259 Commits (758e7b8bf1bb0534a6ec2175dfdac563cbceb4e6)

Author	SHA1	Message	Date
Jeff Mitchell	1ce09069a5	Move worker selection above session creation (#929) ... This prevents a session being created when no workers are available to handle it.	5 years ago
Jeff Mitchell	e9da3a871d	Switch on CORS by default if not specified (#928)	5 years ago
Jeff Mitchell	22462cdd84	Add read:self and cancel:self to sessions; add dev unpriv user (#923) ... * Sessions support for read:self and cancel:self permissions. This is automatic with fallback; no API change is needed. * Strips out values from listing if only self actions are allowed on the resource and the user ID is different. This prevents a default ACL of id=*;type=session;actions=read:self,cancel:self from causing all values to be visible when listing. * Adds an unprivileged user to development/testing instances. This user has only default permissions plus the ability to authorize sessions in the default target.	5 years ago
Jeff Mitchell	d279a906ce	Allow public_cluster_addr to use an env var or file (#907) ... Co-authored-by: Jeff Malnick <malnick@gmail.com>	5 years ago
Todd Knight	568594d1b3	Release the shared lock using a non cancelled context (#918)	5 years ago
Louis Ruch	628a02ad15	Scope role grants (#913) ... * Add scope read grant to default roles * Update CHANGELOG.md Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>	5 years ago
Todd Knight	1f9fcad1cd	Adding Migrate Command (#872)	5 years ago
Jeff Mitchell	6b58a3317d	Add recursive listing to roles (#881) ... This also lays the framework for adding recursive listing to the rest of the resources.	5 years ago
Todd Knight	ec6151d174	Organize DB Schema Migration Code and DB Init Checks (#842) ... Create Schema Manager and propagate contexts into the DB calls downstream. Add checks at controller startup and database init for correct schema version and schema migration dirty bit being set.	5 years ago
Michael Gaffney	94cb79bbdd	See how Boundary would look with gofumpt applied (#853) ... * See how Boundary would look with https://github.com/mvdan/gofumpt applied Results of running `gofumpt -w -s .` * Update tools file and Makefile for gofumpt Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>	5 years ago
Jeff Mitchell	5b5602969f	Update go-keyring to use forked version (#846) ... This may help with #830.	5 years ago
Jeff Mitchell	9a84e50493	Minor linting	5 years ago
Todd Knight	aa4157639c	Change Format of API Error (#784) ... This is a wire breaking change for json errors since we have removed and renamed a few fields, and changed part of the structure of the returned json error. * Remove redundant fields in Status, details.error_id, details.TraceId and details.request_id from API errors. * Added wrapped errors and "ops" field to indicate the internal operation of the errors returned by the API. * Added error cli error reporting of Op and wrapped errors.	5 years ago
Jeff Malnick	af2d9dfe90	fix: do not print info in output that could be JSON or YAML format (#799) ... * fix: print err msg for no credentials found to stderr	5 years ago
Jeff Mitchell	e2e4631929	Add ability to set public cluster address (#761)	6 years ago
Jeff Mitchell	f063b8601c	Fix IPv4-only check when no port is specified (#752) ... We have behavior that causes "0.0.0.0" to only listen on IPv4, however, it also assumed there was a port suffixed. This changes it so that it also works with a port-less address.	6 years ago
Jeff Mitchell	813d21565f	Allow authorize-session to be invoked with target name (#737)	6 years ago
Jeff Mitchell	09b865ab28	Add `pass` cred storage support (#731) ... * Add `pass` cred storage support Make it the default on non-Windows/macOS Document the token storage behavior	6 years ago
Jeff Mitchell	1f48d97327	Support for Unix domain socket listeners (#705) ... The client already supports protocol-agnostic transport so handles unix:/// schemes.	6 years ago
Jeff Mitchell	f454fa9ef2	Don't return error code 1 if saving the value to the keyring (#668)	6 years ago
Jeff Mitchell	ef16b6177c	Update configuration docs (#661) ... * Update configuration docs * Fix public addr example	6 years ago
Jeff Mitchell	868a65ac3d	Don't show "Version v" on startup if empty (#653) ... We'll still show the SHA in this case	6 years ago
Jeff Mitchell	bd271b707d	Add version command (#604)	6 years ago
Jeff Mitchell	4833fbba23	Simplify worker->controller connection (#601) ... Go's TLS stack doesn't need a separate CA cert and in fact for sessions we don't use this. So simplify the worker connection to remove an unnecessary extra key generation.	6 years ago
Todd Knight	6c6fb7a4d0	Format errors better for CLI (#552) ... * Start making errors easier to read for Table based CLI UI. * Add TODO about reporting "update_mask" related errors.	6 years ago
Jeff Mitchell	f8a2100603	Add various env vars to CLI (#528) ... * Add auth method ID env var * Add env var for host catalogs	6 years ago
Jeff Mitchell	fa700dc002	Add account ID templating (#518) ... * Remove default role and create via the same mechanism as other initial resources	6 years ago
Jeff Mitchell	d851ab07d8	Add ability to pull user/account/auth-method ID from stored token (#517)	6 years ago
Jeff Mitchell	6ddfe407a3	Update allowed formats of ACL strings (#508)	6 years ago
Jeff Mitchell	c1a1f8bb1b	Separate out docker dep into package (#482) ... This also then removes support for docker-based containing starting (for now) from platforms other than windows/darwin/linux as there are build issues on several.	6 years ago
Jim	fde96924af	refactor user account repo function names (#476)	6 years ago
Jeff Mitchell	cf3fa4522d	Swap base58 libraries (#472) ... * Swap base58 libraries This doesn't reduce binary size but it removes a metric ton of dependencies.	6 years ago
Jeff Mitchell	bec3d702fb	Add -database-url to dev mode (#459) ... Create default dev mode login name of "admin" and password of "password"	6 years ago
Jeff Mitchell	220ca253be	Add boundary config get-token (#455)	6 years ago
Jim	21ca0b6388	SetAssociatedAccounts, DisassociateAccounts, AssociateAccounts with support for multiple accounts. (#439)	6 years ago
Jeff Mitchell	61a0ae02c1	Bring go-alpnmux in house for now	6 years ago
Jeff Mitchell	94f9d952be	Add connect -exec and ssh subcommand support (#434)	6 years ago
Jeff Mitchell	41a3c66ea1	Add names to init output (#428)	6 years ago
Jeff Mitchell	7fcbffbe88	Remove not-set value. (#427) ... I don't think the conditions exist here that necessitated it being introduced into Vault, but I do sometimes see a baffling condition where the address coming from the flag is empty. I don't think we need this so take it out.	6 years ago
Jeff Mitchell	31fe9292b3	Instantiate default resources (#425)	6 years ago
Jeff Mitchell	03436a73de	Update CLI output functions to show scope info and cleanup (#416)	6 years ago
Jeff Mitchell	38ce9d9eac	Combine controller and worker commands (#415)	6 years ago
Jeff Mitchell	262ff06042	Add public address config option (#405)	6 years ago
Jeff Mitchell	e9b91f323f	Allow port to not be specified in listener address (#404)	6 years ago
Jeff Mitchell	dd06615c2e	Add database initialization command (#400)	6 years ago
Jeff Mitchell	d3606e14b6	Set wrapper on client, not token, so it doesn't fail KMS recovery on update calls	6 years ago
Jeff Mitchell	07a7e9750a	Tie together the database-driven session handling with the worker and add relevant CLI comands (#370)	6 years ago
Jeff Mitchell	37e9fed2e3	Allow not destroying dev databases (#366) ... This also shifts some logic around to better prepare for non-dev-mode workloads, although it does not actually call the KMS creation functions and initial auth method creation from non-dev commands yet.	6 years ago
Jeff Mitchell	c4e2b88022	Add database URL. (#365) ... * Add database URL. This allows specification of either a file://, env://, or other string. If it starts with file:// or env:// the actual value will be read from those resources. * Tidy up the KMS output * Also run migrations in test mode when specifying the URL	6 years ago
Jeff Mitchell	3c13e4765d	Verbose isn't actually used right now so don't expose it; fix some wording for scope id flag	6 years ago
Jeff Mitchell	2914b4c14c	Use base58 for a few more user-facing values (#356)	6 years ago
Jeff Mitchell	ff0d49b6e4	Use previous method of getting recovery wrapper	6 years ago
Jeff Mitchell	f8237fb945	Move some packages into SDK, out of internal	6 years ago
Jeff Mitchell	36f975a952	Add some recovery KMS functions needed for external clients (#339)	6 years ago
Todd Knight	c3ecea172d	Generate new version of SDK resources and Add Tests (#331)	6 years ago
Jeff Mitchell	23156afa11	Add in most of the proxy flow (#326)	6 years ago
Jeff Mitchell	1822c47ef5	Migrate KMS code to the new database DEKs (#324)	6 years ago
Jeff Mitchell	514856c020	Fix broken CLI output	6 years ago
Jeff Mitchell	1f065316ee	Initial (#313)	6 years ago
Jeff Mitchell	28df6eb7b0	Update config encrypt/decrypt CLI command (#309) ... This updates the command to our emergent standards. It also enables using a separate config file for a config kms, which allows non-string values to be encrypted. This allowed some nice cleanup as well.	6 years ago
Jeff Mitchell	b53812a5c1	Add ability to skip automatic auth method creation (#306) ... This is useful if you, for instance, want Terraform to be 100% responsible for creation of resources (outside of the static ones that cannot be removed or modified, like u_anon). This will mean using the recovery mechanism for initial setup, but that isn't an issue once TF supports that :-)	6 years ago
Jeff Mitchell	8f579c75c3	paum -> ampw (#303)	6 years ago
Jeff Mitchell	74544f6324	Encrypt tokens on the way out and decrypt on the way in (#302) ... * Encrypt tokens on the way out and decrypt on the way in This isn't a security feature related to tokens specifically; it's so that we can discard cryptographically bad tokens before we ever hit the DB. This way we can't pass through a DDoS to the database due to fetching obviously invalid token values. I'm using base58 to encode the resulting value as there aren't great base62 options, and allowing base64 / and + values can hamper usability by creating copying/highlighting breaks.	6 years ago
Jeff Mitchell	ac4d9fa311	Add nonce storage and replay prevention test (#293)	6 years ago
Jeff Mitchell	414a2ab2c3	Remove some dead, dead, dead, dead code	6 years ago
Jeff Mitchell	b47cca0329	Add (non-db aspects of) the recovery key workflow (#286)	6 years ago
Jim	9570897032	basic keys mgmt repo (#264)	6 years ago
Jeff Mitchell	adfc5681be	Auth methods CLI (#277)	6 years ago
Jeff Mitchell	282177afc2	Remove the default org (#270)	6 years ago
Jeff Mitchell	fff15bc9f3	Rename KMS purpose 'controller' to 'root'	6 years ago
Jeff Mitchell	bb6b189513	Create a default role on new scope creation (#265)	6 years ago
Jeff Mitchell	b75a6fc5e5	Update scopes CLI command in the model of the roles command (#262) ... * Update scopes CLI command in the model of the roles command * Pull help functions to helper methods	6 years ago
Jeff Mitchell	5d104a7a01	Migrate off Vault's internalshared folder to the separated-out repo	6 years ago
Todd Knight	245c7fbb44	Add Account Update handler (#257) ... * Allow updating accounts (not username or pw). * Updating new field names to LoginName. * Adding creation with password test. * Fixing documentation for WithLoginName	6 years ago
Jeff Mitchell	203e2b5dc2	Initial worker porting steps (#232)	6 years ago
Jeff Mitchell	4cfab04307	Migrate user name to login name (#255)	6 years ago
Jeff Mitchell	6661117d4c	The name. The name. The name!	6 years ago
Jeff Mitchell	d74e30d94a	Minor, easy, linting fixes	6 years ago
Jeff Mitchell	8dd5de49b9	Minor update to default role description text	6 years ago
Todd Knight	f84991c0f1	Use authenticate and Auth Method repo functions (#242)	6 years ago
Jeff Mitchell	908a299ea3	Convert SDK to the new options API (#238)	6 years ago
Jeff Mitchell	2bbc1163c4	Save the entire token, not just the ID (#211) ... This allows us to use the token's scope to set the default scope for an action in the client instead of relying on env vars.	6 years ago
Jeff Mitchell	388a13b10d	Convert scopes to the new paradigm (#206)	6 years ago
Todd Knight	28dbcd84bd	Authenticate Handler API and SDK, and much more (#183)	6 years ago
Jeff Mitchell	acce195dcb	Organizations -> orgs consistency (#189) ... * Organizations -> orgs consistency * Fix up some tests and some mistaken substitutions	6 years ago
Jeff Mitchell	16b56a37ed	Rename base.New -> base.NewCommand for clarity	6 years ago
Jeff Malnick	8afcbd4c8e	Add config CLI command and encrypt/decrypt sub-commands (#77)	6 years ago
Jim	cc5114bdef	refactor scopes to conform to public id usage and repo error msgs (#117)	6 years ago
Jeff Mitchell	5333482ff8	Fix gorm newlines issue (#108) ... Even if you made a custom formatter for gorm, it would blithely println anything returned, including nils, resulting in lots of new lines when we were ignoring output. This also creates a custom logger that doesn't do anything when newlines are found.	6 years ago
Jeff Mitchell	c175fcde8d	Add a gorm log formatter to adapt to hclog (#93) ... This is also added in a test that otherwise output to stdout, which validates functionality.	6 years ago
Jeff Mitchell	a04ac2202d	Fix build after dep update	6 years ago
Jim	980a55a4e3	Added DeleteScope() with tests and TestVerifyOplog() for easier testing (#49)	6 years ago
Jeff Mitchell	f8b456f3a7	Add TestController (#50) ... This can be used in tests to get access to a controller that behaves just like a dev controller but doesn't require the normal Command bits (UI, etc). This can be enhanced over time as needed; for now it's pretty simple but it's good enough to be used for API tests. A simple project create/read API test is added as well, which serves to show the programmatic model (as well as test those functions at the API level).	6 years ago
Jeff Mitchell	ad8d4e9c80	Rename Db's Tx to underlying	6 years ago
Jeff Mitchell	062ce6079f	Create dev org in database (#41) ... These changes create a dev org in the database on startup. They also plumb through a dev-org-id flag that allows specifying a chosen org ID in dev mode. The logic will allow us to let people specify a default org ID in the config file too, although currently that's not enabled. Several other improvements were made as well: * Consolidation of some code from across the server commands * Plumbing shutdownch through so we can use it for canceling contexts during startup	6 years ago
Jeff Mitchell	4d1b916348	Remove AllLoggers (#39) ... This was copied from Vault code but shouldn't be necessary any more as a change in hclog a while back meant that derived loggers share the log level of the parent.	6 years ago
Jeff Mitchell	5a721f0ce3	Update deps (#38) ... * Update deps * Update against latest Vault dep	6 years ago
Jeff Mitchell	7f2aa5ca8f	Add httpfs DB migrations and generate the input (#35)	6 years ago
Jeff Mitchell	1f3c52f495	Name and addr updates (#26) ... * Rename FriendlyName to Name * Standardize on connection parameters for the server being addr This syncs up WATCHTOWER_ADDR and -addr (formerly -address) and frees up -address to be used in resources (which it is). * Add description fields	6 years ago
Jeff Mitchell	e3c7ca3070	Add a hosts create command (#25)	6 years ago
Jeff Mitchell	6254e18698	Fix compilation of command	6 years ago
Jeff Mitchell	7f03246c6f	Add basic API client (#19)	6 years ago
Jeff Mitchell	5e82db8a2d	Minor bugfixes and cleanup	6 years ago
Jeff Mitchell	cad3c24f54	Add auth over ALPN (#5)	6 years ago
Jeff Mitchell	5acda6a0b1	Begin purpose-based listener refactoring (#4)	6 years ago
Jeff Mitchell	07032f6908	Refactoring and the worker is more distinct now (#3)	6 years ago
Jeff Mitchell	1645c3106e	Migrate a bunch of stuff around to prep for worker command (#2) ... Right now it's essentially a copy; it needs some updating, integration into dev, and so on.	6 years ago
Michael Gaffney	5e5a56cac0	Refactor names to avoid stutter (#1) ... Since client code uses the package name as a prefix when referring to the package contents, the names for those contents need not repeat the package name. - Rename base.BaseCommand to base.Command - Rename base.BaseServer to base.Server - Rename config.DevConfig() to config.Dev() - Rename config.LoadConfigFile() to config.LoadFile() - Rename config.NewConfig() to config.New() - Rename config.ParseConfig() to config.Parse() - Rename controller.ControllerCommand to controller.Command - Rename controller.NewController() to controller.New() - Rename dev.DevCommand to dev.Command - Rename listener.ListenerFactory to listener.Factory - Rename listener.NewListener() to listener.New() - Rename version.GetVersion() to version.Get() - Rename version.VersionInfo to version.Info See: - https://golang.org/doc/effective_go.html#package-names - https://blog.golang.org/package-names#TOC_3. - https://github.com/golang/go/wiki/CodeReviewComments#package-names	6 years ago
Jeff Mitchell	482b4d56dd	Initial commit	6 years ago