60 Commits (f9dfd024ed5f2ceb8959a295a43e070b9e1cbb6a)

Author	SHA1	Message	Date
Irena Rindos	d951e1ebc1	Worker graceful shutdown (#2455) ... * add graceful shutdown to worker	4 years ago
Damian Debkowski	546c5dc5be	feat: static json credentials (#2423)	4 years ago
Haotian	17ddc301a8	feat(cli): add/set/remove worker tags (#2266) ... * adds CLI commands for add/set/removing worker tags, and respective tests * adds StringSliceMapVar Flag to convert a string from the CLI to a map[string][]string value	4 years ago
Jeff Mitchell	fa17fdf9d7	Update wording and fix a missing prompt (#2329)	4 years ago
Jeff Mitchell	fe2ee7ef4a	Change behavior of `-token` and `-password` to support env/file only (#2327) ... * Revert "Remove `-token` flag (#2303)" This reverts commit 65cff995d7. * Change behavior of -token * Add use of MustParsePath * Update changelog * Use errors.Is	4 years ago
Jeff Mitchell	65cff995d7	Remove `-token` flag (#2303) ... Token values can be shown in output of `ps` and so, and we support env vars and keyrings, so remove it.	4 years ago
Jeff Mitchell	7eb29261b2	Update to go-kms-wrapping version 2, and plugin-based KMS (#1901)	4 years ago
Jeff Mitchell	95568ef07f	Fix tests using multiple controllers (#1734) ... The previous PR only initialized plugins if they were required, which meant that there may not actually be a plugin manager running because a second node would not actually create the dev database, which is where the plugin was being added. The assumption that a plugin manager is running is still a fine one at the moment, but we just need to make sure it's running in _all_ cases.	4 years ago
Jeff Mitchell	5559cf54d3	Don't always assume plugins should be activated (#1732)	4 years ago
Jeff Mitchell	217adfc4d2	Pull over CombinedSliceFlagValue from WIP plugin-hostcatalogs (#1582) ... I've pulled over files as-is for the most part so this also pulls over some common attribute/secret flags but it's not worth dealing with the merge later...	5 years ago
Jeff Mitchell	e9a8ede0d6	Move wrapper package back to SDK (#1511) ... TF uses this, so SDK is a decent place for it. It doesn't create dependencies between it and API.	5 years ago
Jeff Mitchell	081de3cf79	Migrate sdk/recovery to api/ and sdk/wrapper to internal (#1507) ... * `recovery` is only used by the API (and the main module, for decryption) * `wrapper` is only used by the CLI right now Moving these brings them closer to the code that uses them, and makes the SDK package a bit more clear in terms of functionality.	5 years ago
Michael Gaffney	df35699c4e	Integrate with Vault to retrieve and manage per session credentials (#1308) ... * Fix down migrations * Udpates due to merge * Sentinel values only have to be greater than 0 * Create credential related sdk structs and methods. * Post merge interface updating. * Removing scratch code that was not cleaned up. * updates * Convert client certificate and client certificate keys into pem blocks and validate. * Add newline at end of file. * Faster check for "s" at the end of a resource name when generating from templates. * make fmt * updates * Add dynamic credentials to a session * Refactor: move contents of file * updates * Updates * Add InvalidDynamicCredential error * Assign credentials * Allow updating client certificates seperate from the client certificate key. * Replace application purpose string with enum value * PR feedback / fix go test . * Delete dead code * Use common view * Refactor: extract interface and rename method * Refactor: move code to eliminate privPurpLibrary * Add comment to requestMap * Refactor: do not export methods on an unexported struct * Update internal/db/schema/migrations/postgres/10/03_vault_credential.up.sql Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com> * Add comments to credential Purpose constants * Reorder switch statements to handle errors first * PR feedback * update * fix merge * Organizing the scheduler code and extract the individual store creation test helper function. * Run 'make fmt' * Create certificate when creating store. Allow vault address to be passed in as option * Refactor: rename database views and associated structs This change renames two database views and associated go structs to use a consistent naming pattern. Views ending in 'private' contain encrypted credentials needed for connecting to Vault. Views ending in 'public' mirror the 'private' views but do not include any encrypted values. This change does not include any changes to functionality or behavior. * Adding SAD target operations for credential libraries to the SDK. * Add status field and enumeration table for credential status * Refactor: rename Status to TokenStatus * Add status to vault credentials * Creating the template for the CLI and helper functions. * Add private database view for vault credentials * Add scope_id to view and cleanup TODO comment * Reformat embedded sql queries * Add vault client helpers * updates * white space * Add LookupLease test * CLI commands for Store work. Renamed fields in proto w/ vault prefix. * Test issue credentials with client TLS * Add additional checks to vault ping * Add an error for vault token capabilities and create a VaultToken error kind * Add support for working with Vault policies * Use Vault 1.7.2 for testing * Add testing helper for creating a vault client with a non-root token * Fix Vault renew lease test The Vault renew lease endpoint accepts an optional duration parameter for requesting the number of seconds to extend the lease by. However, Vault is not required to honor this request. * Add a var for the required capabilities of a boundary Vault token * Enhance the test helper for adding a policy to Vault * Allow the test role in postgresql to revoke credentials * Remove out of date comments * Enhance Vault test helpers for the database secrets engine * Reformat comments * Add a method for getting the capabilities of the current Vault token * Add revoke lease to internal Vault client * Reformat: combine err return line with check for nil line * Remove redundant checks in test code Remove checks in test code that are redundant with checks in the test harness. * Refactor CreateToken test helper to return the secret and the token * Fix build failures caused by signature change in vault.CreateToken * Fix Vault version and Vault API link in comments * ran `make gen` after merging from mgaffney-vault. * Remove Vault prefix from attribute fields in API, create a base CLI option for adding field prefixes. format now uses that prefix for error reporting. * Template now allows attaching attribute field prefixes. * Credential store uses PrefixAttributeFieldErrorsWithSubactionPrefix. * Fixing naming of vault flags and helper flags. * Updating more references to generated api methods. * Make the capabilities String method more readable * Add comment outlining PrintApiError usage of Options. * Refactor test to move declarations closer to first use * Fix comment * Implement revoke method on vault repository * Tests now verify certs, CA, and tokens, addresses can be updated in a store. * Added test for creating store with pk/cert in same field. * Allo updating certificates seperate from private key. Only contact backing vault service when updating token. * Fixing bad tests and removing unused code. * Adding tests for various ways of updating tokens. * Add private credential * Add token revocation job and cred renewal/revocation job * Regen after merge. * Fixing field mask related merge error. * Create Library CLI. Removes vault prefix from path. Adds a WithoutCleanup testOption for vault. * Set all credentials to revoked when a token is revoked * Fixing missed renaming update. * fix copy/paste error. * Fixing code generation errors after merge. * make gen after merge. * Update internal/cmd/commands/credentialstorescmd/vault_funcs.go Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com> * Update internal/cmd/commands/credentialstorescmd/vault_funcs.go Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com> * Update internal/cmd/commands/credentialstorescmd/vault_funcs.go Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com> * Refactor: move migrations from 10 to 12 * Removing logic from transaction. * wrapping client errors in the calling op for CredentialStore's client() method. * Redact token * redact client key * updates * Add trigger to revoke credentials when session is canceled or terminated * Fixing some help text for some flags. * Add ability to load values from files (file://) or environment variables (env://). * Updating comments * fix bad merge * feedback * Adding issued credentials to sessions. * Error on capabilities * updates * Expose NewVaulTestServer * Add godoc * Adding generated SessionCredential struct for API. * Progress on building handler test for Authorize Session. * feedback * Update policies * Add 'revoke' as a status for Vault Tokens * Add delete_time to vault credential store * Create dynamic credentials at session creation time. * Tests pass with credentials attached to AuthorizedSession result. * Only call issue if there are credentials to issue. * Fixing output only issues. Adding type to credential library. * Fix test to clear un/pw generated. confirm generated un/pw changes from 1 authorize session call to another. * Update lookupTokenError * Add delete_time to private credential store * Refactor: move private store to separate file * Fixing tests for AuthorizeSession and verifying error cases. * Only create the credential repo if there are credentials to issue. * Rename Library field to CredentialLibrary. * Fixing missing change of Library to CredentialLibrary. * Removing Default SDK functions for fields which are required and update CLI to match. * Replace resource specific id variables with "id" and the input parmater for paths to be just a single string and the resource name as it should show up in the path. * Soft delete vault credential stores * Prevent new SQL functions from silently overwriting existing functions * Rename "Hmac" to "HMAC" in the human readable cli response table. * Fix tests * Add vault database cleanup jobs * Add ability to set the token period in the vault test harness * updates * Add not_null_columns func test * remove unused struct * Up no output timeout * Validate current vault token on addr update * Fix client cert change test * add cert test * Update revocation job where * Fix comment * Use Vault's default port in CLI help strings * Remove down migrations * Increase migration file numbers by 1 * Run make migrations * Move migrations from 12 to 10 * Increase Circle CI timeout for acceptance tests * Fix spelling mistake in error messages * ASD cmds for Target and returning credentials to AuthSession request (#1338) * Add Add/Set/Remove commands for libraries on Targets. Return credentials on AuthorizeSession request. Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com> Co-authored-by: Louis Ruch <louisruch@gmail.com> Co-authored-by: Todd Knight <T.Alan.Knight@gmail.com> Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>	5 years ago
Jeff Mitchell	e6af51943d	Add read:self and delete:self to auth tokens and add logout command (#1162)	5 years ago
Jim	dd0f34bc35	Add new OIDC auth method. (#1090) ... Co-authored-by: Todd Knight <T.Alan.Knight@gmail.com> Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com> Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>	5 years ago
Jeff Mitchell	9649a19d23	Update CLI error codes to be consistent with `connect` (#976)	5 years ago
Jeff Mitchell	519efa6dd1	Add -filter to CLI listing and website docs (#967) ... * Add -filter to CLI listing. This doesn't include docs/Changelog yet, that will come shortly. * Add changelog * Add website docs and fix a curl output bug	5 years ago
Jeff Mitchell	6b58a3317d	Add recursive listing to roles (#881) ... This also lays the framework for adding recursive listing to the rest of the resources.	5 years ago
Jeff Mitchell	5b5602969f	Update go-keyring to use forked version (#846) ... This may help with #830.	5 years ago
Jeff Malnick	af2d9dfe90	fix: do not print info in output that could be JSON or YAML format (#799) ... * fix: print err msg for no credentials found to stderr	5 years ago
Jeff Mitchell	813d21565f	Allow authorize-session to be invoked with target name (#737)	6 years ago
Jeff Mitchell	09b865ab28	Add `pass` cred storage support (#731) ... * Add `pass` cred storage support Make it the default on non-Windows/macOS Document the token storage behavior	6 years ago
Jeff Mitchell	f454fa9ef2	Don't return error code 1 if saving the value to the keyring (#668)	6 years ago
Jeff Mitchell	f8a2100603	Add various env vars to CLI (#528) ... * Add auth method ID env var * Add env var for host catalogs	6 years ago
Jeff Mitchell	d851ab07d8	Add ability to pull user/account/auth-method ID from stored token (#517)	6 years ago
Jeff Mitchell	cf3fa4522d	Swap base58 libraries (#472) ... * Swap base58 libraries This doesn't reduce binary size but it removes a metric ton of dependencies.	6 years ago
Jeff Mitchell	220ca253be	Add boundary config get-token (#455)	6 years ago
Jeff Mitchell	7fcbffbe88	Remove not-set value. (#427) ... I don't think the conditions exist here that necessitated it being introduced into Vault, but I do sometimes see a baffling condition where the address coming from the flag is empty. I don't think we need this so take it out.	6 years ago
Jeff Mitchell	38ce9d9eac	Combine controller and worker commands (#415)	6 years ago
Jeff Mitchell	dd06615c2e	Add database initialization command (#400)	6 years ago
Jeff Mitchell	d3606e14b6	Set wrapper on client, not token, so it doesn't fail KMS recovery on update calls	6 years ago
Jeff Mitchell	07a7e9750a	Tie together the database-driven session handling with the worker and add relevant CLI comands (#370)	6 years ago
Jeff Mitchell	3c13e4765d	Verbose isn't actually used right now so don't expose it; fix some wording for scope id flag	6 years ago
Jeff Mitchell	2914b4c14c	Use base58 for a few more user-facing values (#356)	6 years ago
Jeff Mitchell	ff0d49b6e4	Use previous method of getting recovery wrapper	6 years ago
Jeff Mitchell	f8237fb945	Move some packages into SDK, out of internal	6 years ago
Jeff Mitchell	36f975a952	Add some recovery KMS functions needed for external clients (#339)	6 years ago
Todd Knight	c3ecea172d	Generate new version of SDK resources and Add Tests (#331)	6 years ago
Jeff Mitchell	28df6eb7b0	Update config encrypt/decrypt CLI command (#309) ... This updates the command to our emergent standards. It also enables using a separate config file for a config kms, which allows non-string values to be encrypted. This allowed some nice cleanup as well.	6 years ago
Jeff Mitchell	74544f6324	Encrypt tokens on the way out and decrypt on the way in (#302) ... * Encrypt tokens on the way out and decrypt on the way in This isn't a security feature related to tokens specifically; it's so that we can discard cryptographically bad tokens before we ever hit the DB. This way we can't pass through a DDoS to the database due to fetching obviously invalid token values. I'm using base58 to encode the resulting value as there aren't great base62 options, and allowing base64 / and + values can hamper usability by creating copying/highlighting breaks.	6 years ago
Jeff Mitchell	ac4d9fa311	Add nonce storage and replay prevention test (#293)	6 years ago
Jeff Mitchell	414a2ab2c3	Remove some dead, dead, dead, dead code	6 years ago
Jeff Mitchell	b47cca0329	Add (non-db aspects of) the recovery key workflow (#286)	6 years ago
Jeff Mitchell	adfc5681be	Auth methods CLI (#277)	6 years ago
Jeff Mitchell	282177afc2	Remove the default org (#270)	6 years ago
Jeff Mitchell	b75a6fc5e5	Update scopes CLI command in the model of the roles command (#262) ... * Update scopes CLI command in the model of the roles command * Pull help functions to helper methods	6 years ago
Jeff Mitchell	6661117d4c	The name. The name. The name!	6 years ago
Jeff Mitchell	d74e30d94a	Minor, easy, linting fixes	6 years ago
Jeff Mitchell	908a299ea3	Convert SDK to the new options API (#238)	6 years ago
Jeff Mitchell	2bbc1163c4	Save the entire token, not just the ID (#211) ... This allows us to use the token's scope to set the default scope for an action in the client instead of relying on env vars.	6 years ago