Merge pull request #567 from hashicorp/feature-oidc-standard-crud

OIDC standard crud - ICU-1365

addons/api/addon/models/fragment-auth-method-attributes.js

@@ -9,10 +9,10 @@ export default class FragmentAuthMethodAttributesModel extends Fragment {
   @attr('string') issuer;
   @attr('string') client_id;
   @attr('string') client_secret;
-  @attr('string') client_secret_hmac;
+  @attr('string', { readOnly: true }) client_secret_hmac;
   @attr('number') max_age;
   @attr('string') api_url_prefix;
-  @attr('string') callback_url;
+  @attr('string', { readOnly: true }) callback_url;
   @attr('boolean') disable_discovered_config_validation;
   @attr('boolean') dry_run;
 

addons/api/addon/serializers/fragment-auth-method-attributes.js

@@ -0,0 +1,26 @@
+import JSONSerializer from '@ember-data/serializer/json';
+
+export default class FragmentAuthMethodAttributesSerializer extends JSONSerializer {
+  /**
+   * If an attribute is annotated as readOnly in the model, don't serialize it.
+   * Otherwise delegate to default attribute serializer.
+   *
+   * @override
+   * @method serializeAttribute
+   * @param {Snapshot} snapshot
+   * @param {Object} json
+   * @param {String} key
+   * @param {Object} attribute
+   */
+  serializeAttribute(snapshot, json, key, attribute) {
+    const { type, options } = attribute;
+    let value = super.serializeAttribute(...arguments);
+    // Convert empty strings to null.
+    if (type === 'string' && json[key] === '') json[key] = null;
+    // Do not serialize read-only attributes.
+    if (options.readOnly) delete json[key];
+    // Client secret cannot be unset.  If it's falsy, it must be removed.
+    if (key === 'client_secret' && !json[key]) delete json[key];
+    return value;
+  }
+}

addons/api/app/serializers/fragment-auth-method-attributes.js

@@ -0,0 +1 @@
+export { default } from 'api/serializers/fragment-auth-method-attributes';

addons/api/mirage/generated/factories/auth-method.js

@@ -23,6 +23,8 @@ export default Factory.extend({
           client_id: 'YTwdJBB55LpKnuXb9n65',
           client_secret_hmac: 'GY7blb4ynM5TEPNi_qnphJ9aDWhW8FpmN3D-eP_L7Zk',
           issuer: 'http://127.0.0.1:57070',
+          max_age: 1800,
+          disable_discovered_config_validation: false,
           state: 'active-public',
           account_claim_maps: ['oid=sub', 'full_name=name'],
           claims_scopes: ['profile', 'email'],

addons/api/package.json

@@ -28,7 +28,7 @@
     "ember-cli-htmlbars": "^5.3.1",
     "ember-cli-mirage": "^1.1.8",
     "ember-data": "^3.20.0",
-    "ember-data-model-fragments": "5.0.0-beta.0",
+    "ember-data-model-fragments": "5.0.0-beta.2",
     "ember-fetch": "^8.0.1"
   },
   "devDependencies": {

addons/api/tests/unit/serializers/auth-method-test.js

@@ -46,6 +46,13 @@ module('Unit | Serializer | auth method', function (hooks) {
           { value: 'certificate-1234' },
           { value: 'certificate-5678' },
         ],
+        api_url_prefix: 'protocol://host:port/foo',
+        client_id: 'id123',
+        client_secret: 'secret456',
+        disable_discovered_config_validation: true,
+        dry_run: true,
+        issuer: 'http://www.example.net',
+        max_age: 500,
       },
     });
 
@@ -61,15 +68,13 @@ module('Unit | Serializer | auth method', function (hooks) {
         signing_algorithms: ['RS256', 'RS384'],
         allowed_audiences: ['www.alice.com', 'www.alice.com/admin'],
         idp_ca_certs: ['certificate-1234', 'certificate-5678'],
-        api_url_prefix: null,
+        api_url_prefix: 'protocol://host:port/foo',
-        callback_url: null,
+        client_id: 'id123',
-        client_id: null,
+        client_secret: 'secret456',
-        client_secret: null,
+        disable_discovered_config_validation: true,
-        client_secret_hmac: null,
+        dry_run: true,
-        disable_discovered_config_validation: false,
+        issuer: 'http://www.example.net',
-        dry_run: false,
+        max_age: 500,
-        issuer: null,
-        max_age: null,
       },
     });
   });

addons/api/tests/unit/serializers/fragment-auth-method-attributes-test.js

@@ -0,0 +1,37 @@
+import { module, test } from 'qunit';
+import { setupTest } from 'ember-qunit';
+
+module('Unit | Serializer | fragment auth method attributes', function (hooks) {
+  setupTest(hooks);
+
+  test('it serializes empty strings to null', function (assert) {
+    assert.expect(1);
+    const store = this.owner.lookup('service:store');
+    const record = store.createRecord('user', {
+      name: '',
+      description: '',
+      version: null,
+    });
+    let serializedRecord = record.serialize();
+    assert.deepEqual(serializedRecord, {
+      name: null,
+      description: null,
+    });
+  });
+
+  test('it does not serialize client_secret if present but falsy', function (assert) {
+    assert.expect(1);
+    const store = this.owner.lookup('service:store');
+    const record = store.createRecord('user', {
+      name: '',
+      description: '',
+      version: null,
+      client_secret: false,
+    });
+    let serializedRecord = record.serialize();
+    assert.deepEqual(serializedRecord, {
+      name: null,
+      description: null,
+    });
+  });
+});

addons/core/translations/form/en-us.yaml

@@ -51,3 +51,22 @@ origin:
   description: The Boundary URL to which to connect (e.g. protocol://host:port)
 proxy:
   label: Proxy
+issuer:
+  label: Issuer
+  help:  The issuer URL. Boundary expects only the schema, host, and port and will strip off ".well-known/openid-configuration" if present. This will be used for configuration discovery as well as for validation of the "iss" claim.
+client_id:
+  label: Client ID
+  help: An OAuth 2.0 Client Identifier valid at the Authorization Server.
+client_secret:
+  label: Client Secret
+  description: The client secret is set-only, may not be unset, and will not appear after a successful save.
+max_age:
+  label: Maximum Age
+  help: The OIDC "max_age" parameter sent to the Authorization Server indicating a maximum acceptable time in seconds since the user's last authentication before requiring the user to reauthenticate. 0 indicates an immediate need to reauthenticate.
+api_url_prefix:
+  label: API URL Prefix
+  help: The prefix that should be used for any URLs needed during the authentication flow. This includes the callback URL, the token retrieval URL, and the redirection URL used by the OIDC Authorization Server.
+disable_discovered_config_validation:
+  label: Disable discovered config validation
+  help: >
+    If the Authorization Server's discovered configuration contains values that do not match the configuration set on this auth method, this can be set to force the local configuration to override the discovered values.  This is useful in the case of slow-changing or incorrect values announced by the Authorization Server. NOTE: For safety, not providing this value will be treated the same as "false"; that is, every time the method is updated or the state is changed, this value must be set to "true" or it will be disabled.

ui/admin/app/components/form/auth-method/oidc/index.hbs

@@ -0,0 +1,168 @@
+<Rose::Form
+  @onSubmit={{@submit}}
+  @cancel={{@cancel}}
+  @disabled={{@model.isSaving}}
+  @error={{@model.errors.base}}
+  @showEditToggle={{if @model.isNew false true}}
+  as |form|
+>
+  <form.input
+    @value={{@model.type}}
+    @label={{t 'form.type.label'}}
+    readonly={{true}}
+    @disabled={{true}}
+  />
+
+  <form.input
+    @name='name'
+    @type='text'
+    @value={{@model.name}}
+    @label={{t 'form.name.label'}}
+    @helperText={{t 'form.name.help'}}
+    @error={{@model.errors.name}}
+    readonly={{false}}
+    as |field|
+  >
+    {{#if @model.errors.name}}
+      <field.errors as |errors|>
+        {{#each @model.errors.name as |error|}}
+          <errors.message>{{error.message}}</errors.message>
+        {{/each}}
+      </field.errors>
+    {{/if}}
+  </form.input>
+
+  <form.textarea
+    @name='description'
+    @type='text'
+    @value={{@model.description}}
+    @label={{t 'form.description.label'}}
+    @helperText={{t 'form.description.help'}}
+    @error={{@model.errors.description}}
+    disabled={{@model.isSaving}}
+    readonly={{false}}
+    as |field|
+  >
+    {{#if @model.errors.description}}
+      <field.errors as |errors|>
+        {{#each @model.errors.description as |error|}}
+          <errors.message>{{error.message}}</errors.message>
+        {{/each}}
+      </field.errors>
+    {{/if}}
+  </form.textarea>
+
+  <form.input
+    @name='issuer'
+    @type='text'
+    @value={{@model.attributes.issuer}}
+    @label={{t 'form.issuer.label'}}
+    @helperText={{t 'form.issuer.help'}}
+    @error={{@model.errors.attributes.issuer}}
+    readonly={{false}}
+    as |field|
+  >
+    {{#if @model.errors.attributes.issuer}}
+      <field.errors as |errors|>
+        {{#each @model.errors.attributes.issuer as |error|}}
+          <errors.message>{{error.message}}</errors.message>
+        {{/each}}
+      </field.errors>
+    {{/if}}
+  </form.input>
+
+  <form.checkbox
+    @label={{t 'form.disable_discovered_config_validation.label'}}
+    @helperText={{t 'form.disable_discovered_config_validation.help'}}
+    @checked={{@model.attributes.disable_discovered_config_validation}}
+    onChange={{fn
+      (mut @model.attributes.disable_discovered_config_validation)
+      (if @model.attributes.disable_discovered_config_validation false true)
+    }}
+  />
+
+  <form.input
+    @name='client_id'
+    @type='text'
+    @value={{@model.attributes.client_id}}
+    @label={{t 'form.client_id.label'}}
+    @helperText={{t 'form.client_id.help'}}
+    @error={{@model.errors.attributes.client_id}}
+    readonly={{false}}
+    as |field|
+  >
+    {{#if @model.errors.attributes.client_id}}
+      <field.errors as |errors|>
+        {{#each @model.errors.attributes.client_id as |error|}}
+          <errors.message>{{error.message}}</errors.message>
+        {{/each}}
+      </field.errors>
+    {{/if}}
+  </form.input>
+
+  <form.input
+    @name='client_secret'
+    @type='password'
+    @value={{@model.attributes.client_secret}}
+    @label={{t 'form.client_secret.label'}}
+    @helperText={{t 'form.client_secret.help'}}
+    @error={{@model.errors.attributes.client_secret}}
+    readonly={{false}}
+    as |field|
+  >
+    {{#if @model.errors.attributes.client_secret}}
+      <field.errors as |errors|>
+        {{#each @model.errors.attributes.client_secret as |error|}}
+          <errors.message>{{error.message}}</errors.message>
+        {{/each}}
+      </field.errors>
+    {{/if}}
+  </form.input>
+
+  <form.input
+    @name='max_age'
+    @type='number'
+    @value={{@model.attributes.max_age}}
+    @label={{t 'form.max_age.label'}}
+    @helperText={{t 'form.max_age.help'}}
+    @error={{@model.errors.attributes.max_age}}
+    readonly={{false}}
+    step='1'
+    min='0'
+    as |field|
+  >
+    {{#if @model.errors.attributes.max_age}}
+      <field.errors as |errors|>
+        {{#each @model.errors.attributes.max_age as |error|}}
+          <errors.message>{{error.message}}</errors.message>
+        {{/each}}
+      </field.errors>
+    {{/if}}
+  </form.input>
+
+  <form.input
+    @name='api_url_prefix'
+    @type='test'
+    @value={{@model.attributes.api_url_prefix}}
+    @label={{t 'form.api_url_prefix.label'}}
+    @helperText={{t 'form.api_url_prefix.help'}}
+    @error={{@model.errors.attributes.api_url_prefix}}
+    readonly={{false}}
+    as |field|
+  >
+    {{#if @model.errors.attributes.api_url_prefix}}
+      <field.errors as |errors|>
+        {{#each @model.errors.attributes.api_url_prefix as |error|}}
+          <errors.message>{{error.message}}</errors.message>
+        {{/each}}
+      </field.errors>
+    {{/if}}
+  </form.input>
+
+  <form.actions
+    @disabled={{if @model.cannotSave @model.cannotSave}}
+    @enableEditText={{t 'actions.edit-form'}}
+    @submitText={{t 'actions.save'}}
+    @cancelText={{t 'actions.cancel'}}
+  />
+</Rose::Form>

ui/admin/config/environment.js

@@ -86,9 +86,9 @@ module.exports = function (environment) {
     },
 
     featureFlags: {
+      'primary-auth-method': true,
       oidc: true,
       'oidc-crud': false,
-      'primary-auth-method': true,
       search: false,
       filter: false,
       capabilities: false,
@@ -130,7 +130,7 @@ module.exports = function (environment) {
     // Enable features in development
     ENV.featureFlags['primary-auth-method'] = true;
     ENV.featureFlags['oidc'] = true;
-    //ENV.featureFlags['oidc-crud'] = true;
+    ENV.featureFlags['oidc-crud'] = true;
   }
 
   if (environment === 'test') {

yarn.lock

@@ -8278,39 +8278,6 @@ ember-cli-babel-plugin-helpers@^1.0.0, ember-cli-babel-plugin-helpers@^1.1.0, em
   resolved "https://registry.yarnpkg.com/ember-cli-babel-plugin-helpers/-/ember-cli-babel-plugin-helpers-1.1.1.tgz#5016b80cdef37036c4282eef2d863e1d73576879"
   integrity sha512-sKvOiPNHr5F/60NLd7SFzMpYPte/nnGkq/tMIfXejfKHIhaiIkYFqX8Z9UFTKWLLn+V7NOaby6niNPZUdvKCRw==
 
-ember-cli-babel@7, ember-cli-babel@^7.0.0, ember-cli-babel@^7.1.0, ember-cli-babel@^7.1.2, ember-cli-babel@^7.10.0, ember-cli-babel@^7.11.1, ember-cli-babel@^7.13.0, ember-cli-babel@^7.13.2, ember-cli-babel@^7.18.0, ember-cli-babel@^7.19.0, ember-cli-babel@^7.20.5, ember-cli-babel@^7.21.0, ember-cli-babel@^7.22.1, ember-cli-babel@^7.23.0, ember-cli-babel@^7.23.1, ember-cli-babel@^7.26.2, ember-cli-babel@^7.26.3, ember-cli-babel@^7.4.0, ember-cli-babel@^7.5.0, ember-cli-babel@^7.7.3:
-  version "7.26.3"
-  resolved "https://registry.yarnpkg.com/ember-cli-babel/-/ember-cli-babel-7.26.3.tgz#e93ce7ec458208894d10844cf76e41cc06fdbeb6"
-  integrity sha512-ZCs0g99d3kYaHs1+HT33oMY7/K+nLCAAv7dCLxsMzg7cQf55O6Pq4ZKnWEr3IHVs33xbJFnEb9prt1up36QVnw==
-  dependencies:
-    "@babel/core" "^7.12.0"
-    "@babel/helper-compilation-targets" "^7.12.0"
-    "@babel/plugin-proposal-class-properties" "^7.13.0"
-    "@babel/plugin-proposal-decorators" "^7.13.5"
-    "@babel/plugin-transform-modules-amd" "^7.13.0"
-    "@babel/plugin-transform-runtime" "^7.13.9"
-    "@babel/plugin-transform-typescript" "^7.13.0"
-    "@babel/polyfill" "^7.11.5"
-    "@babel/preset-env" "^7.12.0"
-    "@babel/runtime" "7.12.18"
-    amd-name-resolver "^1.3.1"
-    babel-plugin-debug-macros "^0.3.4"
-    babel-plugin-ember-data-packages-polyfill "^0.1.2"
-    babel-plugin-ember-modules-api-polyfill "^3.5.0"
-    babel-plugin-module-resolver "^3.2.0"
-    broccoli-babel-transpiler "^7.8.0"
-    broccoli-debug "^0.6.4"
-    broccoli-funnel "^2.0.2"
-    broccoli-source "^2.1.2"
-    clone "^2.1.2"
-    ember-cli-babel-plugin-helpers "^1.1.1"
-    ember-cli-version-checker "^4.1.0"
-    ensure-posix-path "^1.0.2"
-    fixturify-project "^1.10.0"
-    resolve-package-path "^3.1.0"
-    rimraf "^3.0.1"
-    semver "^5.5.0"
-
 ember-cli-babel@7.21.0:
   version "7.21.0"
   resolved "https://registry.yarnpkg.com/ember-cli-babel/-/ember-cli-babel-7.21.0.tgz#c79e888876aee87dfc3260aee7cb580b74264bbc"
@@ -8362,6 +8329,39 @@ ember-cli-babel@^6.0.0-beta.4, ember-cli-babel@^6.16.0, ember-cli-babel@^6.3.0,
     ember-cli-version-checker "^2.1.2"
     semver "^5.5.0"
 
+ember-cli-babel@^7.0.0, ember-cli-babel@^7.1.0, ember-cli-babel@^7.1.2, ember-cli-babel@^7.10.0, ember-cli-babel@^7.11.1, ember-cli-babel@^7.13.0, ember-cli-babel@^7.13.2, ember-cli-babel@^7.18.0, ember-cli-babel@^7.19.0, ember-cli-babel@^7.20.5, ember-cli-babel@^7.21.0, ember-cli-babel@^7.22.1, ember-cli-babel@^7.23.0, ember-cli-babel@^7.23.1, ember-cli-babel@^7.26.2, ember-cli-babel@^7.26.3, ember-cli-babel@^7.4.0, ember-cli-babel@^7.5.0, ember-cli-babel@^7.7.3:
+  version "7.26.3"
+  resolved "https://registry.yarnpkg.com/ember-cli-babel/-/ember-cli-babel-7.26.3.tgz#e93ce7ec458208894d10844cf76e41cc06fdbeb6"
+  integrity sha512-ZCs0g99d3kYaHs1+HT33oMY7/K+nLCAAv7dCLxsMzg7cQf55O6Pq4ZKnWEr3IHVs33xbJFnEb9prt1up36QVnw==
+  dependencies:
+    "@babel/core" "^7.12.0"
+    "@babel/helper-compilation-targets" "^7.12.0"
+    "@babel/plugin-proposal-class-properties" "^7.13.0"
+    "@babel/plugin-proposal-decorators" "^7.13.5"
+    "@babel/plugin-transform-modules-amd" "^7.13.0"
+    "@babel/plugin-transform-runtime" "^7.13.9"
+    "@babel/plugin-transform-typescript" "^7.13.0"
+    "@babel/polyfill" "^7.11.5"
+    "@babel/preset-env" "^7.12.0"
+    "@babel/runtime" "7.12.18"
+    amd-name-resolver "^1.3.1"
+    babel-plugin-debug-macros "^0.3.4"
+    babel-plugin-ember-data-packages-polyfill "^0.1.2"
+    babel-plugin-ember-modules-api-polyfill "^3.5.0"
+    babel-plugin-module-resolver "^3.2.0"
+    broccoli-babel-transpiler "^7.8.0"
+    broccoli-debug "^0.6.4"
+    broccoli-funnel "^2.0.2"
+    broccoli-source "^2.1.2"
+    clone "^2.1.2"
+    ember-cli-babel-plugin-helpers "^1.1.1"
+    ember-cli-version-checker "^4.1.0"
+    ensure-posix-path "^1.0.2"
+    fixturify-project "^1.10.0"
+    resolve-package-path "^3.1.0"
+    rimraf "^3.0.1"
+    semver "^5.5.0"
+
 ember-cli-babel@^7.24.0:
   version "7.26.4"
   resolved "https://registry.yarnpkg.com/ember-cli-babel/-/ember-cli-babel-7.26.4.tgz#b73d53592c05479814ca1770b3b849d4e01a87f0"
@@ -8884,25 +8884,32 @@ ember-cookies@^0.5.0, ember-cookies@^0.5.2:
     ember-cli-babel "^7.1.0"
     ember-getowner-polyfill "^1.1.0 || ^2.0.0"
 
-ember-copy@1.0.0, ember-copy@^1.0.0:
+ember-copy@2.0.1:
+  version "2.0.1"
+  resolved "https://registry.yarnpkg.com/ember-copy/-/ember-copy-2.0.1.tgz#13192b12a250324bb4a8b4547a680b113f4e3041"
+  integrity sha512-N/XFvZszrzyyX4IcNoeK4mJvIItNuONumhPLqi64T8NDjJkxBj4Pq61rvMkJx/9eZ8alzE4I8vYKOLxT0FvRuQ==
+  dependencies:
+    ember-cli-babel "^7.22.1"
+
+ember-copy@^1.0.0:
   version "1.0.0"
   resolved "https://registry.yarnpkg.com/ember-copy/-/ember-copy-1.0.0.tgz#426554ba6cf65920f31d24d0a3ca2cb1be16e4aa"
   integrity sha512-aiZNAvOmdemHdvZNn0b5b/0d9g3JFpcOsrDgfhYEbfd7SzE0b69YiaVK2y3wjqfjuuiA54vOllGN4pjSzECNSw==
   dependencies:
     ember-cli-babel "^6.6.0"
 
-ember-data-model-fragments@5.0.0-beta.0:
+ember-data-model-fragments@5.0.0-beta.2:
-  version "5.0.0-beta.0"
+  version "5.0.0-beta.2"
-  resolved "https://registry.yarnpkg.com/ember-data-model-fragments/-/ember-data-model-fragments-5.0.0-beta.0.tgz#da90799970317ca852f96b2ea1548ca70094a5bb"
+  resolved "https://registry.yarnpkg.com/ember-data-model-fragments/-/ember-data-model-fragments-5.0.0-beta.2.tgz#cc5f6e37363216a227394b31beb8eecc4c267a3e"
-  integrity sha512-vjApz3ZWSiLyUUU2IRi/ArKVBJe+iW+BvKkiQ6an/e7ln4Jt06P9xXm1Fu3hfqkQOQlfn7QkUnlzm4XxRtlMfg==
+  integrity sha512-LMObs51btOpHFX0DABReU68hpzkZp/yCKCh5w6CSGEm7MM5Bcj8p7Wb4GQIPZANKidVSvdCOT4qnyCREyUatBg==
   dependencies:
     broccoli-file-creator "^2.1.1"
     broccoli-merge-trees "^3.0.0"
     calculate-cache-key-for-tree "^1.1.0"
-    ember-cli-babel "7"
+    ember-cli-babel "^7.23.0"
     ember-compatibility-helpers "^1.2.1"
-    ember-copy "1.0.0"
+    ember-copy "2.0.1"
-    git-repo-info "^2.0.0"
+    git-repo-info "^2.1.1"
     npm-git-info "^1.0.3"
 
 ember-data@^3.20.0:
@@ -11307,7 +11314,7 @@ git-read-pkt-line@0.0.8:
     bops "0.0.3"
     through "~2.2.7"
 
-git-repo-info@^2.0.0, git-repo-info@^2.1.1:
+git-repo-info@^2.1.1:
   version "2.1.1"
   resolved "https://registry.yarnpkg.com/git-repo-info/-/git-repo-info-2.1.1.tgz#220ffed8cbae74ef8a80e3052f2ccb5179aed058"
   integrity sha512-8aCohiDo4jwjOwma4FmYFd3i97urZulL8XL24nIPxuE+GZnfsAyy/g2Shqx6OjUiFKUXZM+Yy+KHnOmmA3FVcg==