flags: make CaConfig a function so its default resolves lazily

command/ca/certificate.go

@@ -184,7 +184,7 @@ multiple SANs. The '--san' flag and the '--token' flag are mutually exclusive.`,
 			},
 			flags.TemplateSet,
 			flags.TemplateSetFile,
-			flags.CaConfig,
+			flags.CaConfig(),
 			flags.CaURL,
 			flags.Root,
 			flags.Token,

command/ca/provisioner/add.go

@@ -208,7 +208,7 @@ SCEP
 			flags.CaURL,
 			flags.Root,
 			flags.Context,
-			flags.CaConfig,
+			flags.CaConfig(),
 		},
 		Description: `**step ca provisioner add** adds a provisioner to the CA configuration.
 

command/ca/provisioner/remove.go

@@ -26,7 +26,7 @@ func removeCommand() cli.Command {
 			flags.CaURL,
 			flags.Root,
 			flags.Context,
-			flags.CaConfig,
+			flags.CaConfig(),
 		},
 		Description: `**step ca provisioner remove** removes a provisioner from the CA configuration.
 

command/ca/provisioner/update.go

@@ -212,7 +212,7 @@ SCEP
 			flags.CaURL,
 			flags.Root,
 			flags.Context,
-			flags.CaConfig,
+			flags.CaConfig(),
 		},
 		Description: `**step ca provisioner update** updates a provisioner in the CA configuration.
 

command/ca/provisioner/webhook/add.go

@@ -41,7 +41,7 @@ func addCommand() cli.Command {
 			flags.CaURL,
 			flags.Root,
 			flags.Context,
-			flags.CaConfig,
+			flags.CaConfig(),
 		},
 		Description: `**step ca provisioner webhook add** adds a webhook to a provisioner.
 

command/ca/provisioner/webhook/remove.go

@@ -26,7 +26,7 @@ func removeCommand() cli.Command {
 			flags.CaURL,
 			flags.Root,
 			flags.Context,
-			flags.CaConfig,
+			flags.CaConfig(),
 		},
 		Description: `**step ca provisioner webhook remove** removes a webhook from a provisioner.
 

command/ca/provisioner/webhook/update.go

@@ -44,7 +44,7 @@ func updateCommand() cli.Command {
 			flags.CaURL,
 			flags.Root,
 			flags.Context,
-			flags.CaConfig,
+			flags.CaConfig(),
 		},
 		Description: `**step ca provisioner webhook update** updates a webhook attached to a provisioner.
 

command/ca/rekey.go

@@ -226,7 +226,7 @@ Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".`,
 			flags.PasswordFile,
 			flags.Root,
 			flags.CaURL,
-			flags.CaConfig,
+			flags.CaConfig(),
 		},
 	}
 }

command/ca/renew.go

@@ -168,7 +168,7 @@ $ step ca renew --offline internal.crt internal.key
 				Usage: `Use mTLS to renew a certificate. Use --mtls=false to force the token
 authorization flow instead.`,
 			},
-			flags.CaConfig,
+			flags.CaConfig(),
 			flags.Force,
 			flags.Offline,
 			flags.PasswordFile,

command/ca/revoke.go

@@ -198,7 +198,7 @@ attribute certificate have been compromised (reasonCode=10).
 `,
 			},
 			flags.Token,
-			flags.CaConfig,
+			flags.CaConfig(),
 			flags.Offline,
 			flags.CaURL,
 			flags.Root,

command/ca/sign.go

@@ -139,7 +139,7 @@ $ step ca sign foo.csr foo.crt \
 			acmeContactFlag,
 			acmeHTTPListenFlag,
 			flags.K8sSATokenPathFlag,
-			flags.CaConfig,
+			flags.CaConfig(),
 			flags.CaURL,
 			flags.Root,
 			flags.Context,

command/ca/token.go

@@ -207,7 +207,7 @@ extra names. Use the '--principal' flag multiple times to configure
 multiple principals.`,
 			},
 			sshHostFlag,
-			flags.CaConfig,
+			flags.CaConfig(),
 			flags.Force,
 			cli.StringFlag{
 				Name: "not-before",

command/ssh/certificate.go

@@ -210,7 +210,7 @@ $  step ssh certificate --kty OKP --curve Ed25519 mariano@work id_ed25519
 				Usage: "Set minimum required length for password used to encrypt private key. The default value is '0'. Values <=0 are interpreted as if no minimum value is set.",
 				Value: 0,
 			},
-			flags.CaConfig,
+			flags.CaConfig(),
 			flags.CaURL,
 			flags.Root,
 			flags.Context,

command/ssh/checkHost.go

@@ -49,7 +49,7 @@ $ step ssh check-host internal.smallstep.com
 				Name:  "verbose, v",
 				Usage: `Return "true" or "false" in the terminal.`,
 			},
-			flags.CaConfig,
+			flags.CaConfig(),
 			flags.Offline,
 			flags.CaURL,
 			flags.Root,

command/ssh/config.go

@@ -94,7 +94,7 @@ times to set multiple variables.`,
 			flags.Console,
 			flags.DryRun,
 			flags.Force,
-			flags.CaConfig,
+			flags.CaConfig(),
 			flags.CaURL,
 			flags.Root,
 			flags.Offline,

command/ssh/hosts.go

@@ -39,7 +39,7 @@ $ step ssh hosts
 			flags.TemplateSetFile,
 			flags.Console,
 			flags.Offline,
-			flags.CaConfig,
+			flags.CaConfig(),
 			flags.CaURL,
 			flags.Root,
 			flags.Context,

command/ssh/login.go

@@ -98,7 +98,7 @@ $  step ssh certificate --kty OKP --curve Ed25519 mariano@work id_ed25519
 			flags.Console,
 			flags.Force,
 			flags.Offline,
-			flags.CaConfig,
+			flags.CaConfig(),
 			flags.CaURL,
 			flags.Root,
 			flags.Context,

command/ssh/logout.go

@@ -67,7 +67,7 @@ $ step ssh logout --all
 			},
 			flags.Identity,
 			flags.Offline,
-			flags.CaConfig,
+			flags.CaConfig(),
 			flags.CaURL,
 			flags.Root,
 			flags.Context,

command/ssh/proxycommand.go

@@ -59,7 +59,7 @@ This command will add the user to the ssh-agent if necessary.
 			flags.TemplateSetFile,
 			flags.Console,
 			flags.Offline,
-			flags.CaConfig,
+			flags.CaConfig(),
 			flags.CaURL,
 			flags.Root,
 			flags.Context,

command/ssh/rekey.go

@@ -69,7 +69,7 @@ $ step ssh rekey --out id2_ecdsa id_ecdsa-cert.pub id_ecdsa
 			flags.SSHPOPCert,
 			flags.SSHPOPKey,
 			flags.Offline,
-			flags.CaConfig,
+			flags.CaConfig(),
 			flags.CaURL,
 			flags.Root,
 			flags.Context,

command/ssh/renew.go

@@ -65,7 +65,7 @@ $ step ssh renew -out new-id_ecdsa-cer.pub id_ecdsa-cert.pub id_ecdsa
 			flags.SSHPOPKey,
 			flags.Force,
 			flags.Offline,
-			flags.CaConfig,
+			flags.CaConfig(),
 			flags.CaURL,
 			flags.Root,
 			flags.Context,

command/ssh/revoke.go

@@ -113,7 +113,7 @@ attribute certificate have been compromised (reasonCode=10).
 `,
 			},
 			flags.Offline,
-			flags.CaConfig,
+			flags.CaConfig(),
 			flags.CaURL,
 			flags.Root,
 			flags.Context,

flags/flags.go

@@ -287,13 +287,11 @@ uses the configuration, certificates, and keys created with **step ca init**,
 but can accept a different configuration file using **--ca-config** flag.`,
 	}
 
-	// CaConfig is a cli.Flag used to pass the CA configuration file.
-	CaConfig = cli.StringFlag{
-		Name: "ca-config",
-		Usage: `The certificate authority configuration <file>. Defaults to
-$(step path)/config/ca.json`,
-		Value: filepath.Join(step.Path(), "config", "ca.json"),
-	}
+	// CaConfig is now a function (see the CaConfig func below). Defining it as a
+	// package var made its default value call step.Path() at package
+	// initialization, which caches the step configuration path from $HOME before
+	// a program has a chance to set STEPPATH (e.g. an SSH/PAM session hook where
+	// PAM exports the target user's HOME). Resolving it lazily fixes that.
 
 	// AdminCert is a cli.Flag used to pass the x5c header certificate for a JWT.
 	AdminCert = cli.StringFlag{
@@ -728,3 +726,17 @@ func FirstStringOf(ctx *cli.Context, flags ...string) (string, string) {
 
 	return "", name
 }
+
+// CaConfig returns the --ca-config flag. It is a function rather than a package
+// var so its default value, which calls step.Path(), is resolved when the
+// command is constructed instead of at package initialization. As a var,
+// importing this package would call step.Path() at load time and cache the
+// step configuration path from $HOME before a program could set STEPPATH.
+func CaConfig() cli.Flag {
+	return cli.StringFlag{
+		Name: "ca-config",
+		Usage: `The certificate authority configuration <file>. Defaults to
+$(step path)/config/ca.json`,
+		Value: filepath.Join(step.Path(), "config", "ca.json"),
+	}
+}