$schema: https://json-schema.org/draft/2020-12/schema
title: ester authentication
description: Authentication and authorization configuration for ester
definitions:
  reltime:
    oneOf:
    - type: integer
    - type: string
      pattern: "^[1-9][0-9]*[smhdwy]$"
  dn:
    type: string
    pattern: ^([^=]+=[^,]+,)+([^=]+=[^,]+)$
  ipAddressCidr:
    type: string
    pattern: ^([0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]{1,2}$
  ip6AddressCidr:
    type: string
    pattern: ^([0-9a-f]{0,4}:){2,7}[0-9a-f]{0,4}/[0-9]{1,3}$
  ip46AddressCidr:
    oneOf:
    - $ref: "#/definitions/ipAddressCidr"
    - $ref: "#/definitions/ip6AddressCidr"
  crypt:
    type: string
    pattern: "^\\$[156]\\$.*$"
  issue:
    type: object
    required:
    - lifetime
    additionalProperties: false
    properties:
      lifetime:
        $ref: "#/definitions/reltime"
      subject:
        $ref: "#/definitions/dn"
      subject-altname:
        type: string
      blocks:
        type: array
        items:
          $ref: "#/definitions/ip46AddressCidr"
      eku:
        type: array
        items:
          enum:
          - server
          - client
          - code
      ca:
        type: object
        additionalProperties: false
        properties:
          pathlen:
            type: integer
            minimum: 0
      require-approval:
        type: boolean
  list:
    type: object
    additionalProperties: false
    properties:
      subject:
        $ref: "#/definitions/dn"
  revoke:
    type: object
    additionalProperties: false
    properties:
      subject:
        $ref: "#/definitions/dn"
  audit:
    type: object
    additionalProperties: false
    properties:
      view:
        type: boolean
type: object
additionalProperties: false
properties:
  users:
    type: object
    additionalProperties: false
    patternProperties:
      ^.*$:
        type: object
        required:
        - password
        additionalProperties: false
        properties:
          password:
            $ref: "#/definitions/crypt"
          issue:
            $ref: "#/definitions/issue"
          list:
            $ref: "#/definitions/list"
          revoke:
            $ref: "#/definitions/revoke"
          audit:
            $ref: "#/definitions/audit"
  cert:
    type: object
    additionalProperties: false
    patternProperties:
      ^([^=]+=[^,]+,)+([^=]+=[^,]+)$:
        type: object
        additionalProperties: false
        properties:
          issuer-chain:
            type: array
            items:
              $ref: "#/definitions/dn"
          issue:
            $ref: "#/definitions/issue"
          list:
            $ref: "#/definitions/list"
          revoke:
            $ref: "#/definitions/revoke"
          audit:
            $ref: "#/definitions/audit"
