From 263660a7cbe0be341bbd3670e9402e8c51c60f46 Mon Sep 17 00:00:00 2001 From: Jeff Mitchell Date: Thu, 4 Jan 2024 21:19:36 -0500 Subject: [PATCH] Add support for templating key_id (#4215) --- CHANGELOG.md | 22 +++++++++++-------- internal/credential/vault/private_library.go | 15 ++++++++++++- .../credential/vault/private_library_test.go | 13 +++++++++++ 3 files changed, 40 insertions(+), 10 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4e287556d..7e37eb2ba 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,13 +6,17 @@ Canonical reference for changes, improvements, and bugfixes for Boundary. ### New and Improved -* cli: New generic commands `read`, `update`, and `delete` have been added. - These allow operating on resources by directly specifying the ID of the - resource as the next parameter (e.g. `boundary update ttcp_1234567890`). - Subtypes do not need to be specified (e.g. that command is equivalent to - `boundary targets update tcp -id ttcp_1234567890`), and any flags given after - the ID are passed through to the type-specific subcommand. Once the ID has - been entered, autocomplete is also supported. +* New generic commands `read`, `update`, and `delete` have been added. These + allow operating on resources by directly specifying the ID of the resource as + the next parameter (e.g. `boundary update ttcp_1234567890`). Subtypes do not + need to be specified (e.g. that command is equivalent to `boundary targets + update tcp -id ttcp_1234567890`), and any flags given after the ID are passed + through to the type-specific subcommand. Once the ID has been entered, + autocomplete is also supported. + ([PR](https://github.com/hashicorp/boundary/pull/3992)) +* The `key_id` parameter within SSH Certificate Credential Libraries now accepts + the use of templated parameters + ([PR](https://github.com/hashicorp/boundary/pull/4215)) ## 0.14.3 (2023/12/12) @@ -22,8 +26,8 @@ Canonical reference for changes, improvements, and bugfixes for Boundary. enables rate limits by default. For details on the default rate limits, how to configure rate limits, and how to disable rate limiting see the noted PR. ([PR](https://github.com/hashicorp/boundary/pull/4092)) -* Add support for OIDC prompts. Using prompts, the Relying Party (RP) can - customize the authentication and authorization flow to suit their specific +* Add support for OIDC prompts. Using prompts, the Relying Party (RP) can + customize the authentication and authorization flow to suit their specific needs and improve the user experience. [OIDC Authentication request] (https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest) server. ([PR](https://github.com/hashicorp/boundary/pull/4053)) diff --git a/internal/credential/vault/private_library.go b/internal/credential/vault/private_library.go index e4f492d74..a5dc34246 100644 --- a/internal/credential/vault/private_library.go +++ b/internal/credential/vault/private_library.go @@ -898,6 +898,19 @@ func (lib *sshCertIssuingCredentialLibrary) retrieveCredential(ctx context.Conte return nil, errors.Wrap(ctx, err, op) } + // Template the key ID if it's not empty + keyId := lib.KeyId + if keyId != "" { + tplate, err = template.New(ctx, lib.KeyId) + if err != nil { + return nil, errors.Wrap(ctx, err, op) + } + keyId, err = tplate.Generate(ctx, opts.WithTemplateData) + if err != nil { + return nil, errors.Wrap(ctx, err, op) + } + } + var criticalOptions map[string]string if lib.CriticalOptions != nil { if json.Unmarshal(lib.CriticalOptions, &criticalOptions) != nil { @@ -923,7 +936,7 @@ func (lib *sshCertIssuingCredentialLibrary) retrieveCredential(ctx context.Conte CriticalOptions: criticalOptions, Extensions: extensions, TTL: lib.Ttl, - KeyId: lib.KeyId, + KeyId: keyId, } var privateKey credential.PrivateKey diff --git a/internal/credential/vault/private_library_test.go b/internal/credential/vault/private_library_test.go index 6c79c837d..0cbebe0f3 100644 --- a/internal/credential/vault/private_library_test.go +++ b/internal/credential/vault/private_library_test.go @@ -1268,6 +1268,7 @@ func TestRepository_sshCertIssuingCredentialLibrary_retrieveCredential(t *testin tests := []struct { name string username string + keyId string vaulthPath string opts []Option retOpts []credential.Option @@ -1332,6 +1333,18 @@ func TestRepository_sshCertIssuingCredentialLibrary_retrieveCredential(t *testin opts: []Option{WithKeyType(KeyTypeEcdsa), WithKeyBits(256)}, retOpts: []credential.Option{credential.WithTemplateData(template.Data{User: template.User{Name: util.Pointer("revenge-of-the-template")}})}, }, + { + name: "vault issue ec(256) cert with template key ID", + username: "username-7-because-789", + keyId: `{{truncateFrom .Account.Email "@"}}`, + expected: map[string]any{ + "key_id": "rise-of-the-template", + "valid_principals": []string{"username-7-because-789"}, + }, + vaulthPath: "ssh/issue/boundary", + opts: []Option{WithKeyType(KeyTypeEcdsa), WithKeyBits(256)}, + retOpts: []credential.Option{credential.WithTemplateData(template.Data{Account: template.Account{Email: util.Pointer("rise-of-the-template@foobar.com")}})}, + }, { name: "vault issue ec(384) cert with disallowed extension", username: "username-10-because-789",