45 Commits (4d966c8eb40d8c1194e20ec0983f736f8dde6fd6)

Author	SHA1	Message	Date
Jeff Mitchell	704d68848c	Merge remote-tracking branch 'origin/main' into llb-byow	4 years ago
Louis Ruch	58d546cdd4	feat(credential): Add static credential store and username_password credential	4 years ago
Jeff Mitchell	5d3facf561	Merge remote-tracking branch 'origin/main' into llb-byow	4 years ago
Jeff Mitchell	d6362f9e5e	Restrict anonymous user capabilities (#2156)	4 years ago
Jim	fdf43fc4fe	feature (worker): add CreateWorker(...) service (aka API) (#2143)	4 years ago
Jeff Mitchell	c59d0df611	Add worker creation ACLs (#2138) ... This is a bit more than simply adding the action; we had some checks to ensure that list/create could only happen/not happen in some cases and those had to be modified to account for subactions.	4 years ago
Jeff Mitchell	48ac8b8f0b	Merge branch 'main' into plugin-hostcatalogs	4 years ago
Jim	f63ca1313c	feature (kms/audit): Add base audit key type (#1651) ... * feature (db): Add the ability to enable debug output for a connection * refactor: Use scope.Global instead of "global" * feature (db/migrations): Add kms audit keys Add schema changes to support a new DEK for audit crypto operations. * feature (kms/audit): Add audit key type All the bits required to define a new DEK concrete type for operating on audit entries. * refactor (db): Remove deprecated migration unit tests. We added a new audit DEK to kms.CreateKeysTx(...). Unfortunately, unit tests like TestMigrations_UserDimension, Test_PrimaryAuthMethodChanges and TestMigrations_CredentialDimension have an indirect dependency on a specific historical set of DEKs via an indirect call kms.CreateKeysTx. This of course fails because the new DEK's tables is not a part of pinned migration versions that these tests depend on.	4 years ago
Todd	a4ea99047f	Remove Prefix Id and Plugin Name fields (#1563) ... * Remove Prefix Id and Plugin Name fields. Creating catalogs now require either the plugin id or the name of the plugin resource (but not both). Host Catalogs and Host Sets API resources now have a read only plugin field populated with plugin info. Host Catalogs have a plugin id field as a top level field.	4 years ago
Jeff Mitchell	92809b733a	Fix unknown permission issue with credential-store (#1524) ... This also affected credential libraries and managed groups. It seems that any end-to-end tests of these grants currently had them included in wildcards instead of individually, but these types were never added to the valid list for resources. Additionally, credential store wasn't added as a valid top level type for pinning purposes.	5 years ago
Jeff Mitchell	781871c30d	Properly accept grant format type=<type>;output_fields=<of> (#1474) ... Although we document that this is allowed, and the ACL code handles it, some of the validation code did not. This would cause a semi intermittent problem because that validation code is used only in some code paths; specifically we skip it (for now) to avoid erroring out on some deprecated grant string formats when reading grants from the DB, but we use it to error out when validating incoming grants.	5 years ago
Jeff Mitchell	e3012afb4f	Add primary auth method ID to default output fields, fix display bug (#1441)	5 years ago
s-christoff	6b78108ecf	Update primary error functions to take a context, deprecate old functions (#1358) ... * add new error funcs which take a ctx and deprecate existing funcs * use context where available when writing error events * remove circular internal/errors pkg dep * suppress some chatty errors using errors.WithoutEvent() * convert auth oidc funcs to take context where needed to write events Co-authored-by: Jim <jlambert@hashicorp.com>	5 years ago
Jim	70ad081e39	Events: convert from hclog to events (#1409)	5 years ago
Jeff Mitchell	054c0aa538	Update password generated account IDs (#1290)	5 years ago
Jeff Mitchell	b513f21153	Add test for GrantsForUser (#1287) ... * Start of test * Add a test for existing GrantsForUser functionality. The test has randomization built in to allocate users across groups and both users and groups across roles. It tracks which users and groups have been assigned to which roles, then ensures that GrantsForUser returns the correct set of roles for a given user. This required modifying the CTE in GrantsForUser to return role_id as well. This doesn't test managed groups yet, that will come in a follow-on PR.	5 years ago
Jeff Mitchell	22d5c88a0b	Add Output Fields support (#1192)	5 years ago
Jeff Mitchell	e6af51943d	Add read:self and delete:self to auth tokens and add logout command (#1162)	5 years ago
Jeff Mitchell	412018fbb4	Update misleading Authenticated bool with new name and explanation. (#1111)	5 years ago
Jeff Mitchell	aa570f4e48	Honor child scope list permissions when recursing (#1016) ... Current behavior is that you need list grant on the parent scope when recursively listing, and this is sufficient. This is good for administrative workflows but can be unintuitive for resources that only exist at a project level. This change allows permissions on the child scope to also be taken into account, so that you can start a recursive list from a parent scope without direct list support on that scope but still get back child scopes for which list access is granted. This also fixes a bug where visibility of a scope for recursive listing would be based on whether the user had list resources for roles within that scope instead of for the resource type in question.	5 years ago
Jeff Mitchell	cb3980cb8c	Remove list:self from main (#915) ... * Remove list:self from main As per futher discussions, we won't be supporting this, in favor of simply read:self and cancel:self (since listing now already filters out items on which you have no permissions). This doesn't remove list:self entirely from the code base as much of that will simply be converted to read:self and cancel:self -- that will be in a later PR. However, with this removed if we want to release we won't expose an API publicly that isn't going to stick around.	5 years ago
Jeff Mitchell	1afa3a4b6c	Disallow an invalid grant format (#914)	5 years ago
Jeff Mitchell	0629526319	Add read/list/cancel:self actions and support for ACL subactions. (#882) ... Update perms table in anticipation of session support for these.	5 years ago
Louis Ruch	84656dbfea	ICU-747,ICU-748/refactor internal/oplog and internal/perms to use domain errors (#854) ... * Refactor internal/oplog to domain errors * Refactor internal/perms * Update changelog	5 years ago
Jeff Mitchell	b5d84495a3	Fix IDs being lowercased in role grants (#839) ... Fix IDs being lowercased in role grants Fixes #794	5 years ago
Jeff Mitchell	9237d6f787	Rename authorize to authorize-session (#531) ... As pointed out by Rob, this makes it clearer what the action actually is. We were sort of torn on it before, but I've definitely come around to it.	5 years ago
Todd Knight	f76d5aed9f	Additional validation for add|set|remove methods. (#527)	5 years ago
Jeff Mitchell	43c2deddff	Add permissions concepts and the beginning of the perms table (#526)	5 years ago
Jeff Mitchell	fa700dc002	Add account ID templating (#518) ... * Remove default role and create via the same mechanism as other initial resources	5 years ago
Jeff Mitchell	6ddfe407a3	Update allowed formats of ACL strings (#508)	5 years ago
Jeff Mitchell	cefea936c3	Update ACLs to allow type=*. (#504)	5 years ago
Jeff Mitchell	a38f40606e	Create default roles in scopes to allow authentication and listing scopes/auth methods (#502)	5 years ago
Jeff Mitchell	33b0021547	Add Sessions CLI command and add session cleanup to worker (#388)	6 years ago
Jeff Mitchell	07a7e9750a	Tie together the database-driven session handling with the worker and add relevant CLI comands (#370)	6 years ago
Jeff Mitchell	73a38b1433	Remove some unneeded resource types and fix the resource typing for default role in global scope (#256)	6 years ago
Jeff Mitchell	6661117d4c	The name. The name. The name!	6 years ago
Jeff Mitchell	322b13ae98	Standardize static group -> group naming (#236)	6 years ago
Jeff Mitchell	99653727bb	Migrate grants to more structured output (#194)	6 years ago
Todd Knight	28dbcd84bd	Authenticate Handler API and SDK, and much more (#183)	6 years ago
Jeff Mitchell	acce195dcb	Organizations -> orgs consistency (#189) ... * Organizations -> orgs consistency * Fix up some tests and some mistaken substitutions	6 years ago
Todd Knight	847ca1cc78	Grant management added to Roles API and SDK (#185) ... * Adding grants related methods to Roles. * Adding grants back after the merge of Principals. * Adding tests for Grant related custom methods. * Improving api handler methods. * Fixing tests and sdk field. * Adding todos for adding principals and grants to List and Update Role responses. * Fix up Set* tests and fix SetPrincipals bug. * Making AddPrincipals and RemovePrincipals similar to the tests for AddGrants and RemoveGrants. * Add JSON grants to output (#187) I also changed canonical_grants to grants_canonical and used grants_json. I believe that when members are simply different formats of other members this is the preferred way to have it in the API. Let me know if you disagree and we can dig in more. * Regenerate the API role resource. Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>	6 years ago
Jeff Mitchell	bcdcaffa6f	Port over 162 and 165 to master (#176) ... Co-authored-by: Jim Lambert <jlambert@hashicorp.com> Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>	6 years ago
Jeff Mitchell	d8f11af4d7	Move actions, resource (types), and scopes to packages. (#149)	6 years ago
Jeff Mitchell	993a6f1680	Remove "projects" from grant strings (#143) ... This removes the ability for a grant string to switch projects, in accordance with our updated design. It mostly removes code, with a few test fixes, and also adds one additional check (and test) to ensure a grant errors rather than do-nothing succeeds if both id and type are empty.	6 years ago
Jeff Mitchell	f41bf6e31e	Add permission grant string parsing and validation and ACL implementation (#109) ... This adds parsing and validation for grant strings along with the ability to create canonical JSON and text strings from a grant. It also adds an ACL implementation, allowing a collection of grant strings to then be checked against a resource/action tuple and indicate if it's allowed. Note that only specific sets of provided data in grant strings is allowed. This vastly simplifies logic. Test coverage is 100%. A future update will consolidate and migrate types between this and IAM but I didn't want to mix that in with this.	6 years ago