|
|
|
|
@ -8,6 +8,7 @@ import (
|
|
|
|
|
"context"
|
|
|
|
|
"fmt"
|
|
|
|
|
"os"
|
|
|
|
|
"path"
|
|
|
|
|
"path/filepath"
|
|
|
|
|
"strings"
|
|
|
|
|
"testing"
|
|
|
|
|
@ -24,25 +25,15 @@ type CreateTokenResponse struct {
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Setup verifies if appropriate credentials are set and adds the boundary controller
|
|
|
|
|
// policy to vault. Returns the vault address.
|
|
|
|
|
func Setup(t testing.TB, boundaryControllerFilePath string) (boundaryPolicyName, kvPolicyFilePath, ldapPolicyFilePath string) {
|
|
|
|
|
// SetupForBoundaryController verifies if appropriate credentials are set and
|
|
|
|
|
// adds the boundary controller policy to vault. Returns the policy name.
|
|
|
|
|
func SetupForBoundaryController(t testing.TB, boundaryControllerFilePath string) (boundaryPolicyName string) {
|
|
|
|
|
// Set up boundary policy
|
|
|
|
|
boundaryPolicyFilePath, err := filepath.Abs(boundaryControllerFilePath)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
boundaryPolicyName = WritePolicy(t, context.Background(), boundaryPolicyFilePath)
|
|
|
|
|
boundaryPolicyName = WritePolicy(t, t.Context(), boundaryPolicyFilePath)
|
|
|
|
|
|
|
|
|
|
// Create kv policy
|
|
|
|
|
kvPolicyFilePath = fmt.Sprintf("%s/%s", t.TempDir(), "kv-policy.hcl")
|
|
|
|
|
_, err = os.Create(kvPolicyFilePath)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
// Create ldap policy
|
|
|
|
|
ldapPolicyFilePath = fmt.Sprintf("%s/%s", t.TempDir(), "ldap-policy.hcl")
|
|
|
|
|
_, err = os.Create(ldapPolicyFilePath)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
return boundaryPolicyName, kvPolicyFilePath, ldapPolicyFilePath
|
|
|
|
|
return boundaryPolicyName
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// SetupLdap sets a Vault server up for LDAP against an OpenLDAP server. It
|
|
|
|
|
@ -52,7 +43,7 @@ func Setup(t testing.TB, boundaryControllerFilePath string) (boundaryPolicyName,
|
|
|
|
|
// clean-up in place to run after a test is complete. When applicable, callers
|
|
|
|
|
// should destroy the Vault LDAP policy and LDAP secrets engine this function
|
|
|
|
|
// creates.
|
|
|
|
|
func SetupLdap(t testing.TB, vaultLdapMountPath, vaultLdapPolicyFilePath, ldapAddr, ldapAdminDn, ldapAdminPw, ldapDn, ldapUser, ldapGroup string) string {
|
|
|
|
|
func SetupLdap(t testing.TB, vaultLdapMountPath, ldapAddr, ldapAdminDn, ldapAdminPw, ldapDn, ldapUser, ldapGroup string) string {
|
|
|
|
|
// Enable LDAP secrets engine.
|
|
|
|
|
output := e2e.RunCommand(t.Context(), "vault",
|
|
|
|
|
e2e.WithArgs("secrets", "enable", fmt.Sprintf("-path=%s", vaultLdapMountPath), "ldap"),
|
|
|
|
|
@ -60,8 +51,10 @@ func SetupLdap(t testing.TB, vaultLdapMountPath, vaultLdapPolicyFilePath, ldapAd
|
|
|
|
|
require.NoError(t, output.Err, string(output.Stderr))
|
|
|
|
|
|
|
|
|
|
// Define and write LDAP access policy to Vault.
|
|
|
|
|
f, err := os.OpenFile(vaultLdapPolicyFilePath, os.O_APPEND|os.O_WRONLY, 0o644)
|
|
|
|
|
vaultLdapPolicyFilePath := path.Join(t.TempDir(), "ldap-policy.hcl")
|
|
|
|
|
f, err := os.Create(vaultLdapPolicyFilePath)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
_, err = fmt.Fprintf(f, `
|
|
|
|
|
path "%[1]s/static-cred/%[2]s" {
|
|
|
|
|
capabilities = ["read"]
|
|
|
|
|
@ -148,21 +141,27 @@ func SetupLdap(t testing.TB, vaultLdapMountPath, vaultLdapPolicyFilePath, ldapAd
|
|
|
|
|
return policyName
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// CreateKvPrivateKeyCredential creates a private key credential in vault and creates a vault policy
|
|
|
|
|
// to be able to read that credential. Returns the name of the policy.
|
|
|
|
|
func CreateKvPrivateKeyCredential(t testing.TB, secretPath string, user string, keyPath string, kvPolicyFilePath string) string {
|
|
|
|
|
// CreateKvPrivateKeyCredential creates a private key credential in vault and
|
|
|
|
|
// creates a vault policy to be able to read that credential. Returns the secret
|
|
|
|
|
// and policy names. Note that this function does not put any clean-up in place
|
|
|
|
|
// to run after a test is complete. When applicable, callers should destroy the
|
|
|
|
|
// policy and secret this function creates.
|
|
|
|
|
func CreateKvPrivateKeyCredential(t testing.TB, secretPath string, user string, keyPath string) (secretName string, policyName string) {
|
|
|
|
|
secretName, err := base62.Random(16)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
// Update policy file
|
|
|
|
|
f, err := os.OpenFile(kvPolicyFilePath, os.O_APPEND|os.O_WRONLY, 0o644)
|
|
|
|
|
policyFilePath := path.Join(t.TempDir(), fmt.Sprintf("kv-pk-%s-policy.hcl", secretName))
|
|
|
|
|
f, err := os.Create(policyFilePath)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
_, err = f.WriteString(fmt.Sprintf("path \"%s/data/%s\" { capabilities = [\"read\"] }\n",
|
|
|
|
|
|
|
|
|
|
_, err = fmt.Fprintf(f, "path \"%s/data/%s\" { capabilities = [\"read\"] }\n",
|
|
|
|
|
secretPath,
|
|
|
|
|
secretName,
|
|
|
|
|
))
|
|
|
|
|
)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
policyName = WritePolicy(t, t.Context(), policyFilePath)
|
|
|
|
|
|
|
|
|
|
// Create secret
|
|
|
|
|
output := e2e.RunCommand(context.Background(), "vault",
|
|
|
|
|
e2e.WithArgs(
|
|
|
|
|
@ -175,24 +174,31 @@ func CreateKvPrivateKeyCredential(t testing.TB, secretPath string, user string,
|
|
|
|
|
)
|
|
|
|
|
require.NoError(t, output.Err, string(output.Stderr))
|
|
|
|
|
|
|
|
|
|
return secretName
|
|
|
|
|
return secretName, policyName
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// CreateKvPasswordCredential creates a username/password credential in vault and creates a vault
|
|
|
|
|
// policy to be able to read that credential. Returns the name of the policy
|
|
|
|
|
func CreateKvPasswordCredential(t testing.TB, secretPath string, user string, kvPolicyFilePath string) (secretName string, password string) {
|
|
|
|
|
// CreateKvPasswordCredential creates a username/password credential in vault
|
|
|
|
|
// and creates a vault policy to be able to read that credential. Returns the
|
|
|
|
|
// secret and policy names as well as the password for the secret. Note that
|
|
|
|
|
// this function does not put any clean-up in place to run after a test is
|
|
|
|
|
// complete. When applicable, callers should destroy the policy and secret this
|
|
|
|
|
// function creates.
|
|
|
|
|
func CreateKvPasswordCredential(t testing.TB, secretPath string, user string) (secretName string, policyName string, password string) {
|
|
|
|
|
secretName, err := base62.Random(16)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
// Update policy file
|
|
|
|
|
f, err := os.OpenFile(kvPolicyFilePath, os.O_APPEND|os.O_WRONLY, 0o644)
|
|
|
|
|
policyFilePath := path.Join(t.TempDir(), fmt.Sprintf("kv-up-%s-policy.hcl", secretName))
|
|
|
|
|
f, err := os.Create(policyFilePath)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
_, err = f.WriteString(fmt.Sprintf("path \"%s/data/%s\" { capabilities = [\"read\"] }\n",
|
|
|
|
|
|
|
|
|
|
_, err = fmt.Fprintf(f, "path \"%s/data/%s\" { capabilities = [\"read\"] }\n",
|
|
|
|
|
secretPath,
|
|
|
|
|
secretName,
|
|
|
|
|
))
|
|
|
|
|
)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
policyName = WritePolicy(t, t.Context(), policyFilePath)
|
|
|
|
|
|
|
|
|
|
// Create secret
|
|
|
|
|
password, err = base62.Random(16)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
@ -207,24 +213,30 @@ func CreateKvPasswordCredential(t testing.TB, secretPath string, user string, kv
|
|
|
|
|
)
|
|
|
|
|
require.NoError(t, output.Err, string(output.Stderr))
|
|
|
|
|
|
|
|
|
|
return secretName, password
|
|
|
|
|
return secretName, policyName, password
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// CreateKvPasswordDomainCredential creates a username/password/domain credential in vault and creates a vault
|
|
|
|
|
// policy to be able to read that credential. Returns the name of the policy
|
|
|
|
|
func CreateKvPasswordDomainCredential(t testing.TB, secretPath string, user string, domain string, kvPolicyFilePath string) (secretName string, password string) {
|
|
|
|
|
// CreateKvPasswordDomainCredential creates a username/password/domain
|
|
|
|
|
// credential in vault and creates a vault policy to be able to read that
|
|
|
|
|
// credential. Returns the name of the policy. Note that this function does not
|
|
|
|
|
// put any clean-up in place to run after a test is complete. When applicable,
|
|
|
|
|
// callers should destroy the policy and secret this function creates.
|
|
|
|
|
func CreateKvPasswordDomainCredential(t testing.TB, secretPath string, user string, domain string) (secretName string, policyName string, password string) {
|
|
|
|
|
secretName, err := base62.Random(16)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
// Update policy file
|
|
|
|
|
f, err := os.OpenFile(kvPolicyFilePath, os.O_APPEND|os.O_WRONLY, 0o644)
|
|
|
|
|
policyFilePath := path.Join(t.TempDir(), fmt.Sprintf("kv-upd-%s-policy.hcl", secretName))
|
|
|
|
|
f, err := os.Create(policyFilePath)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
_, err = f.WriteString(fmt.Sprintf("path \"%s/data/%s\" { capabilities = [\"read\"] }\n",
|
|
|
|
|
|
|
|
|
|
_, err = fmt.Fprintf(f, "path \"%s/data/%s\" { capabilities = [\"read\"] }\n",
|
|
|
|
|
secretPath,
|
|
|
|
|
secretName,
|
|
|
|
|
))
|
|
|
|
|
)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
policyName = WritePolicy(t, t.Context(), policyFilePath)
|
|
|
|
|
|
|
|
|
|
// Create secret
|
|
|
|
|
password, err = base62.Random(16)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
@ -240,7 +252,7 @@ func CreateKvPasswordDomainCredential(t testing.TB, secretPath string, user stri
|
|
|
|
|
)
|
|
|
|
|
require.NoError(t, output.Err, string(output.Stderr))
|
|
|
|
|
|
|
|
|
|
return secretName, password
|
|
|
|
|
return secretName, policyName, password
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// WritePolicy adds a policy to vault. Provide a name for the policy that you want to create as well
|
|
|
|
|
|
Hugo
8 months ago
committed by
Danielle Miu