# HG changeset patch
# Node ID efba9f1580c5
# Parent  00858d2bede6
diff --git a/access/users.go b/access/users.go
--- a/access/users.go
+++ b/access/users.go
@@ -1,7 +1,6 @@
 package access
 
 import (
-	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
@@ -17,7 +16,6 @@ const (
 
 var (
 	usernames map[string]string
-	keys      map[string]ssh.PublicKey
 	keysLock  sync.Mutex
 )
 
@@ -25,7 +23,6 @@ func refreshKeys() error {
 	keysLock.Lock()
 	defer keysLock.Unlock()
 
-	keys = map[string]ssh.PublicKey{}
 	usernames = map[string]string{}
 
 	keysPath := filepath.Join(AdminRepoPath(), keysDir)
@@ -73,8 +70,8 @@ func loadSshKey(filename, username strin
 			continue
 		}
 
-		fingerprint := ssh.FingerprintSHA256(pubkey)
-		if duppedname, found := usernames[fingerprint]; found {
+		key := MarshalPublicKey(pubkey)
+		if duppedname, found := usernames[key]; found {
 			zap.S().Warnf(
 				"duplicate key found for user %s. existing key was for %s.",
 				username,
@@ -82,39 +79,19 @@ func loadSshKey(filename, username strin
 			)
 		}
 
-		usernames[fingerprint] = username
-		keys[fingerprint] = pubkey
+		usernames[key] = username
 		counter++
 	}
 
 	zap.S().Infof("loaded %d keys for user %q", counter, username)
 }
 
-// UsernameFromFingerprint looks up a username from an SSH key's fingerprint
-// and returns the username if found, or err if not found.
-func UsernameFromFingerprint(fingerprint string) (string, error) {
-	keysLock.Lock()
-	defer keysLock.Unlock()
-
-	username, found := usernames[fingerprint]
-	if !found {
-		return "", fmt.Errorf("user not found")
-	}
-
-	return username, nil
+func MarshalPublicKey(pubkey ssh.PublicKey) string {
+	return strings.TrimSpace(string(ssh.MarshalAuthorizedKey(pubkey)))
 }
 
-func UsernameFromPubkey(pubkey ssh.PublicKey) (string, error) {
-	return UsernameFromFingerprint(ssh.FingerprintSHA256(pubkey))
+func UsernameFromPubkey(pubkey string) string {
+	keysLock.Lock()
+	defer keysLock.Unlock()
+	return usernames[pubkey]
 }
-
-func PubkeyFromFingerprint(fingerprint string) (string, error) {
-	pubkey, found := keys[fingerprint]
-	if !found {
-		return "", fmt.Errorf("PubKey not found")
-	}
-
-	str := string(ssh.MarshalAuthorizedKey(pubkey))
-
-	return str, nil
-}
diff --git a/authorized_keys/command.go b/authorized_keys/command.go
--- a/authorized_keys/command.go
+++ b/authorized_keys/command.go
@@ -9,7 +9,7 @@ import (
 )
 
 type Command struct {
-	FingerPrint  string `kong:"arg,help='The fingerprint of the calling user'"`
+	PubKey       string `kong:"arg,help='The pubkey of the calling user'"`
 	HGKeeperExec string `kong:"flag,help='The path to hgkeeper executable',default='hgkeeper'"`
 }
 
@@ -19,14 +19,9 @@ func (c *Command) Run(g *globals.Globals
 	}
 	defer access.Teardown()
 
-	pubkey, err := access.PubkeyFromFingerprint(c.FingerPrint)
-	if err != nil {
-		return err
-	}
-
-	username, err := access.UsernameFromFingerprint(c.FingerPrint)
-	if err != nil {
-		return err
+	username := access.UsernameFromPubkey(c.PubKey)
+	if username == "" {
+		return fmt.Errorf("username not found for pubkey: %s", c.PubKey)
 	}
 
 	options := []string{
@@ -34,7 +29,7 @@ func (c *Command) Run(g *globals.Globals
 		"restrict",
 	}
 
-	fmt.Printf("%s %s", strings.Join(options, ","), pubkey)
+	fmt.Printf("%s %s", strings.Join(options, ","), c.PubKey)
 
 	return nil
 }
diff --git a/docs/includes/ondemand/openssh.md b/docs/includes/ondemand/openssh.md
--- a/docs/includes/ondemand/openssh.md
+++ b/docs/includes/ondemand/openssh.md
@@ -10,7 +10,7 @@ have some pointers here, we'd love to he
 
 ```
 Match User hg
-    AuthorizedKeysCommand /usr/local/bin/hgkeeper --repos-path=/var/lib/hg/repos/ authorized-keys %f
+    AuthorizedKeysCommand /usr/local/bin/hgkeeper --repos-path=/var/lib/hg/repos/ authorized-keys "%t %k"
     AuthorizedKeysCommandUser hg
     PasswordAuthentication no
 ```
diff --git a/docs/includes/reverseproxy/openssh.md b/docs/includes/reverseproxy/openssh.md
--- a/docs/includes/reverseproxy/openssh.md
+++ b/docs/includes/reverseproxy/openssh.md
@@ -12,7 +12,7 @@ In the following snippet, be sure to rep
 
 ```
 Match User hg
-    AuthorizedKeysCommand /usr/bin/curl -q --get --data-encode "fp=%f" http://<external-hostname>:<external-http-port>/hgk/authorized_keys
+    AuthorizedKeysCommand /usr/bin/curl -q --get --data-urlencode "pubkey=%t %k" http://<external-hostname>:<external-http-port>/hgk/authorized_keys
     AuthorizedKeysCommandUser hg
     PasswordAuthentication no
 ```
diff --git a/examples/openssh/hgkeeper.conf b/examples/openssh/hgkeeper.conf
--- a/examples/openssh/hgkeeper.conf
+++ b/examples/openssh/hgkeeper.conf
@@ -1,5 +1,5 @@
 Match User hg
-	AuthorizedKeysCommand /usr/local/bin/hgkeeper --repos-path=/repos authorized-keys %f
+	AuthorizedKeysCommand /usr/local/bin/hgkeeper --repos-path=/repos authorized-keys "%t %k"
 	AuthorizedKeysCommandUser hg
 
 
diff --git a/http/authorized_keys.go b/http/authorized_keys.go
--- a/http/authorized_keys.go
+++ b/http/authorized_keys.go
@@ -11,21 +11,18 @@ import (
 
 func authorizedKeysHandler(externalHostname, externalPort string) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		fp := r.URL.Query().Get("fp")
-		if fp == "" {
+		pubkey := r.URL.Query().Get("pubkey")
+		if pubkey == "" {
 			w.WriteHeader(http.StatusBadRequest)
-			fmt.Fprintf(w, "missing fp parameter")
+			fmt.Fprintf(w, "missing pubkey parameter")
 
 			return
 		}
 
-		pubkey, err := access.PubkeyFromFingerprint(fp)
-		if err != nil {
+		if access.UsernameFromPubkey(pubkey) == "" {
 			w.WriteHeader(http.StatusNotFound)
-			fmt.Fprintf(w, "failed to find fingerprint %q", fp)
-
-			zap.S().Errorf("failed to find fingerprint for %s: %v", fp, err)
-
+			fmt.Fprintf(w, "failed to find pubkey %q", pubkey)
+			zap.S().Errorf("failed to find pubkey: %v", pubkey)
 			return
 		}
 
diff --git a/ssh/server.go b/ssh/server.go
--- a/ssh/server.go
+++ b/ssh/server.go
@@ -38,10 +38,10 @@ func NewServer(hostKeysPath, reposPath, 
 }
 
 func (s *Server) publicKeyHandler(ctx ssh.Context, key ssh.PublicKey) bool {
-	username, err := access.UsernameFromPubkey(key)
-	if err != nil {
+	pubkey := access.MarshalPublicKey(key)
+	username := access.UsernameFromPubkey(pubkey)
+	if username == "" {
 		zap.S().Warnf("authentication failure, unknown key %s", gossh.FingerprintSHA256(key))
-
 		return false
 	}
 
