1688 Commits (181f0f180603a78a54cecdaa64dfd93e5f40cda2)

Author	SHA1	Message	Date
Johan Brandhorst-Satzkorn	bc31892f29	internal/db: add set_once_columns function (#3117) ... * internal/db: add set_once_columns function Also replace existing before_soft_delete_credential_vault_store function and trigger with the new function. * internal/db/schema: add note to replaced definitions	3 years ago
Elim Tsiagbey	b2376356dd	Bats Tests: Target Host Sources (#3107) ... * Bats Tests: Target Host Sources - Add bats test coverage for adding a Host Source to a Target - Create `target_host_sources.bash` file with helper functions for bats test file ## Considerations Created new resources like a target & host catalog instead of using already created resources because the changes could affect existing tests and it made it easy to change the newly created resources	3 years ago
Johan Brandhorst-Satzkorn	e3fc289733	Update buf dependencies (#3116)	3 years ago
Jim	63a2b62b85	chore (deps): update GKW and protobuf; and run "make gen" (#3111)	3 years ago
Jim	982c9c263c	chore: update buf version to 1.15.1 (#3102)	3 years ago
Jeff Mitchell	fc664eb35f	Improve grant validation (#3081) ... This adds several relationships into the resource package that are then made use of to improve the grant validation that runs during Parse. By understanding mappings between ID and resource type the validation checks can far better align with actual allowed grant formats so we can find several common misunderstandings before they simply result in an authorization failure. In the future some of these functions could be used in the logic in the actual ACL checks but it's not currently necessary and I don't want to lump that change in with this. Note that the tests have not meaningfully changed, but they _have_ had to be updated because the stricter validation is actually catching issues.	3 years ago
Jeff Mitchell	164e6cf212	Update nodeenrollment to 0.1.19 (#3090)	3 years ago
Jim	86192f75eb	feature (auth/ldap): add LDAP auth method along with associated accounts and managed groups (#2912) ... * feature (auth): required schema changes for auth ldap method (#2669) chore (auth/ldap): move schema changes to next avail migration number * feature (auth/ldap): define AuthMethod and all its value objects (#2703) * feature (auth/ldap): storage protos * feature (auth/ldap): define AuthMethod and all its value objects * feature (auth/ldap): add repo and reading an auth method (#2718) * feature (auth/ldap): add Repository.CreateAuthMethod(...) and Repository.DeleteAuthMethod(...) (#2724) * feature (auth/ldap): add Repository.UpdateAuthMethod(...) (#2739) * feature (auth/ldap): add Account * feature (auth/ldap): add AuthMethod.EnableGroups * fix (auth/ldap): refactor AuthMethod.oplog to enforce proper constraints * feature (auth/ldap): add Account repo functions * refactor (auth/ldap): remove entry attributes from account Realized the entry attributes could have absolutely anything in them (including binary data) and since we absolutely don't have to have them there's just no reason to take on the risk. * feature (auth/ldap): add AuthMethod.UseTokenGroups * feature (auth/ldap): add Authenticate(...) * refactor (auth/ldap): ensure options take a context as the 1st parameter * feature (auth/ldap): add Account attribute maps * chore (auth/ldap): make fmt deltas * feature (auth/ldap): add managed groups (#2760) * tests (auth/ldap): add missing unit test to Repository.DeleteAccount(...) Add bits to test the delete operation when you're not able to generate oplog metadata * feature (auth/ldap): add managed groups fixup! feature (auth/ldap): add managed groups (#2760) * feature (auth/ldap): service proto definition (#2761) * feature (handlers/authmethods): add handlers for ldap auth method operations (#2794) * feature (auth/ldap): add Account attribute maps * chore (auth/ldap): update cap/ldap to latest version * feature (auth/ldap): add ldap api generation definitions * feature (authmethods): add ldap repo NewService(...) * feature (authmethods/ldap): add proper mask_mapping to protobufs * feature (authmethods): add support to get an ldap auth method * refactor (auth/ldap): export TestGenerateCA(...) * feature (authmethods): add support to create an ldap auth method * feature (authmethods): add support to delete an ldap auth method * feature (authmethods): add support to list ldap auth methods * refactor (auth/ldap): make urls optional for NewAuthMethod(...) * refactor (auth/ldap): export ldap.TestInvalidPem * chore: make fmt changes * fix (auth/ldap): properly handle group search config Add constraints and tests to ensure when an ldap AuthMethod.EnableGroups is true, and UseTokenGroups is false; that there's a GroupDn configured for finding a user's associated groups * feature (authmethods): add support to update an ldap auth methods * chore (db/ldap): tmp mv migrations so there's no conflict with ongoing work * feature (verifier): add ldap auth method to verifier bits * fix (controller): prevent panic when controller stops when there's no listener * feature (authmethods): add support to authenticate via ldap auth methods * chore (migrations): fix whitespace in stmt * chore: fmt fixup * tests (auth/ldap): invalid err msg * feature (cli/authmethods): add support for ldap auth-methods CRUD and authenticate (#2810) * feature (authmethods): add CLI support for ldap auth methods CRUD * tests (api/auth): ldap auth method classification tests * feature (authmethods): add CLI support for ldap auth authenticate * feature (auth/ldap): set request timeouts for ldap server connections * feature (handlers/authmethods): handle u_anon listing properly. * feature (account/handers): ldap account and managed group CRUDL APIs (#2852) * feature (auth/ldap) add repository Listing of ManagedGroupMemberAccount * feature (controller/handlers): add ldapRepoFn to accounts service * feature (auth/ldap) register ldap managed group subtype * feature (account/handlers): ldap account CRUDL APIs * feature (controller/handlers): add ldapRepo to managed groups service * feature (account/handlers): ldap managed group CRUDL APIs * docs (domain): add LDAP accounts, auth-methods and managed groups (#2857) * feature (ldap/cli) add ldap accounts and managed groups CRUDL commands (#2856) * fix (handlers/authmethods): fix ldap authorized actions (#2892) * feature (cli/ldap/authenticate): use primary auth method if none is provided (#2890) * fix (auth/ldap): support setting the state attribute * feature (cli/ldap/authenticate): use primary auth method if none is provided * feature (wh/ldap) add tests for new ldap auth method and accounts (#2919) * refactor (migrations/ldap): mv to correct directory * chore: add copyright headers * fix (api/authmethods/ldap): renumber new LdapAuthMethodAttributes field * fix (auth/ldap): allow the auth method state to be updated (#2951) * chore: update sdk and api versions for llb - this is tmp until merging * tests (managed groups): add required errContains for new test	3 years ago
Damian Debkowski	bbbd6b1e51	backport 0.12.1 release (#3079) ... * chore: update version * fix(tests): break out of infinite loop for bats tests * chore: update changelog * fix: make-gen-delta check	3 years ago
Jeff Mitchell	d391dc6ab7	Add top level resource prefix function in globals (#3075)	3 years ago
Jeff Mitchell	b76b24a4ad	Move prefixes for many packages into the globals package (#3069) ... This is a prerequisite for some enhancements to grant validation	3 years ago
Todd	6adc0c86b5	Rename downstream router to receiver (#3068) ... This was done previously but these were missed.	3 years ago
Jeff Mitchell	b7d810e475	Fix function signature (#3070)	3 years ago
Irena Rindos	1821cb4631	Use tofu token from controller (#3064) ... * initial commit	3 years ago
Jeff Mitchell	b2bab45c13	Port over changes (#3061) (#3062)	3 years ago
Jim	a2692e0a68	update the deps (#3054)	3 years ago
Zhihe Li	21e73e4b17	Update changelog and UI commitish (#3052) (#3053)	3 years ago
Irena Rindos	ab0a2ad689	Fix hcp billing test (#3045) ... * fix test failure	3 years ago
Irena Rindos	860af44556	Fix sql tests failing on the first of the month (#3042) ... * initial commit	3 years ago
Timothy Messier	5e0957eb24	ci(test): Use docker mirror (#3018)	3 years ago
Timothy Messier	b69d1c2e2e	fix(cli): Fallback parsing of un-typed credentials (#2989) ... The `boundary connect` subcommands attempt to parse the credentials to use for brokering. This allows the subcommands to insert the credentials automatically into the process called by the subcommand, i.e. `ssh` or `psql`. There is some fallback logic to try a best attempt at parsing the credential in cases where a credential type has not be set on the credential source. The bug was introduced with the recent change to the vault credential library subtype being renamed from `vault` to `vault-generic`. This fallback logic would only run if the credential source type was "vault" or "static", so if the vault credential library was created without specifying a credential-type, the credential would not be parsed and automatically passed to the sub-process. This fix removes the additional check on the credential source's type, instead it will attempt to parse the credential, relying just on the structure of the credential. This also fixes a similar bug in the table output of secrets when using `boundary connect` without a subcommand. The parsing of the credentials for display in the table was only running for `vault` or `static`. Blame: db42eafd7a	3 years ago
Hugo	41b1b5b4b7	feat(db): Introduce migrations for ssh targets (#2960) ... Adds the schema for ssh targets. This also changes the target listing func to not error out when it encounters a target with an unknown type. Instead, it now ignores it and continues to the next one.	3 years ago
Johan Brandhorst-Satzkorn	18eed58ec5	fix(targets): Use correct error string in enterprise (#2984) ... In enterprise the error is different, so we need a different test error string to compare against. Create a variable that can be overwritten in the enterprise repo.	3 years ago
Johan Brandhorst-Satzkorn	8a0ee97f3b	fix(targets): Readd WorkerFilterDeprecationMessage (#2982) ... This variable is updated in the enterprise repo and needs to stay.	3 years ago
Timothy Messier	5c19dba3c9	ci(sqltest): Add github action workflow for sql tests (#2977)	3 years ago
Johan Brandhorst-Satzkorn	ac3543bdfb	fix(targets): Use correct field name in deprecation warning (#2978)	3 years ago
Todd	fe5b554370	AuthorizedDownstreamWorkers now separated from AuthorizedWorkers to maintain API compatibility (#2957) ... * AuthorizedDownstreamWorkers now separated from AuthorizedWorkers to maintain API compatibility	3 years ago
Todd	3461caee41	fix downstream manager test (#2950)	3 years ago
Johan Brandhorst-Satzkorn	cf412b95a2	fix: Support streaming HTTP responses (#2956) ... * all: Upgrade listenerutil dependency The new listenerutil implements http.Flusher, which is necessary for streaming responses from the grpc-gateway to work. * daemon/controller: Remove newline delimiter in streaming responses The default gRPC-Gateway HTTPBody marshaler uses newlines as a delimiter. This introduces newlines in our streamed responses. Wrapping the default marshaler lets us define a nil delimiter, which ensures our streaming responses are unaffected by the server side chunking.	3 years ago
Todd	1e89be1b1a	Downstream worker connections are tracked by worker id (#2949) ... When possible downstream workers will include their worker id information in the connections they establish with the upstream using the nodeenrollment library. The tracking listener now tracks connections that are connected in this same way instead of just connections of type *tls.Conn.	3 years ago
Johan Brandhorst-Satzkorn	4146c0c55d	Upgrade Go version to 1.20 (#2898) ... * chore: Upgrade Go version * fix: Upgrade golangci-lint to support 1.20 * fix: Don't use t.SetEnv in parallel tests This is a panic in Go 1.20 and it sounds like a recipe for distaster in general.	3 years ago
Eng Zer Jun	6403b0f389	test: use `t.TempDir` to create temporary test directory (#2922) ... This commit replaces `os.MkdirTemp` with `t.TempDir` in tests. The directory created by `t.TempDir` is automatically removed when the test and all its subtests [complete. Prior to this commit, temporary directory created using `os.MkdirTemp` needs to be removed manually by calling `os.RemoveAll`, which is omitted in some tests. The error handling boilerplate e.g. defer func() { if err := os.RemoveAll(dir); err != nil { t.Fatal(err) } } is also tedious, but `t.TempDir` handles this for us nicely. Reference: https://pkg.go.dev/testing#T.TempDir Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>	3 years ago
Damian Debkowski	cabe362534	fix(handler): return targetId as hostId for cli edge case support (#2920)	3 years ago
Haotian	f88547bbf5	fix(cli): update plural resource mentions in generated help texts (#2918)	3 years ago
Jeff Mitchell	1e9057d8a3	Update KMS references	3 years ago
Damian Debkowski	84b410974b	fix(handlers): return error when updating json cred w/ empty obj (#2903) ... * fix(handlers): return error when updating json cred w/ empty obj * chore(handlers): split cond stmt & refactor func name	3 years ago
Timothy Messier	e25b0e7888	fix(credentiallibraries): Fallback logic to support 0.11.x cli (#2910)	3 years ago
Cameron Perera	42858c4c0d	chore: bump ui commit (#2913)	3 years ago
Johan Brandhorst-Satzkorn	48e4fcce25	fix: remove file number dependency from test ... This was failing because of the added comments. This isn't a crucial part of the test, so remove it.	3 years ago
Johan Brandhorst-Satzkorn	3c29308673	chore: Add license headers to all files	3 years ago
Cameron Perera	80774077d6	chore: bump ui commit for 0.12.x release (#2904)	3 years ago
Timothy Messier	718e183a1e	fix(credentiallibraries): Correctly populate attrs for vault-generic (#2901)	3 years ago
Timothy Messier	f9a2f44f5b	test(cli): Add tests for vault-ssh-certificate credential library ... This adds tests for updating specific fields of the credential library.	3 years ago
Timothy Messier	e66ea15fef	fix(cli): Status code on api error ... When using the json output of the cli (`-format=json`), a successful call to the controller API would place the HTTP status code in the JSON as `status_code`. However, if there was an error from the API the status code would be placed in the JSON as `status`. In order to be consistent, this adds a `status_code` field to the error response case. For backwards compatibility it still populates `status` in the error case. This inconsistency was missed partially due to a bug in the CLI tests. The assertion on status code was not valid and would always be successful. Thus this also fixes the assertions and tests.	3 years ago
Irena Rindos	4114b41527	Filter managed workers from egress workers when the host address is unsafe (#2899)	3 years ago
Hugo	e455e31f9e	fix(target): Incorrectly allowing whitespace on Target's address field (#2862)	3 years ago
Timothy Messier	32dd7f07d0	fix(vault): Only persist revokable credentials ... When issuing credentials from vault credential libraries, only persist the vault credential if it is revokable. A credential that is revokable has a valid lease id that can be used to revoke the lease in vault. If the credential is not revokable it is also not renewable since renewing also requires a lease id. See: https://developer.hashicorp.com/vault/docs/concepts/lease	3 years ago
Timothy Messier	12a53bbfa9	feat(target): Allow vault ssh cert library as credential source ... This allows the new vault ssh certificate credential library to be used as an injected application credential source.	3 years ago
Timothy Messier	1aaaf4af1d	feat(controller): Translate ssh certificate credentials for worker	3 years ago
Timothy Messier	6a41bf1237	feat(wh): Support vault ssh certificate credentials ... This expands the wh_credential_dimension to include fields for the new vault ssh certificate credential library.	3 years ago