LocalKeyAgent only loads keys for a user logged into a proxy.

constants.go

@@ -100,6 +100,14 @@ const (
 	// ComponentAuditLog is audit log component
 	ComponentAuditLog = "auditlog"
 
+	// ComponentKeyAgent is an agent that has loaded the sessions keys and
+	// certificates for a user connected to a proxy.
+	ComponentKeyAgent = "keyagent"
+
+	// ComponentKeyStore is all sessions keys and certificates a user has on disk
+	// for all proxies.
+	ComponentKeyStore = "keystore"
+
 	// DebugEnvVar tells tests to use verbose debug output
 	DebugEnvVar = "DEBUG"
 

lib/client/api.go

@@ -389,7 +389,7 @@ func NewClient(c *Config) (tc *TeleportClient, err error) {
 		}
 	} else {
 		// initialize the local agent (auth agent which uses local SSH keys signed by the CA):
-		tc.localAgent, err = NewLocalAgent(c.KeysDir, c.Username)
+		tc.localAgent, err = NewLocalAgent(c.KeysDir, tc.ProxyHost(), c.Username)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -1027,7 +1027,7 @@ func (tc *TeleportClient) ConnectToProxy() (*ProxyClient, error) {
 
 // Logout locates a certificate stored for a given proxy and deletes it
 func (tc *TeleportClient) Logout() error {
-	return trace.Wrap(tc.localAgent.DeleteKey(tc.ProxyHost(), tc.Config.Username))
+	return trace.Wrap(tc.localAgent.DeleteKey())
 }
 
 // Login logs the user into a Teleport cluster by talking to a Teleport proxy.
@@ -1098,13 +1098,13 @@ func (tc *TeleportClient) Login(activateKey bool) (*Key, error) {
 		}
 
 		// save the list of TLS CAs client trusts
-		err = tc.localAgent.SaveCerts(tc.ProxyHost(), response.HostSigners)
+		err = tc.localAgent.SaveCerts(response.HostSigners)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 
 		// save the cert to the local storage (~/.tsh usually):
-		_, err = tc.localAgent.AddKey(tc.ProxyHost(), tc.Config.Username, key)
+		_, err = tc.localAgent.AddKey(key)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -1144,7 +1144,7 @@ func (tc *TeleportClient) AddTrustedCA(ca services.CertAuthority) error {
 	// only host CA has TLS certificates, user CA will overwrite trusted certs
 	// to empty file if called
 	if ca.GetType() == services.HostCA {
-		err = tc.LocalAgent().SaveCerts(tc.ProxyHost(), auth.AuthoritiesToTrustedCerts([]services.CertAuthority{ca}))
+		err = tc.LocalAgent().SaveCerts(auth.AuthoritiesToTrustedCerts([]services.CertAuthority{ca}))
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -1154,7 +1154,7 @@ func (tc *TeleportClient) AddTrustedCA(ca services.CertAuthority) error {
 }
 
 func (tc *TeleportClient) AddKey(host string, key *Key) (*agent.AddedKey, error) {
-	return tc.localAgent.AddKey(host, tc.Username, key)
+	return tc.localAgent.AddKey(key)
 }
 
 // directLogin asks for a password + HOTP token, makes a request to CA via proxy

lib/client/client.go

@@ -168,23 +168,21 @@ func (proxy *ProxyClient) ConnectToSite(ctx context.Context, quiet bool) (auth.C
 
 	tlsConfig := utils.TLSConfig()
 	localAgent := proxy.teleportClient.LocalAgent()
-	pool, err := localAgent.GetCerts(proxy.teleportClient.ProxyHost())
+	pool, err := localAgent.GetCerts()
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	tlsConfig.RootCAs = pool
-	keys, err := localAgent.GetKeys(proxy.teleportClient.Username)
+	key, err := localAgent.GetKey()
 	if err != nil {
-		return nil, trace.Wrap(err, "failed to fetch TLS keys for %v", proxy.teleportClient.Username)
+		return nil, trace.Wrap(err, "failed to fetch TLS key for %v", proxy.teleportClient.Username)
 	}
-	for _, key := range keys {
-		if len(key.TLSCert) != 0 {
-			tlsCert, err := tls.X509KeyPair(key.TLSCert, key.Priv)
-			if err != nil {
-				return nil, trace.Wrap(err, "failed to parse TLS cert and key")
-			}
-			tlsConfig.Certificates = append(tlsConfig.Certificates, tlsCert)
+	if len(key.TLSCert) != 0 {
+		tlsCert, err := tls.X509KeyPair(key.TLSCert, key.Priv)
+		if err != nil {
+			return nil, trace.Wrap(err, "failed to parse TLS cert and key")
 		}
+		tlsConfig.Certificates = append(tlsConfig.Certificates, tlsCert)
 	}
 	if len(tlsConfig.Certificates) == 0 {
 		return nil, trace.BadParameter("no TLS keys found for user %v, please relogin to get new credentials", proxy.teleportClient.Username)