Add support for templating key_id (#4215)

CHANGELOG.md

@@ -6,13 +6,17 @@ Canonical reference for changes, improvements, and bugfixes for Boundary.
 
 ### New and Improved
 
-* cli: New generic commands `read`, `update`, and `delete` have been added.
-  These allow operating on resources by directly specifying the ID of the
-  resource as the next parameter (e.g. `boundary update ttcp_1234567890`).
-  Subtypes do not need to be specified (e.g. that command is equivalent to
-  `boundary targets update tcp -id ttcp_1234567890`), and any flags given after
-  the ID are passed through to the type-specific subcommand. Once the ID has
-  been entered, autocomplete is also supported.
+* New generic commands `read`, `update`, and `delete` have been added. These
+  allow operating on resources by directly specifying the ID of the resource as
+  the next parameter (e.g. `boundary update ttcp_1234567890`). Subtypes do not
+  need to be specified (e.g. that command is equivalent to `boundary targets
+  update tcp -id ttcp_1234567890`), and any flags given after the ID are passed
+  through to the type-specific subcommand. Once the ID has been entered,
+  autocomplete is also supported.
+  ([PR](https://github.com/hashicorp/boundary/pull/3992))
+* The `key_id` parameter within SSH Certificate Credential Libraries now accepts
+  the use of templated parameters
+  ([PR](https://github.com/hashicorp/boundary/pull/4215))
 
 ## 0.14.3 (2023/12/12)
 
@@ -22,8 +26,8 @@ Canonical reference for changes, improvements, and bugfixes for Boundary.
   enables rate limits by default. For details on the default rate limits,
   how to configure rate limits, and how to disable rate limiting see the
   noted PR. ([PR](https://github.com/hashicorp/boundary/pull/4092))
-* Add support for OIDC prompts. Using prompts, the Relying Party (RP) can 
-  customize the authentication and authorization flow to suit their specific 
+* Add support for OIDC prompts. Using prompts, the Relying Party (RP) can
+  customize the authentication and authorization flow to suit their specific
   needs and improve the user experience. [OIDC Authentication request]
   (https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest) server.
   ([PR](https://github.com/hashicorp/boundary/pull/4053))

internal/credential/vault/private_library.go

@@ -898,6 +898,19 @@ func (lib *sshCertIssuingCredentialLibrary) retrieveCredential(ctx context.Conte
 		return nil, errors.Wrap(ctx, err, op)
 	}
 
+	// Template the key ID if it's not empty
+	keyId := lib.KeyId
+	if keyId != "" {
+		tplate, err = template.New(ctx, lib.KeyId)
+		if err != nil {
+			return nil, errors.Wrap(ctx, err, op)
+		}
+		keyId, err = tplate.Generate(ctx, opts.WithTemplateData)
+		if err != nil {
+			return nil, errors.Wrap(ctx, err, op)
+		}
+	}
+
 	var criticalOptions map[string]string
 	if lib.CriticalOptions != nil {
 		if json.Unmarshal(lib.CriticalOptions, &criticalOptions) != nil {
@@ -923,7 +936,7 @@ func (lib *sshCertIssuingCredentialLibrary) retrieveCredential(ctx context.Conte
 		CriticalOptions: criticalOptions,
 		Extensions:      extensions,
 		TTL:             lib.Ttl,
-		KeyId:           lib.KeyId,
+		KeyId:           keyId,
 	}
 
 	var privateKey credential.PrivateKey

internal/credential/vault/private_library_test.go

@@ -1268,6 +1268,7 @@ func TestRepository_sshCertIssuingCredentialLibrary_retrieveCredential(t *testin
 	tests := []struct {
 		name       string
 		username   string
+		keyId      string
 		vaulthPath string
 		opts       []Option
 		retOpts    []credential.Option
@@ -1332,6 +1333,18 @@ func TestRepository_sshCertIssuingCredentialLibrary_retrieveCredential(t *testin
 			opts:       []Option{WithKeyType(KeyTypeEcdsa), WithKeyBits(256)},
 			retOpts:    []credential.Option{credential.WithTemplateData(template.Data{User: template.User{Name: util.Pointer("revenge-of-the-template")}})},
 		},
+		{
+			name:     "vault issue ec(256) cert with template key ID",
+			username: "username-7-because-789",
+			keyId:    `{{truncateFrom .Account.Email "@"}}`,
+			expected: map[string]any{
+				"key_id":           "rise-of-the-template",
+				"valid_principals": []string{"username-7-because-789"},
+			},
+			vaulthPath: "ssh/issue/boundary",
+			opts:       []Option{WithKeyType(KeyTypeEcdsa), WithKeyBits(256)},
+			retOpts:    []credential.Option{credential.WithTemplateData(template.Data{Account: template.Account{Email: util.Pointer("rise-of-the-template@foobar.com")}})},
+		},
 		{
 			name:     "vault issue ec(384) cert with disallowed extension",
 			username: "username-10-because-789",