From b0a56b1cfb9c8350ddff3362364dc57c26bcafae Mon Sep 17 00:00:00 2001 From: Suma Yaghi Date: Tue, 19 May 2026 16:21:01 -0400 Subject: [PATCH 1/5] Adding list leaf for SSH public keys --- release/models/system/openconfig-aaa.yang | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/release/models/system/openconfig-aaa.yang b/release/models/system/openconfig-aaa.yang index 2a76f13bc3..2302e45ef7 100644 --- a/release/models/system/openconfig-aaa.yang +++ b/release/models/system/openconfig-aaa.yang @@ -400,6 +400,25 @@ module openconfig-aaa { description "SSH public key for the user (RSA or DSA)"; } + + list authorized-ssh-keys { + key "key-name"; + max-elements 10; + description + "Authorized SSH public keys for the user"; + + leaf key-name { + type string; + description + "The name with which to reference the authorized SSH public key"; + } + + leaf authorized-ssh-key { + type string; + description + "Authorized SSH public key for the user"; + } + } leaf role { type union { From 53d3cbbfc464d724a3cf669f8015b9e02e5330ef Mon Sep 17 00:00:00 2001 From: Suma Yaghi Date: Thu, 21 May 2026 17:00:42 -0400 Subject: [PATCH 2/5] Moving the list to the user container --- release/models/system/openconfig-aaa.yang | 68 ++++++++++++++++------- 1 file changed, 49 insertions(+), 19 deletions(-) diff --git a/release/models/system/openconfig-aaa.yang b/release/models/system/openconfig-aaa.yang index 2302e45ef7..d3fd71d202 100644 --- a/release/models/system/openconfig-aaa.yang +++ b/release/models/system/openconfig-aaa.yang @@ -400,25 +400,6 @@ module openconfig-aaa { description "SSH public key for the user (RSA or DSA)"; } - - list authorized-ssh-keys { - key "key-name"; - max-elements 10; - description - "Authorized SSH public keys for the user"; - - leaf key-name { - type string; - description - "The name with which to reference the authorized SSH public key"; - } - - leaf authorized-ssh-key { - type string; - description - "Authorized SSH public key for the user"; - } - } leaf role { type union { @@ -439,6 +420,23 @@ module openconfig-aaa { description "Operational state data for local users"; } + + grouping authorized-ssh-key-config { + description + "Configuration data for user SSH keys"; + + leaf key-name { + type string; + description + "The name with which to reference the authorized SSH public key"; + } + + leaf authorized-ssh-key { + type string; + description + "Authorized SSH public key for the user"; + } + } grouping aaa-authentication-user-top { description @@ -477,6 +475,38 @@ module openconfig-aaa { uses aaa-authentication-user-config; uses aaa-authentication-user-state; } + + container authorized-ssh-keys { + description + "Top-level container for authorized SSH keys"; + + list authorized-ssh-key { + key "key-name"; + description + "Authorized SSH public keys for the user"; + + leaf key-name { + type leafref { + path "../config/key-name"; + } + description + "References the key name in the configuration block"; + } + + container config { + description + "Configuration data for the authorized SSH key"; + uses authorized-ssh-key-config; + } + + container state { + config false; + description + "Operational state data for the authorized SSH key"; + uses authorized-ssh-key-config; + } + } + } } } From ac7b9596fb09eab5bb083ac9d4af0a2a83da07f0 Mon Sep 17 00:00:00 2001 From: Suma Yaghi Date: Mon, 25 May 2026 11:11:46 -0400 Subject: [PATCH 3/5] Updating description for authorized-ssh-key --- release/models/system/openconfig-aaa.yang | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/release/models/system/openconfig-aaa.yang b/release/models/system/openconfig-aaa.yang index d3fd71d202..b50c2c588b 100644 --- a/release/models/system/openconfig-aaa.yang +++ b/release/models/system/openconfig-aaa.yang @@ -434,7 +434,7 @@ module openconfig-aaa { leaf authorized-ssh-key { type string; description - "Authorized SSH public key for the user"; + "Authorized SSH public key for the user (RSA or ECDSA)"; } } @@ -483,7 +483,7 @@ module openconfig-aaa { list authorized-ssh-key { key "key-name"; description - "Authorized SSH public keys for the user"; + "Authorized SSH public keys for the user (RSA or ECDSA)"; leaf key-name { type leafref { From 46bb298b37143a9fa731aa1d1a6c4045783f488d Mon Sep 17 00:00:00 2001 From: Suma Yaghi Date: Wed, 24 Jun 2026 13:13:00 -0400 Subject: [PATCH 4/5] Making requested edits --- release/models/system/openconfig-aaa.yang | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/release/models/system/openconfig-aaa.yang b/release/models/system/openconfig-aaa.yang index b50c2c588b..79cb0a1b65 100644 --- a/release/models/system/openconfig-aaa.yang +++ b/release/models/system/openconfig-aaa.yang @@ -397,6 +397,7 @@ module openconfig-aaa { leaf ssh-key { type string; + status deprecated; description "SSH public key for the user (RSA or DSA)"; } @@ -425,7 +426,7 @@ module openconfig-aaa { description "Configuration data for user SSH keys"; - leaf key-name { + leaf name { type string; description "The name with which to reference the authorized SSH public key"; @@ -434,7 +435,7 @@ module openconfig-aaa { leaf authorized-ssh-key { type string; description - "Authorized SSH public key for the user (RSA or ECDSA)"; + "Authorized SSH public key for the user"; } } @@ -481,11 +482,11 @@ module openconfig-aaa { "Top-level container for authorized SSH keys"; list authorized-ssh-key { - key "key-name"; + key "name"; description "Authorized SSH public keys for the user (RSA or ECDSA)"; - leaf key-name { + leaf name { type leafref { path "../config/key-name"; } From f0b9af9603db7b5d1d2a5fb0f33dcd80417bda78 Mon Sep 17 00:00:00 2001 From: Suma Yaghi Date: Fri, 7 Aug 2026 11:41:16 -0400 Subject: [PATCH 5/5] Resolving comments --- release/models/system/openconfig-aaa.yang | 98 ++++++++++++++--------- 1 file changed, 58 insertions(+), 40 deletions(-) diff --git a/release/models/system/openconfig-aaa.yang b/release/models/system/openconfig-aaa.yang index 79cb0a1b65..79ea50d86f 100644 --- a/release/models/system/openconfig-aaa.yang +++ b/release/models/system/openconfig-aaa.yang @@ -32,8 +32,14 @@ module openconfig-aaa { Portions of this model reuse data definitions or structure from RFC 7317 - A YANG Data Model for System Management"; - oc-ext:openconfig-version "1.1.0"; + oc-ext:openconfig-version "1.2.0"; + revision 2026-08-07 { + description + "Deprecating ssh-key leaf in favour of public-keys list."; + reference "1.2.0"; + } + revision 2025-10-31 { description "Added GLOME path."; @@ -399,7 +405,8 @@ module openconfig-aaa { type string; status deprecated; description - "SSH public key for the user (RSA or DSA)"; + "SSH public key for the user. Deprecated in favour of the + public-keys list, which supports mutiple keys per user."; } leaf role { @@ -421,23 +428,64 @@ module openconfig-aaa { description "Operational state data for local users"; } - - grouping authorized-ssh-key-config { + + grouping public-key-config { description "Configuration data for user SSH keys"; - + leaf name { type string; description "The name with which to reference the authorized SSH public key"; } - - leaf authorized-ssh-key { + + leaf public-key { type string; description - "Authorized SSH public key for the user"; + "An authorized SSH public key for the user, formatted as a single + entry of an OpenSSH authorized_keys file: + + [options] [comment] + + Encoding the full entry as one string preserves any key options + and algorithm names not known to the system."; + + reference + "OpenSSH sshd(8), AUTHORIZED_KEYS FILE FORMAT"; } } + + grouping public-keys { + description + "SSH keys"; + + list public-key { + key "name"; + description + "Authorized SSH public keys for the user."; + + leaf name { + type leafref { + path "../config/name"; + } + description + "References the key name in the configuration block"; + } + + container config { + description + "Configuration data for the authorized SSH key"; + uses public-key-config; + } + + container state { + config false; + description + "Operational state data for the authorized SSH key"; + uses public-key-config; + } + } + } grouping aaa-authentication-user-top { description @@ -476,38 +524,8 @@ module openconfig-aaa { uses aaa-authentication-user-config; uses aaa-authentication-user-state; } - - container authorized-ssh-keys { - description - "Top-level container for authorized SSH keys"; - - list authorized-ssh-key { - key "name"; - description - "Authorized SSH public keys for the user (RSA or ECDSA)"; - - leaf name { - type leafref { - path "../config/key-name"; - } - description - "References the key name in the configuration block"; - } - - container config { - description - "Configuration data for the authorized SSH key"; - uses authorized-ssh-key-config; - } - - container state { - config false; - description - "Operational state data for the authorized SSH key"; - uses authorized-ssh-key-config; - } - } - } + + uses public-keys; } }