDenied("missing second factor")
	}
	tokenData, err := s.GetSignupToken(token)
	if err != nil {
		log.Warningf("failed to get signup token: %v", err)
		return nil, trace.AccessDenied("expired or incorrect signup token")
	}

	err = s.UpsertPassword(tokenData.User.Name, []byte(password))
	if err != nil {
		return nil, trace.Wrap(err)
	}

	// create services.User and services.WebSession
	webSession, err := s.createUserAndSession(tokenData)
	if err != nil {
		return nil, trace.Wrap(err)
	}

	return webSession, nil
}
1116352
func (c *LogoutController) Logout(ctx *app.LogoutLogoutContext) error {
	return redirectWithParams(ctx, c.configuration, ctx.ResponseData.Header(), ctx.Params, authservice.LogoutLogoutPath())
}
139560
func WithCredentials(cp *mysql.ConnParams) (*mysql.ConnParams, error) {
	result := *cp
	user, passwd, err := GetCredentialsServer().GetUserAndPassword(cp.Uname)
	switch err {
	case nil:
		result.Uname = user
		result.Pass = passwd
	case ErrUnknownUser:
		// we just use what we have, and will fail later anyway
		err = nil
	}
	return &result, err
}
1055690
func (c *Client) Logout(sessionID string) error {
	payload := &Request{
		Action: "logout",
		Param: &LogoutRequest{
			CustomerNumber:  c.customerNumber,
			APIKey:          c.apiKey,
			APISessionID:    sessionID,
			ClientRequestID: "",
		},
	}

	err := c.doRequest(payload, nil)
	if err != nil {
		return fmt.Errorf("logout error: %v", err)
	}

	return nil
}
720884
func (f *Instance) Login(entity names.Tag, model names.ModelTag, fromController bool, userData string) {
	f.AddCall(funcName(), entity, model, fromController, userData)
}