1724 Commits (d4bcdd8a067d23ad00071261a3aba2e7204cc665)

Author	SHA1	Message	Date
Haotian	d4bcdd8a06	fix(cli): correctly print secrets in authorize-session for current vault credential source subtypes (#3218) ... * updates authorize-session case statement with current vault credential source types	3 years ago
Timothy Messier	d792cf4487	test(vault): Increase threshold for period assertion (#3216) ... This allows for a greater delta between the period returned by vault and they expected value to account for some delay due to load on the test runners.	3 years ago
Chris van Meer	2c23848da5	Remove quotations when not needed (#3207)	3 years ago
Jeff Mitchell	a6fe1a5815	Update gen templates for license/gen info (#3211)	3 years ago
Jeff Mitchell	869310d7da	Only create WithAutomaticVersioning if versioning is used (#3210) ... This option did not respect whether or not versioning was enabled when writing it out during generation. This does mean that there is a breaking change for auth tokens, but as it was a no-op anyways it's easy to fix and not something I want to /v2 about.	3 years ago
Jeff Mitchell	037dc0cf18	Add missing nil check in test	3 years ago
Jeff Mitchell	f9f7ee2cc4	Fix build	3 years ago
Jeff Mitchell	bbe9719e19	Add tracking of worker used for injection (#3204)	3 years ago
Elim Tsiagbey	a2f8d87bfb	Add support for setting, adding & deleting LDAP account assoicated to a user (#3198)	3 years ago
Johan Brandhorst-Satzkorn	e04438b7f8	authmethods: fix test broken by LDAP ... These tests were never updated for LDAP	3 years ago
XingLu Wang	9d50db4c44	doc: Fix typo (#3185)	3 years ago
Haotian	762e0d7d0d	fix(sql): move added file to correct folder (#3197) ... * move rename_constraints.up.sql from 67 to 69 * update sql replacement reference comments	3 years ago
Haotian	b806297afe	style(db): rename constraint names to follow sql style guide (#2973) ... * programatically rename unique and foreign key constraints to enforce 'tablename_uq' and 'reftable_fkey' patterns * manually rename unique constraints for names over 63 characters * update changed constraint names in db update testcases	3 years ago
Jim	b974063a52	chore (boundary/dev): remove typo (#3194)	3 years ago
Jeff Mitchell	c6d7dc01a0	Exit before filtering if no workers are listed (#3196) ... This is just an early error message to avoid running the filtering function if there are no workers to begin with.	3 years ago
Jim	af1092e8e8	feat (boundary/dev): add connection info for dev ldap server when running via `boundary dev` (#3193) ... * chore (dev/ldap): update gldap dependency This update fixes the dup entries returned when searching for users and/or groups * feat (boundary/dev): add connection info for dev ldap server	3 years ago
Jim	667ea285be	feature (boundary dev): add support for dev ldap auth method (#3192)	3 years ago
Hugo	5f45fb620b	fix(perms): Tests use action.List in resource action set (#3188) ... `action.List` is a collection action, that is, it is not part of the set of actions that can be executed against a single instance of any given resource. As part of the `ListPermissions` call, `idActions` is expected, that is, all the actions that can be executed against a resource instance. `action.List` will never be part of this. This commit updates the tests to reflect this fact.	3 years ago
Jeff Mitchell	d28ea130ee	Fix ListPermissions when separate id/type grants are used (#3183) ... This makes two changes: 1. ListPermissions assumed every grant string had a type field, which does not match all grant formats. It now infers type from ID for formats which do not specify type. 2. Allow ID-only grant strings to be valid so long as the type specified matches the type of the specified ID.	3 years ago
Zhihe Li	98a6318760	Bump UI commit (#3178)	3 years ago
Jeff Mitchell	e7bf134710	Enhance tcp client port vet logic (#3175)	3 years ago
Jeff Mitchell	20391e3503	Add default client port to targets and use in connect command (#2767)	3 years ago
Jim	40d888c7f2	fix (test): update how we determine when/if a test is running. (#3169)	3 years ago
Damian Debkowski	c5b1b7bbc7	fix(handler): return human readable error for json cred w/ empty object (#3109) ... * fix(handler): return human readable error for json cred w/ empty object * fix(handler): sync error messages for create/update json cred * fix(handler): sync error logic for create/update json cred	3 years ago
Jim	a4f54cb98f	refactor (events): QOL fix: turn off events for tests. (#3163)	3 years ago
Johan Brandhorst-Satzkorn	c1a61b9e34	internal/tests/cluster: switch flaky test to polling (#3153) ... * internal/tests/cluster: switch flaky test to polling Also extend deadline from 10 seconds to 1 minute, hopefully this should fix any flakiness in this test. * fixup! internal/tests/cluster: switch flaky test to polling	3 years ago
Johan Brandhorst-Satzkorn	ecdb77b584	internal/db/sqltest: fix sessions aggregate (#3152) ... The sessions aggregate was inserting host_id and host_set_id, columns which are no longer present on the session table. Also fix the test that guards against regressions like this in the future.	3 years ago
Hugo	5926dc40ba	fix(host/plugin): Remove dead code and duplicate imports	3 years ago
Hugo Vieira	e467cbbfa2	feat(cmd): Display plugin host external name if present	3 years ago
Hugo Vieira	45dc8251ec	feat(api): Support plugin host external_name field	3 years ago
Hugo Vieira	2ff9b8efac	feat(host/plugin): Support External Name field ... The new `ExternalName` field is an optional field that is used to store the cloud providers' human-identifiable name for a given compute instance. This field is not user-editable, but it is kept in sync with the cloud provider's through Boundary's `SetSyncJob`.	3 years ago
Jeff Mitchell	bdf7bf7702	Do not allow PKI-KMS workers to have names updated via API (#3143) ... Do not allow PKI-KMS workers to have names updated via API This would cause their public IDs to change, which we do not want. Descriptions are also disallowed, since those come from the config file. This also adds logic to allow upgrading from old KMS method to new, with a test. Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com>	3 years ago
Jim	60723c070c	feature (is_nil): support checking func for nil (#3142)	3 years ago
Haotian	5b26634b8a	feat(ui): serve controller metadata from ui handler (#3120) ... * adds noop metadata function to OSS UI handler * removes old-style build tags for UI handler files	3 years ago
Jeff Mitchell	163ce184b8	KMS-PKI Workers (#3101) ... This adds a new mechanism for worker authentication that uses the third-party arbitration of the original KMS flow by leveraging recently-added capabilities in nodeenrollment to support a registration wrapper. This allows for workers to be registered to the system with just a name and a matching wrapper, while at the same time allowing these workers to be used for private Vault access and multi-hop as they contain per-worker encryption keys and support rotation. Nodes using this mode will generate and rotate credentials in-memory (using another recently added nodeenrollment capability) so will have a new set of keys on every startup. This has the side effect of ensuring that there is never a conflict or re-use of these credentials. Note that the normal test worker flow was using the now-deprecated KMS method; there is still a test that uses this (explicitly) but all other tests using test workers that did not specify a specific PKI flow now actually use this mechanism. This means there is fairly decent test coverage in a general sense, plus the specific tests updated/added for this feature. This also adds a new KMS type that can be used to have distinct KMSes for upstream authentication vs. accepting from downstream.	3 years ago
Elim Tsiagbey	16f48686a7	Refactor Target Repository (#3092) ... - Refactor the Target domain repository functions so that they no longer return 4 different types. `Target` struct now contains `HostSource` & `CredentialSources` with Getters & Setters - Extending `Target` to contain `HostSource` & `CredentialSources` enables `funcs` to just return `Target` instead of multiple return types. This also allows easy future refactors and extensions of `Target`	3 years ago
Johan Brandhorst-Satzkorn	bc31892f29	internal/db: add set_once_columns function (#3117) ... * internal/db: add set_once_columns function Also replace existing before_soft_delete_credential_vault_store function and trigger with the new function. * internal/db/schema: add note to replaced definitions	3 years ago
Elim Tsiagbey	b2376356dd	Bats Tests: Target Host Sources (#3107) ... * Bats Tests: Target Host Sources - Add bats test coverage for adding a Host Source to a Target - Create `target_host_sources.bash` file with helper functions for bats test file ## Considerations Created new resources like a target & host catalog instead of using already created resources because the changes could affect existing tests and it made it easy to change the newly created resources	3 years ago
Johan Brandhorst-Satzkorn	e3fc289733	Update buf dependencies (#3116)	3 years ago
Jim	63a2b62b85	chore (deps): update GKW and protobuf; and run "make gen" (#3111)	3 years ago
Jim	982c9c263c	chore: update buf version to 1.15.1 (#3102)	3 years ago
Jeff Mitchell	fc664eb35f	Improve grant validation (#3081) ... This adds several relationships into the resource package that are then made use of to improve the grant validation that runs during Parse. By understanding mappings between ID and resource type the validation checks can far better align with actual allowed grant formats so we can find several common misunderstandings before they simply result in an authorization failure. In the future some of these functions could be used in the logic in the actual ACL checks but it's not currently necessary and I don't want to lump that change in with this. Note that the tests have not meaningfully changed, but they _have_ had to be updated because the stricter validation is actually catching issues.	3 years ago
Jeff Mitchell	164e6cf212	Update nodeenrollment to 0.1.19 (#3090)	3 years ago
Jim	86192f75eb	feature (auth/ldap): add LDAP auth method along with associated accounts and managed groups (#2912) ... * feature (auth): required schema changes for auth ldap method (#2669) chore (auth/ldap): move schema changes to next avail migration number * feature (auth/ldap): define AuthMethod and all its value objects (#2703) * feature (auth/ldap): storage protos * feature (auth/ldap): define AuthMethod and all its value objects * feature (auth/ldap): add repo and reading an auth method (#2718) * feature (auth/ldap): add Repository.CreateAuthMethod(...) and Repository.DeleteAuthMethod(...) (#2724) * feature (auth/ldap): add Repository.UpdateAuthMethod(...) (#2739) * feature (auth/ldap): add Account * feature (auth/ldap): add AuthMethod.EnableGroups * fix (auth/ldap): refactor AuthMethod.oplog to enforce proper constraints * feature (auth/ldap): add Account repo functions * refactor (auth/ldap): remove entry attributes from account Realized the entry attributes could have absolutely anything in them (including binary data) and since we absolutely don't have to have them there's just no reason to take on the risk. * feature (auth/ldap): add AuthMethod.UseTokenGroups * feature (auth/ldap): add Authenticate(...) * refactor (auth/ldap): ensure options take a context as the 1st parameter * feature (auth/ldap): add Account attribute maps * chore (auth/ldap): make fmt deltas * feature (auth/ldap): add managed groups (#2760) * tests (auth/ldap): add missing unit test to Repository.DeleteAccount(...) Add bits to test the delete operation when you're not able to generate oplog metadata * feature (auth/ldap): add managed groups fixup! feature (auth/ldap): add managed groups (#2760) * feature (auth/ldap): service proto definition (#2761) * feature (handlers/authmethods): add handlers for ldap auth method operations (#2794) * feature (auth/ldap): add Account attribute maps * chore (auth/ldap): update cap/ldap to latest version * feature (auth/ldap): add ldap api generation definitions * feature (authmethods): add ldap repo NewService(...) * feature (authmethods/ldap): add proper mask_mapping to protobufs * feature (authmethods): add support to get an ldap auth method * refactor (auth/ldap): export TestGenerateCA(...) * feature (authmethods): add support to create an ldap auth method * feature (authmethods): add support to delete an ldap auth method * feature (authmethods): add support to list ldap auth methods * refactor (auth/ldap): make urls optional for NewAuthMethod(...) * refactor (auth/ldap): export ldap.TestInvalidPem * chore: make fmt changes * fix (auth/ldap): properly handle group search config Add constraints and tests to ensure when an ldap AuthMethod.EnableGroups is true, and UseTokenGroups is false; that there's a GroupDn configured for finding a user's associated groups * feature (authmethods): add support to update an ldap auth methods * chore (db/ldap): tmp mv migrations so there's no conflict with ongoing work * feature (verifier): add ldap auth method to verifier bits * fix (controller): prevent panic when controller stops when there's no listener * feature (authmethods): add support to authenticate via ldap auth methods * chore (migrations): fix whitespace in stmt * chore: fmt fixup * tests (auth/ldap): invalid err msg * feature (cli/authmethods): add support for ldap auth-methods CRUD and authenticate (#2810) * feature (authmethods): add CLI support for ldap auth methods CRUD * tests (api/auth): ldap auth method classification tests * feature (authmethods): add CLI support for ldap auth authenticate * feature (auth/ldap): set request timeouts for ldap server connections * feature (handlers/authmethods): handle u_anon listing properly. * feature (account/handers): ldap account and managed group CRUDL APIs (#2852) * feature (auth/ldap) add repository Listing of ManagedGroupMemberAccount * feature (controller/handlers): add ldapRepoFn to accounts service * feature (auth/ldap) register ldap managed group subtype * feature (account/handlers): ldap account CRUDL APIs * feature (controller/handlers): add ldapRepo to managed groups service * feature (account/handlers): ldap managed group CRUDL APIs * docs (domain): add LDAP accounts, auth-methods and managed groups (#2857) * feature (ldap/cli) add ldap accounts and managed groups CRUDL commands (#2856) * fix (handlers/authmethods): fix ldap authorized actions (#2892) * feature (cli/ldap/authenticate): use primary auth method if none is provided (#2890) * fix (auth/ldap): support setting the state attribute * feature (cli/ldap/authenticate): use primary auth method if none is provided * feature (wh/ldap) add tests for new ldap auth method and accounts (#2919) * refactor (migrations/ldap): mv to correct directory * chore: add copyright headers * fix (api/authmethods/ldap): renumber new LdapAuthMethodAttributes field * fix (auth/ldap): allow the auth method state to be updated (#2951) * chore: update sdk and api versions for llb - this is tmp until merging * tests (managed groups): add required errContains for new test	3 years ago
Damian Debkowski	bbbd6b1e51	backport 0.12.1 release (#3079) ... * chore: update version * fix(tests): break out of infinite loop for bats tests * chore: update changelog * fix: make-gen-delta check	3 years ago
Jeff Mitchell	d391dc6ab7	Add top level resource prefix function in globals (#3075)	3 years ago
Jeff Mitchell	b76b24a4ad	Move prefixes for many packages into the globals package (#3069) ... This is a prerequisite for some enhancements to grant validation	3 years ago
Todd	6adc0c86b5	Rename downstream router to receiver (#3068) ... This was done previously but these were missed.	3 years ago
Jeff Mitchell	b7d810e475	Fix function signature (#3070)	3 years ago
Irena Rindos	1821cb4631	Use tofu token from controller (#3064) ... * initial commit	3 years ago