151 Commits (cf3900a9067ddb4e6921538b9d520bd54fe5fb19)

Author	SHA1	Message	Date
dani	c89777de41	Expose Valid Principals for Vault SSH Signed Certs (#3791) ... * allow additional valid principals when creating vault ssh signed cert cred lib * add additional_valid_principals field to credential libraries documentation page	3 years ago
Jeff Mitchell	fb4a5a98dc	Add some target fields and move some things around (#3879) ... In preparation for putting proxy code in the api package this creates some necessary fields in the target output and it pre-moves credential parsing and proxy handshake code to their new places. This will make the diff for the actual proxy code move quite a bit smaller. Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>	3 years ago
dani	a7c1876d7b	remove deprecated option application-credential-source (#3728) ... Co-authored-by: Danielle Miu <29378233+DanielleMiu@users.noreply.github.com>	3 years ago
Sepehr	16d86d601a	Add additional observation tags, remove from version and authorized_action	3 years ago
April Ayres	23c969ed39	Add observability tags to plugin protobuf.	3 years ago
Sepehr	14af8e8cd7	observation tags proto messages	3 years ago
Jim	dc89ca28a1	feat: add API support for additional LDAP auth method fields. (#3679) ... * feat (auth/ldap): add Repo support for max page size and deref aliases (#3670) * chore: update cap/ldap dependency This latest version of cap/ldap adds support for MaxPageSize and DerefAliases * feat (auth/ldap): add MaxPageSize and DerefAliases to storage proto * feat (api/authmethods): add new ldap fields. Add support for maximum_page_size and dereference_aliases * feat (auth/ldap): schema changes to support new LDAP attributes * feat (auth/ldap): add Repo support for max page size and deref aliases * feat (handlers/ldap): add support for new fields (#3674) Added API support for new ldap fields: MaximumPageSize and DereferenceAliases * chore: add CHANGELOG entry for new api auth ldap fields	3 years ago
Johan Brandhorst-Satzkorn	bae219d461	Re-enable copywrite with hack (#3569) ... * Ignore license change commit from blame This changed almost all the files in the repo * Re-enable copywrite with hack Adds a hack that removes existing copyright headers from files before rerunning copywrite with directory specific configuration.	3 years ago
hashicorp-copywrite[bot]	29da0bcb92	[COMPLIANCE] License changes (#3567) ... * Adding explicit MPL license for sub-package. This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository. * Adding explicit MPL license for sub-package This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository. * Updating the license from MPL to Business Source License Going forward, this project will be licensed under the Business Source License v1.1. Please see our blog post for more details at https://hashi.co/bsl-blog, FAQ at www.hashicorp.com/licensing-faq, and details of the license at www.hashicorp.com/bsl. * Update copyright file headers to BUS-1.1 * Rerun make gen This will pick up the last of the license changes * Revert "Rerun make gen" This reverts commit dbe0968bff. * Remove copywrite from generation script The current version of copywrite is not sophisticated enough to only apply the copywrite changes to certain subdirectories, so to avoid accidentally relicensing our api and sdk modules, we will stop running the copywrite script until such time that it can do the right thing. * License protobuf API as MPL The protobuf API files are used to generate the SDK, since we want the SDK to be MPL, the protobuf files must also be MPL. This extends to all protobuf files whose sources end up in the SDK directory, including: - internal/proto/controller/api - internal/proto/controller/custom_options - internal/proto/plugin It also includes the generated service directory in internal/gen/controller/api/services, since they are generated from the protobuf sources used for the SDK. * Change website license file name This makes the naming scheme consistent with the rest of the repository. * Add note on licensing to README * Set copywrite license to BUSL * Revert "Add note on licensing to README" This reverts commit 4d865a91a7. --------- Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com> Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>	3 years ago
Damian Debkowski	e285a8ef6f	refactor: make secrets optional for storage bucket (#3353)	3 years ago
Todd	86b2f4b90a	Strongly type API resource for session recording creation time value attributes (#3480)	3 years ago
Todd	8d9222bec3	Add credential and libraries to session recording resource (#3374)	3 years ago
Jeff Mitchell	feb3aea38f	Support multiple IDs in grants (#3263) ... This allows specifying multiple IDs in grants via an `ids` field, which will eventually become the normal way to specify IDs. Internally, each grant with multiple IDs turns into multiple ACL grants each with a single ID; to make this distinction clearer and allow for better separation of concerns an AclGrant type has been introduced, so really multiple IDs in a Grant turn into multiple AclGrants. The nice thing about doing it this way is that it becomes purely a parsing concern; no actual validation logic has changed. For backwards compatibility with grants already stored in roles, we do not error out if `id` is specified. However, eventually we will simply not support grants with `id` coming via the API; they will fail API validation, such that new grants will require the use of the updated `ids` field. A follow-on PR will plumb this through the service handlers/API/CLI, but I decided to do it in separate chunks to make reviewing easier, given that they are easily separable into the internal and external aspects of the change. * Add CLI/API checks around using ID in grants (#3264) * Plumb through some contexts to remove a lot of deprecated errors (#3268)	3 years ago
Johan Brandhorst-Satzkorn	ebcd6d2828	api: remove connection ID (#3298) ... Removing this until we figure out why it's sometimes missing. May add it back again later.	3 years ago
Johan Brandhorst-Satzkorn	610df9892b	all: propagate more history metadata (#3279) ... A few target and host properties were missed when reading historical data from the history tables.	3 years ago
Johan Brandhorst-Satzkorn	0c8177590f	Upgrade grpc-gateway dependency (#3257) ... * proto: correct classification of authz token The target authorization token had the invalid classification "private". Fortunately, classification is a fail-closed system, so this won't have exposed users authorization tokens, but we should still use the correct classification. Use "secret". * scripts: add Go script to remove gotags comments The new version of grpc-gateway includes our gotags comments in the generate swagger documentation. This script removes all mentions of these. * Upgrade grpc-gateway dependency Mainly we need this to fix generation of our docs side API docs, but it also includes a nice fix for the new Download RPC, i.e. it now contains the correct response schema (a binary stream).	3 years ago
Danielle Miu	1052118836	remove field masks from proto	3 years ago
Todd	d1a5f3a2ff	Update attribute fields to be proto struct so generated api becomes map[string]any	3 years ago
Louis Ruch	9a3006e42a	feat(storage): Include type plugin in API response for buckets	3 years ago
Johan Brandhorst-Satzkorn	3374d32a55	api: add created, updated times to conn, chan ... In addition to session recordings, connection and channel recordings now also include the created and updated time.	3 years ago
Todd	5f20eb60ad	Add Host and Catalogs to the API resource	3 years ago
Johan Brandhorst-Satzkorn	15524f3408	api: add created, updated times to recordings	3 years ago
Johan Brandhorst-Satzkorn	4387a59ce5	sessionrecordings: add endpoint	3 years ago
Johan Brandhorst-Satzkorn	89befba55e	api: add state and error details fields to recordings	3 years ago
Todd	ee6a5f05b5	Add historical target and scope information to session recording	3 years ago
Todd	cfe0dc08d9	Add session recording service stuff	3 years ago
Danielle Miu	bb82fa6507	update storage buckets to use a shared persisted secrets type. add options	3 years ago
Louis Ruch	0d96a20024	feat(target): Add domain support for storage bucket association	3 years ago
Todd	8f9e218e1c	refactor historical values in the session recording resource	3 years ago
Louis Ruch	8ea61054cd	feat(storage): Add support for Storage Bucket API	3 years ago
Danielle Miu	a4a14fc7fc	merged commit for plugin rework, storage bucket sql and proto, storage bucket secret rewrapping, storage bucket repository	3 years ago
Todd	bc48f2d0e0	Add monitor session job proto and controller changes ... This adds a new Job type that is for generic session state monitoring. Monitoring sessions does not include any information about specific connections.	3 years ago
Todd	4c801cca18	update the recording msg type enums	3 years ago
Todd	dbe3473874	Add CreateChannel enum for upstream message handler	3 years ago
Todd	68dc4da50e	Add CloseConnectionRecording enums to the upstream message service	3 years ago
Johan Brandhorst-Satzkorn	7632143861	add session recording API definitions	3 years ago
Louis Ruch	def8e47f32	feat(storage): Add pluginInfo to storageBucket	3 years ago
Jim	b9cc441227	feature (handlers): add UpstreamMessageService and its oss impl. ... Define OSS protos for UpstreamMessageService rpc which defines a way to send an upstream message to a controller (across multi-hops if needed). Implement OSS versions of both workers and controllers for the UpstreamMessageService. The upstream requests/responses are encrypted using the originating worker's NodeCredential's key. The worker always forwards the request upstream. The controller attends to find a registered UpstreamMessageHandler to handle the msg; if none if found, then an Unimplemented status error is returned.	3 years ago
Damian Debkowski	79eea06dd7	feat(proto): storage bucket plugin grpc definitions (#252)	3 years ago
Jeff Mitchell	c149bc4a79	Allow slashes in authorize-session when using target name (#3249) ... This requires specifying `**` as the selector in the proto, which will match any segments and simply requires that the verb is the last part of the URL, which it already is.	3 years ago
Jeff Mitchell	20391e3503	Add default client port to targets and use in connect command (#2767)	3 years ago
Hugo Vieira	45dc8251ec	feat(api): Support plugin host external_name field	3 years ago
Hugo Vieira	2ff9b8efac	feat(host/plugin): Support External Name field ... The new `ExternalName` field is an optional field that is used to store the cloud providers' human-identifiable name for a given compute instance. This field is not user-editable, but it is kept in sync with the cloud provider's through Boundary's `SetSyncJob`.	3 years ago
Jim	982c9c263c	chore: update buf version to 1.15.1 (#3102)	3 years ago
Jim	86192f75eb	feature (auth/ldap): add LDAP auth method along with associated accounts and managed groups (#2912) ... * feature (auth): required schema changes for auth ldap method (#2669) chore (auth/ldap): move schema changes to next avail migration number * feature (auth/ldap): define AuthMethod and all its value objects (#2703) * feature (auth/ldap): storage protos * feature (auth/ldap): define AuthMethod and all its value objects * feature (auth/ldap): add repo and reading an auth method (#2718) * feature (auth/ldap): add Repository.CreateAuthMethod(...) and Repository.DeleteAuthMethod(...) (#2724) * feature (auth/ldap): add Repository.UpdateAuthMethod(...) (#2739) * feature (auth/ldap): add Account * feature (auth/ldap): add AuthMethod.EnableGroups * fix (auth/ldap): refactor AuthMethod.oplog to enforce proper constraints * feature (auth/ldap): add Account repo functions * refactor (auth/ldap): remove entry attributes from account Realized the entry attributes could have absolutely anything in them (including binary data) and since we absolutely don't have to have them there's just no reason to take on the risk. * feature (auth/ldap): add AuthMethod.UseTokenGroups * feature (auth/ldap): add Authenticate(...) * refactor (auth/ldap): ensure options take a context as the 1st parameter * feature (auth/ldap): add Account attribute maps * chore (auth/ldap): make fmt deltas * feature (auth/ldap): add managed groups (#2760) * tests (auth/ldap): add missing unit test to Repository.DeleteAccount(...) Add bits to test the delete operation when you're not able to generate oplog metadata * feature (auth/ldap): add managed groups fixup! feature (auth/ldap): add managed groups (#2760) * feature (auth/ldap): service proto definition (#2761) * feature (handlers/authmethods): add handlers for ldap auth method operations (#2794) * feature (auth/ldap): add Account attribute maps * chore (auth/ldap): update cap/ldap to latest version * feature (auth/ldap): add ldap api generation definitions * feature (authmethods): add ldap repo NewService(...) * feature (authmethods/ldap): add proper mask_mapping to protobufs * feature (authmethods): add support to get an ldap auth method * refactor (auth/ldap): export TestGenerateCA(...) * feature (authmethods): add support to create an ldap auth method * feature (authmethods): add support to delete an ldap auth method * feature (authmethods): add support to list ldap auth methods * refactor (auth/ldap): make urls optional for NewAuthMethod(...) * refactor (auth/ldap): export ldap.TestInvalidPem * chore: make fmt changes * fix (auth/ldap): properly handle group search config Add constraints and tests to ensure when an ldap AuthMethod.EnableGroups is true, and UseTokenGroups is false; that there's a GroupDn configured for finding a user's associated groups * feature (authmethods): add support to update an ldap auth methods * chore (db/ldap): tmp mv migrations so there's no conflict with ongoing work * feature (verifier): add ldap auth method to verifier bits * fix (controller): prevent panic when controller stops when there's no listener * feature (authmethods): add support to authenticate via ldap auth methods * chore (migrations): fix whitespace in stmt * chore: fmt fixup * tests (auth/ldap): invalid err msg * feature (cli/authmethods): add support for ldap auth-methods CRUD and authenticate (#2810) * feature (authmethods): add CLI support for ldap auth methods CRUD * tests (api/auth): ldap auth method classification tests * feature (authmethods): add CLI support for ldap auth authenticate * feature (auth/ldap): set request timeouts for ldap server connections * feature (handlers/authmethods): handle u_anon listing properly. * feature (account/handers): ldap account and managed group CRUDL APIs (#2852) * feature (auth/ldap) add repository Listing of ManagedGroupMemberAccount * feature (controller/handlers): add ldapRepoFn to accounts service * feature (auth/ldap) register ldap managed group subtype * feature (account/handlers): ldap account CRUDL APIs * feature (controller/handlers): add ldapRepo to managed groups service * feature (account/handlers): ldap managed group CRUDL APIs * docs (domain): add LDAP accounts, auth-methods and managed groups (#2857) * feature (ldap/cli) add ldap accounts and managed groups CRUDL commands (#2856) * fix (handlers/authmethods): fix ldap authorized actions (#2892) * feature (cli/ldap/authenticate): use primary auth method if none is provided (#2890) * fix (auth/ldap): support setting the state attribute * feature (cli/ldap/authenticate): use primary auth method if none is provided * feature (wh/ldap) add tests for new ldap auth method and accounts (#2919) * refactor (migrations/ldap): mv to correct directory * chore: add copyright headers * fix (api/authmethods/ldap): renumber new LdapAuthMethodAttributes field * fix (auth/ldap): allow the auth method state to be updated (#2951) * chore: update sdk and api versions for llb - this is tmp until merging * tests (managed groups): add required errContains for new test	3 years ago
Todd	fe5b554370	AuthorizedDownstreamWorkers now separated from AuthorizedWorkers to maintain API compatibility (#2957) ... * AuthorizedDownstreamWorkers now separated from AuthorizedWorkers to maintain API compatibility	3 years ago
Todd	1e89be1b1a	Downstream worker connections are tracked by worker id (#2949) ... When possible downstream workers will include their worker id information in the connections they establish with the upstream using the nodeenrollment library. The tracking listener now tracks connections that are connected in this same way instead of just connections of type *tls.Conn.	3 years ago
Johan Brandhorst-Satzkorn	3c29308673	chore: Add license headers to all files	3 years ago
Timothy Messier	1aaaf4af1d	feat(controller): Translate ssh certificate credentials for worker	3 years ago
Haotian	43f0ba89cf	feat(credentiallibraries): support vault ssh certificates	3 years ago