879 Commits (decc3ec2cf5510ec80989c3a318b2fd4e2072935)

Author	SHA1	Message	Date
Timothy Messier	decc3ec2cf	test(targets): Change test to not depend on response order (#1653) ... This test started failing when the order of the list response changed. Since the order does not matter, this test was updated to not depend on the order.	5 years ago
Timothy Messier	7d7d8af694	feat(cli): Add support for egress credentials for targets command	5 years ago
Timothy Messier	1da403a2d2	feat(api): Add support for egress credentials for targets endpoint	5 years ago
Timothy Messier	36f1ae75f7	feat(sdk): Add support for egress credentials to target service	5 years ago
Timothy Messier	1b7cfb1704	feat(target): Add support for credential library validation ... Target subtypes must now implement another repository hook to validate any CredentialLibraries that are being added/set. This allows for subtypes to determine the valid set of CredentialLibraries. For tcp.Targets only CredentialLibaries with credential.ApplicationPurpose are allowed. If any other purpose is provided an error is returned.	5 years ago
Timothy Messier	2cc58ff901	refact(target): Change repository to take CredentialLibraries ... This change removes the hard-coded credential purpose for the Credential Libraries. It also moves the logic of creating CredentialLibraries from CredentialSources out of the repository and into the targets.Service. This refactor will allow for additional credential purposes to be supported in both the service and the repository.	5 years ago
Jim	8ae6e9892f	feature (events/audit): Add auth info to audit events (#1644)	5 years ago
Louis Ruch	c9a189a18e	test(kms): Add missing tests and fixup some log lines (#1645)	5 years ago
Jeff Mitchell	1782f6a4e4	Enhance worker connection security (#1641) ... This stores worker connection nonces within the database to ensure uniqueness of connections. Prior the connection required any attacker to be able to decrypt the incoming encrypted authentication message in order to replay (and if the attacker has access to the KMS you have bigger problems), but with this change even if an attacker does have access to the KMS key, they cannot reuse the same message. (If they're able to encrypt against the KMS key, they can still act as a worker with a new message, so this only really helps if they only have decryption capabilities.)	5 years ago
Jim	a679300b50	feature (events): Classify auth method request/resp messages for audit events. (#1640) ... * refactor (oidc): Stop emitting error for not found token id Stop emitting errors when authtoken repo.IssueAuthToken is called and there's if no pending token. It's not an "normal" state and not an error condition. * feature (audit tagging): Add tags for auth method requests/responses Including testing functions for asserting audit events created when a service is called	5 years ago
Jeff Mitchell	3de16b6e21	Fix TLS 1.2 support (#1637)	5 years ago
Timothy Messier	24c6c329fe	chore(target): Remove unused option support from repo Create ... For the target Repository's Create method, the options of WithHostSources and WithCredentialSources where never used by the targets.Service. As such the repository does not need to support these options. See: 51812ff779	5 years ago
Michael Gaffney	c361e6ec22	fix(warehouse): Add primary key to credential group membership table (#1636)	5 years ago
Jim	99d6da4121	feature (events): Add audit request interceptors (#1620)	5 years ago
Louis Ruch	157bea08b9	test(vault): Register vault jobs for tests to reduce error spam in logs (#1630)	5 years ago
Jim	1ce9a71b53	feature (db): Add on conflict support to db.Create(...) (#1612)	5 years ago
Oleg Butuzov	5a2fa689a7	refactor: replace (*regexp.Regexp).Match on (*regexp.Regexp).MatchString (#1617) ... This PR change one method of regexp.Regexp struct with a similar one, as result code produce less allocations on heap.	5 years ago
Louis Ruch	95327b5e43	style: Run make fmt (#1626)	5 years ago
Timothy Messier	b5fbf9608e	refact(target): Remove old TargetType (#1618) ... Now that subtypes are registered via sub-packages, this TargetType is not needed and should not be used. This removes it and updates the target.Repository and targets.Service to use the updated code. This was missed in eac433f7ff.	5 years ago
Jim	769416c2ff	refactor (controller): Use a grpc server for the grpc-gateway (#1576) ... * refactor (controller): Use a grpc server for the grpc-gateway This starts a grpc server for the grpc-gateway. The new gateway server uses an in-memory listener which also supports "dialing", so the http proxy can connect to the in-memory listener. This change allows us to use all grpc server features and was in part motivated by a need for an interceptor of inbound requests. With that said, having a "proper" grpc server for the gateway will provide a lot more flexibility and capabilities moving forward. The request context will still be verified via middleware in the http proxy (see wrapHandlerWithCommonFuncs). This verified context will be serialized into a protobuf and sent along to the grpc-gateway via metadata where an interceptor will add the verified request info to the request's context (see requestCtxInterceptor). The interceptor will verify the serialized request info via a shared ticket with it's companion in-memory http proxy. FYI: the ticket is simply random base62 string (see db.NewPrivateId). This change also necessitated a minor change to services. We need to return an empty response instead of nil, nil when there are no errors and the response is empty. * refactor (handlers): Rename gRPC Gateway filter Originally, this was called an OutgoingInterceptor, which is an unfortunate name since it's not an interceptor. Now that we're refactoring the gateway stuff and have proper interceptors, renaming this should remove ambiguity * refactor: Rework how 204 with empty msg is handled Recent changes to grpc gateway has necessitated a change to how 204s are handled by the gateway * tests (bats): Check status codes for delete operations	5 years ago
Timothy Messier	02b2291375	feat(subtypes): Make Registry thread-safe	5 years ago
Timothy Messier	eac433f7ff	refact(target): Move tcp into subpackage ... This moves all of the tcp target functionality into a tcp package. It also establishes a Register function in the target package to allow specific target types to be registered at initilazation time. When registering, a target type needs to provide its Subtype, as well as some RepositoryHooks that are used by the target Repository.	5 years ago
Timothy Messier	51812ff779	docs(target): Mark additional fields as output only (#1609) ... When creating or updating a target, the following fields should have been marked as output only: - host_set_ids - host_source_ids - application_credential_source_ids - application_credential_library_ids This updates the protobuf and generated files including the swagger file used by the docs site to correctly mark these are output only. Fixes #1588	5 years ago
Jeff Mitchell	c05324282f	Rename the UI passthrough dir flag/env var (#1600) ... This puts it more in line with other upcoming options that use "dir" instead of "directory" (plus it's easier to type), and makes it clear that this directory and the passthrough behavior is related to the UI as opposed to other upcoming items.	5 years ago
Jim	3b99ded7ad	refactor: Update gorm deps (#1591) ... Our recent upstream PR was merged into gorm. We needed to change just a few bits to migrate our gorm dep back to the upstream source.	5 years ago
Michael Gaffney	7ccab48a3c	style: Run `make fmt`	5 years ago
Timothy Messier	e3f7c263b0	refactor(sqltest): Update init script to support migration editions ... This updates the docker image used for tests to support the new location for sql migration files and the concept of editions. It continues to process the old paths for now if the new directory does not exist, so that the same image can be used during the transition.	5 years ago
Timothy Messier	8caaf3e076	refactor(schema): Add support for migration editions ... This refactors the schema package and subpackages to support editions. An Edition is a collection of sql migrations. A given boundary binary can have multiple migration editions. The `schema.Manager` is updated to apply the necessary migrations in the correct order, leveraging an Edition's priority to determine the order in which the separate Editions are applied. The sql migration files are now nested under a directory for the edition. This also switches from the generated code to using embed, which eliminates the need for the `make migrations` target and the generated code. As such this commit removes the target and generated code. See: https://pkg.go.dev/embed	5 years ago
Jeff Mitchell	217adfc4d2	Pull over CombinedSliceFlagValue from WIP plugin-hostcatalogs (#1582) ... I've pulled over files as-is for the most part so this also pulls over some common attribute/secret flags but it's not worth dealing with the merge later...	5 years ago
Jim	c8b29ded1c	Events: Add outbound detail protobufs, request status code, and update event encrypt filter. (#1569) ... * feat (events): Add status code to audit events * feat (events): Add the resp proto msg to every audit event * chore (events): Update eventlogger dep This latest version will redact any map and/or map field which isn't explicitly classified via a Taggable interface * feat (events): Begin to add tagging to response proto msgs	5 years ago
Jim	8d6dee09a9	refact: Add db.DB wrapper and refact all test fixtures to use it. (#1535) ... * refact: Changes required for gorm v2 * refact: Add db.DB wrapper and refact all test fixtures to use it Stop leaking the gorm abstraction within our unit tests. * refact: Migrate direct calls to pq to pgx driver The refactor will remove the remaining direct dependencies on the pq driver which has been deprecated in favor of the pgx driver. It includes the addition of common.SqlOpen which is a wrapper around sql.Open, which is needed to deal with the driver name changing from "postgres" to "pgx" but in our code base the dialect and driver are synonyms.	5 years ago
Jim	136ac00b49	refact: Changes required for gorm v2 (#1528)	5 years ago
Jim	350b79be2d	chore: Update go:build tags to new fmt	5 years ago
Randall Morey	0eb1ab1698	chore: bump UI commit (#1565)	5 years ago
Timothy Messier	88b3c8358c	feat(cmd): Include version metadata in output (#1560) ... If the VersionMetadata is set, include it in the output of the `boundary version` subcommand.	5 years ago
Louis Ruch	49d5711a49	fix (service): corrects permission bug in hostset service (#1549) ... * fix (service): corrects permission bug in hostset service * fixup! fix (service): corrects permission bug in hostset service	5 years ago
Todd	0ba217cbfa	Run `make tools` and `make gen` now that the dependencies have been updated. (#1552)	5 years ago
Louis Ruch	1c40100edd	tests(scheduler): fix unit test deadlock (#1550) ... If a new job is started as the test successfully compeltes and begins the scheduler shutdown process. The new job will deadlock waiting on channel reads.	5 years ago
Jim	5312f7d042	fix (credential/vault): Correct typo in error msg (#1547) ... * fix (credential/vault): Correct typo in error msg * test (vault): Add missing assertion	5 years ago
Louis Ruch	6000f20ae5	chore(authenticate): remove deprecated authenticate:login and credentials field (#1534) ... * chore(authenticate): remove deprecated authenticate:login * Update changelog	5 years ago
Jeff Mitchell	7fc712de44	Bump protoc	5 years ago
Louis Ruch	6a92e08928	refact(worker): update worker porxy handler signature to return an error (#1536) ... Instead of requiring the each proxy handler to handle the webSocket connection closure. On error the worker handler will appropriately close the connection and event any errors.	5 years ago
Louis Ruch	8b5e4a175a	feat(worker): add egress credentials option to proxy (#1531)	5 years ago
Jeff Mitchell	bc240da52b	Fix word ordering	5 years ago
Timothy Messier	99d0d2f682	wh: Add wh_credential_dimension and bridge tables ... This adds new dimension table to record credential information. Since a session can have multiple credentials, the wh_session_accumulating_fact is is linked to the credential_dimensions via bridge tables, wh_credential_group and wh_credential_group_membership. When a session is inserted, the credental group and credential dimensions will be upserted. If the group changed in any way, a new group is inserted along with all of the corresponding credentials.	5 years ago
Jeff Mitchell	1f7999ed97	Add authorized collection actions output for credential stores (#1530) ... Add authorized collection actions output for credential stores	5 years ago
Michael Gaffney	e9d3cebd45	feat(credential): Add specific credential types (#1525) ... This adds interfaces for the following credential types: - Username and password - Username and private key - Certificate and private key It also adds the following types for redacting secret data: - Password - PrivateKey	5 years ago
Jim	2afac7348a	fix (controller): Set controller CancelCtx (#1513)	5 years ago
Jeff Mitchell	70cb75d030	Fix sessions authorized actions output (#1527)	5 years ago
Jeff Mitchell	92809b733a	Fix unknown permission issue with credential-store (#1524) ... This also affected credential libraries and managed groups. It seems that any end-to-end tests of these grants currently had them included in wildcards instead of individually, but these types were never added to the valid list for resources. Additionally, credential store wasn't added as a valid top level type for pinning purposes.	5 years ago