1 files changed, 22 insertions, 0 deletions

diff --git a/app/controllers/ca.go b/app/controllers/ca.go
index 632db50..c04dcd8 100644
--- a/app/controllers/ca.go
+++ b/app/controllers/ca.go
@@ -11,9 +11,24 @@ import (
         "code.crute.us/mcrute/ssh-proxy/app/middleware"
         "code.crute.us/mcrute/ssh-proxy/app/models"
         "github.com/labstack/echo/v4"
+        "github.com/prometheus/client_golang/prometheus"
+        "github.com/prometheus/client_golang/prometheus/promauto"
         "golang.org/x/crypto/ssh"
 )
 
+var (
+        caError = promauto.NewCounterVec(prometheus.CounterOpts{
+                Namespace: "ssh_proxy",
+                Name:      "ssh_ca_error",
+                Help:      "Total number of errors during SSH CA operation",
+        }, []string{"type"})
+        caSuccess = promauto.NewCounter(prometheus.CounterOpts{
+                Namespace: "ssh_proxy",
+                Name:      "ssh_ca_success",
+                Help:      "Total number of successful CA operations",
+        })
+)
+
 type CASecret struct {
         Key string `mapstructure:"key"`
 }
@@ -57,24 +72,29 @@ func (h *CAHandler) authorizeRequest(c echo.Context, certRequest *ssh.Certificat
         }
 
         if user.Username != certRequest.ValidPrincipals[0] {
+                caError.With(prometheus.Labels{"type": "user_request_mismatch"}).Inc()
                 return fmt.Errorf("Authenticated username and cert username must match")
         }
 
         if !session.HasScope("ca:issue") {
+                caError.With(prometheus.Labels{"type": "missing_oauth_scope"}).Inc()
                 return fmt.Errorf("Authorized session does not have scope ca:issue")
         }
 
         if certRequest.Extensions == nil {
+                caError.With(prometheus.Labels{"type": "no_extensions"}).Inc()
                 return fmt.Errorf("Cert request extensions are empty")
         }
 
         hostLine, ok := certRequest.Extensions["allowed-hosts"]
         if !ok {
+                caError.With(prometheus.Labels{"type": "no_allowed_hosts"}).Inc()
                 return fmt.Errorf("Cert request allowed-hosts is blank")
         }
 
         for _, host := range strings.Split(hostLine, ",") {
                 if !user.AuthorizedForHost(host) {
+                        caError.With(prometheus.Labels{"type": "user_no_auth_host"}).Inc()
                         return fmt.Errorf("User %s is not authorized for host %s", session.UserId, host)
                 }
         }
@@ -168,5 +188,7 @@ func (h *CAHandler) HandleIssue(c echo.Context) error {
                 })
         }
 
+        caSuccess.Inc()
+
         return c.Blob(http.StatusOK, "application/x-ssh-certificate", ssh.MarshalAuthorizedKey(certToIssue))
 }