Merge remote-tracking branch 'origin/main' into llb-byow

internal/tests/api/accounts/account_test.go

@@ -398,5 +398,14 @@ func TestErrorsOidc(t *testing.T) {
 		accounts.WithPasswordAccountLoginName("foo"),
 	)
 	require.Error(err)
-	require.JSONEq(err.Error(), `{"kind":"InvalidArgument", "message":"Error in provided request.", "details":{"request_fields":[{"name":"attributes", "description":"Attribute fields do not match the expected format."}]}}`)
+	require.JSONEq(err.Error(), `{
+		"details": {
+			"request_fields": [{
+				"description": "Attribute fields do not match the expected format.",
+				"name": "attributes"
+			}]
+		},
+		"kind": "InvalidArgument",
+		"message": "Error in provided request."
+	}`)
 }

internal/tests/api/authmethods/authmethod_test.go

@@ -362,4 +362,20 @@ func TestErrors(t *testing.T) {
 	apiErr = api.AsServerError(err)
 	require.NotNil(apiErr)
 	assert.EqualValues(http.StatusBadRequest, apiErr.Response().StatusCode())
+
+	// Passing in a invalid authentication method sub-type should return an  error
+	_, err = amClient.Authenticate(tc.Context(), "ampwd_1234567890", "login", map[string]interface{}{
+		"login_name": "admin",
+		"password":   "password",
+	})
+	require.Error(err)
+	apiErr = api.AsServerError(err)
+	require.NotNil(apiErr)
+	assert.Len(apiErr.Details.RequestFields, 1)
+	assert.EqualValues(apiErr.Details.RequestFields, []*api.FieldError{
+		{
+			Name:        "attributes",
+			Description: "unknown subtype in ID: ampwd_1234567890",
+		},
+	})
 }

internal/tests/api/credentials/credentials_classification_test.go

@@ -0,0 +1,201 @@
+package credentials_test
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/hashicorp/boundary/sdk/pbs/controller/api"
+	pb "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/credentials"
+	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/scopes"
+	"github.com/hashicorp/boundary/sdk/wrapper"
+	"github.com/hashicorp/eventlogger"
+	"github.com/hashicorp/eventlogger/filters/encrypt"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/structpb"
+	"google.golang.org/protobuf/types/known/timestamppb"
+	"google.golang.org/protobuf/types/known/wrapperspb"
+)
+
+func TestCredentialClassification(t *testing.T) {
+	ctx := context.Background()
+	now := time.Now()
+	pbNow := timestamppb.Now()
+	wrapper := wrapper.TestWrapper(t)
+	testEncryptingFilter := api.NewEncryptFilter(t, wrapper)
+
+	cases := []struct {
+		name string
+		in   *eventlogger.Event
+		want *eventlogger.Event
+	}{
+		{
+			"Usernamepassword",
+			&eventlogger.Event{
+				Type:      "test",
+				CreatedAt: now,
+				Payload: &pb.Credential{
+					Id:                "id",
+					CredentialStoreId: "cred-store-id",
+					Scope: &scopes.ScopeInfo{
+						Id:            "scope-id",
+						Type:          "scope-type",
+						Name:          "scope-name",
+						Description:   "scope-descriptione",
+						ParentScopeId: "scope-parent-scope-id",
+					},
+					Name: &wrapperspb.StringValue{
+						Value: "name",
+					},
+					Description: &wrapperspb.StringValue{
+						Value: "description",
+					},
+					CreatedTime: pbNow,
+					UpdatedTime: pbNow,
+					Version:     1,
+					Type:        "username_password",
+					Attrs: &pb.Credential_UsernamePasswordAttributes{
+						UsernamePasswordAttributes: &pb.UsernamePasswordAttributes{
+							Username:     &wrapperspb.StringValue{Value: "username"},
+							Password:     &wrapperspb.StringValue{Value: "password"},
+							PasswordHmac: "password-hmac",
+						},
+					},
+					AuthorizedActions: []string{
+						"action-1",
+						"action-2",
+					},
+				},
+			},
+			&eventlogger.Event{
+				Type:      "test",
+				CreatedAt: now,
+				Payload: &pb.Credential{
+					Id:                "id",
+					CredentialStoreId: "cred-store-id",
+					Scope: &scopes.ScopeInfo{
+						Id:            "scope-id",
+						Type:          "scope-type",
+						Name:          "scope-name",
+						Description:   "scope-descriptione",
+						ParentScopeId: "scope-parent-scope-id",
+					},
+					Name: &wrapperspb.StringValue{
+						Value: "name",
+					},
+					Description: &wrapperspb.StringValue{
+						Value: "description",
+					},
+					CreatedTime: pbNow,
+					UpdatedTime: pbNow,
+					Version:     1,
+					Type:        "username_password",
+					Attrs: &pb.Credential_UsernamePasswordAttributes{
+						UsernamePasswordAttributes: &pb.UsernamePasswordAttributes{
+							Username:     &wrapperspb.StringValue{Value: "username"},
+							Password:     &wrapperspb.StringValue{Value: "[REDACTED]"},
+							PasswordHmac: "password-hmac",
+						},
+					},
+					AuthorizedActions: []string{
+						"action-1",
+						"action-2",
+					},
+				},
+			},
+		},
+		{
+			"Default",
+			&eventlogger.Event{
+				Type:      "test",
+				CreatedAt: now,
+				Payload: &pb.Credential{
+					Id:                "id",
+					CredentialStoreId: "cred-store-id",
+					Scope: &scopes.ScopeInfo{
+						Id:            "scope-id",
+						Type:          "scope-type",
+						Name:          "scope-name",
+						Description:   "scope-descriptione",
+						ParentScopeId: "scope-parent-scope-id",
+					},
+					Name: &wrapperspb.StringValue{
+						Value: "name",
+					},
+					Description: &wrapperspb.StringValue{
+						Value: "description",
+					},
+					CreatedTime: pbNow,
+					UpdatedTime: pbNow,
+					Version:     1,
+					Type:        "username_password",
+					Attrs: &pb.Credential_Attributes{
+						Attributes: &structpb.Struct{
+							Fields: map[string]*structpb.Value{
+								"field1": structpb.NewStringValue("value-1"),
+								"field2": structpb.NewStringValue("value-2"),
+							},
+						},
+					},
+					AuthorizedActions: []string{
+						"action-1",
+						"action-2",
+					},
+				},
+			},
+			&eventlogger.Event{
+				Type:      "test",
+				CreatedAt: now,
+				Payload: &pb.Credential{
+					Id:                "id",
+					CredentialStoreId: "cred-store-id",
+					Scope: &scopes.ScopeInfo{
+						Id:            "scope-id",
+						Type:          "scope-type",
+						Name:          "scope-name",
+						Description:   "scope-descriptione",
+						ParentScopeId: "scope-parent-scope-id",
+					},
+					Name: &wrapperspb.StringValue{
+						Value: "name",
+					},
+					Description: &wrapperspb.StringValue{
+						Value: "description",
+					},
+					CreatedTime: pbNow,
+					UpdatedTime: pbNow,
+					Version:     1,
+					Type:        "username_password",
+					Attrs: &pb.Credential_Attributes{
+						Attributes: &structpb.Struct{
+							Fields: map[string]*structpb.Value{
+								"field1": structpb.NewStringValue(encrypt.RedactedData),
+								"field2": structpb.NewStringValue(encrypt.RedactedData),
+							},
+						},
+					},
+					AuthorizedActions: []string{
+						"action-1",
+						"action-2",
+					},
+				},
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			wantJSON, err := json.Marshal(tc.want)
+			require.NoError(t, err)
+
+			got, err := testEncryptingFilter.Process(ctx, tc.in)
+			require.NoError(t, err)
+			require.NotNil(t, got)
+			gotJSON, err := json.Marshal(got)
+			require.NoError(t, err)
+			assert.JSONEq(t, string(wantJSON), string(gotJSON))
+		})
+	}
+}

internal/tests/api/credentials/credentials_test.go

@@ -0,0 +1,208 @@
+package credentials_test
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/credentials"
+	"github.com/hashicorp/boundary/api/credentialstores"
+	"github.com/hashicorp/boundary/internal/credential/static"
+	"github.com/hashicorp/boundary/internal/daemon/controller"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestList(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	_, proj := iam.TestScopes(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+
+	cs, err := credentialstores.NewClient(client).Create(tc.Context(), "static", proj.GetPublicId())
+	require.NoError(err)
+	require.NotNil(cs)
+
+	credClient := credentials.NewClient(client)
+
+	ul, err := credClient.List(tc.Context(), cs.Item.Id)
+	require.NoError(err)
+	assert.Empty(ul.Items)
+
+	cred, err := credClient.Create(tc.Context(), static.UsernamePasswordSubtype.String(), cs.Item.Id,
+		credentials.WithName("0"),
+		credentials.WithDescription("description"),
+		credentials.WithUsernamePasswordCredentialUsername("user"),
+		credentials.WithUsernamePasswordCredentialPassword("pass"))
+	require.NoError(err)
+
+	expected := make([]*credentials.Credential, 10)
+	expected[0] = cred.Item
+
+	ul, err = credClient.List(tc.Context(), cs.Item.Id)
+	require.NoError(err)
+	assert.ElementsMatch(comparableCatalogSlice(expected[:1]), comparableCatalogSlice(ul.Items))
+
+	for i := 1; i < 10; i++ {
+		cred, err := credClient.Create(tc.Context(), static.UsernamePasswordSubtype.String(), cs.Item.Id,
+			credentials.WithName(fmt.Sprintf("%d", i)),
+			credentials.WithDescription("description"),
+			credentials.WithUsernamePasswordCredentialUsername("user"),
+			credentials.WithUsernamePasswordCredentialPassword("pass"))
+		require.NoError(err)
+		expected[i] = cred.Item
+	}
+	ul, err = credClient.List(tc.Context(), cs.Item.Id)
+	require.NoError(err)
+	assert.ElementsMatch(comparableCatalogSlice(expected), comparableCatalogSlice(ul.Items))
+
+	filterItem := ul.Items[3]
+	ul, err = credClient.List(tc.Context(), cs.Item.Id,
+		credentials.WithFilter(fmt.Sprintf(`"/item/id"==%q`, filterItem.Id)))
+	require.NoError(err)
+	assert.Len(ul.Items, 1)
+	assert.Equal(filterItem.Id, ul.Items[0].Id)
+}
+
+func comparableCatalogSlice(in []*credentials.Credential) []credentials.Credential {
+	var filtered []credentials.Credential
+	for _, i := range in {
+		p := credentials.Credential{
+			Id:          i.Id,
+			Name:        i.Name,
+			Description: i.Description,
+			CreatedTime: i.CreatedTime,
+			UpdatedTime: i.UpdatedTime,
+			Attributes:  i.Attributes,
+		}
+		filtered = append(filtered, p)
+	}
+	return filtered
+}
+
+func TestCrud(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	_, proj := iam.TestScopes(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+
+	cs, err := credentialstores.NewClient(client).Create(tc.Context(), "static", proj.GetPublicId())
+	require.NoError(err)
+	require.NotNil(cs)
+
+	checkResource := func(step string, c *credentials.Credential, wantedName, wantedUser string, wantVersion uint32) {
+		assert.NotNil(c, "returned no resource", step)
+		assert.Equal(wantedName, c.Name, step)
+		gotUser, ok := c.Attributes["username"]
+		require.True(ok)
+		assert.Equal(wantedUser, gotUser, step)
+		assert.Equal(wantVersion, c.Version)
+	}
+	credClient := credentials.NewClient(client)
+
+	cred, err := credClient.Create(tc.Context(), static.UsernamePasswordSubtype.String(), cs.Item.Id, credentials.WithName("foo"),
+		credentials.WithUsernamePasswordCredentialUsername("user"), credentials.WithUsernamePasswordCredentialPassword("pass"))
+	require.NoError(err)
+	require.NotNil(cs)
+	checkResource("create", cred.Item, "foo", "user", 1)
+
+	cred, err = credClient.Read(tc.Context(), cred.Item.Id)
+	require.NoError(err)
+	require.NotNil(cs)
+	checkResource("read", cred.Item, "foo", "user", 1)
+
+	cred, err = credClient.Update(tc.Context(), cred.Item.Id, cred.Item.Version, credentials.WithName("bar"))
+	require.NoError(err)
+	require.NotNil(cs)
+	checkResource("update", cred.Item, "bar", "user", 2)
+
+	cred, err = credClient.Update(tc.Context(), cred.Item.Id, cred.Item.Version, credentials.WithUsernamePasswordCredentialUsername("newuser"))
+	require.NoError(err)
+	require.NotNil(cs)
+	checkResource("update", cred.Item, "bar", "newuser", 3)
+
+	cred, err = credClient.Update(tc.Context(), cred.Item.Id, cred.Item.Version, credentials.DefaultName())
+	require.NoError(err)
+	require.NotNil(cs)
+	checkResource("update", cred.Item, "", "newuser", 4)
+
+	cred, err = credClient.Update(tc.Context(), cred.Item.Id, cred.Item.Version,
+		credentials.WithName("newuser"), credentials.WithUsernamePasswordCredentialUsername("neweruser"))
+	require.NoError(err)
+	require.NotNil(cs)
+	checkResource("update", cred.Item, "newuser", "neweruser", 5)
+
+	_, err = credClient.Delete(tc.Context(), cred.Item.Id)
+	assert.NoError(err)
+
+	_, err = credClient.Delete(tc.Context(), cred.Item.Id)
+	require.Error(err)
+	apiErr := api.AsServerError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusNotFound, apiErr.Response().StatusCode())
+}
+
+func TestErrors(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	_, proj := iam.TestScopes(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+	cs, err := credentialstores.NewClient(client).Create(tc.Context(), "static", proj.GetPublicId())
+	require.NoError(err)
+	require.NotNil(cs)
+
+	c := credentials.NewClient(client)
+
+	cred, err := c.Create(tc.Context(), static.UsernamePasswordSubtype.String(), cs.Item.Id, credentials.WithName("foo"),
+		credentials.WithUsernamePasswordCredentialUsername("user"), credentials.WithUsernamePasswordCredentialPassword("pass"))
+	require.NoError(err)
+	require.NotNil(cred)
+
+	// A malformed id is processed as the id and not a different path to the api.
+	_, err = c.Read(tc.Context(), fmt.Sprintf("%s/../", cred.Item.Id))
+	require.Error(err)
+	apiErr := api.AsServerError(err)
+	require.NotNil(apiErr)
+	assert.EqualValues(http.StatusBadRequest, apiErr.Response().StatusCode())
+	require.Len(apiErr.Details.RequestFields, 1)
+	assert.Equal(apiErr.Details.RequestFields[0].Name, "id")
+
+	// Updating the wrong version should fail.
+	_, err = c.Update(tc.Context(), cred.Item.Id, 73, credentials.WithName("anything"))
+	require.Error(err)
+	apiErr = api.AsServerError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusNotFound, apiErr.Response().StatusCode())
+
+	// Same name
+	_, err = c.Create(tc.Context(), static.UsernamePasswordSubtype.String(), proj.GetPublicId(), credentials.WithName("foo"))
+	require.Error(err)
+	apiErr = api.AsServerError(err)
+	assert.NotNil(apiErr)
+
+	_, err = c.Read(tc.Context(), static.CredentialPrefix+"_doesntexis")
+	require.Error(err)
+	apiErr = api.AsServerError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusNotFound, apiErr.Response().StatusCode())
+
+	_, err = c.Read(tc.Context(), "invalid id")
+	require.Error(err)
+	apiErr = api.AsServerError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusBadRequest, apiErr.Response().StatusCode())
+}

internal/tests/api/credentialstores/credentialstore_test.go

@@ -49,12 +49,17 @@ func TestList(t *testing.T) {
 	require.NoError(err)
 	assert.ElementsMatch(comparableCatalogSlice(expected[:1]), comparableCatalogSlice(ul.Items))
 
-	for i := 1; i < 10; i++ {
+	for i := 1; i < 5; i++ {
 		cr, err = storeClient.Create(tc.Context(), "vault", proj.GetPublicId(), credentialstores.WithName(expected[i].Name),
 			credentialstores.WithVaultCredentialStoreAddress(vaultServ.Addr), credentialstores.WithVaultCredentialStoreToken(expected[i].Attributes["token"].(string)))
 		require.NoError(err)
 		expected[i] = cr.Item
 	}
+	for i := 5; i < 10; i++ {
+		cr, err = storeClient.Create(tc.Context(), "static", proj.GetPublicId(), credentialstores.WithName(expected[i].Name))
+		require.NoError(err)
+		expected[i] = cr.Item
+	}
 	ul, err = storeClient.List(tc.Context(), proj.GetPublicId())
 	require.NoError(err)
 	assert.ElementsMatch(comparableCatalogSlice(expected), comparableCatalogSlice(ul.Items))

internal/tests/api/targets/classification_test.go

@@ -71,19 +71,9 @@ func TestTargets(t *testing.T) {
 							HostCatalogId: "host-catalog-id",
 						},
 					},
-					SessionMaxSeconds:               &wrapperspb.UInt32Value{Value: 0},
-					SessionConnectionLimit:          &wrapperspb.Int32Value{Value: 0},
-					WorkerFilter:                    &wrapperspb.StringValue{Value: "worker-filter"},
-					ApplicationCredentialLibraryIds: []string{"application-credential-library-id"},
-					ApplicationCredentialLibraries: []*pb.CredentialLibrary{
-						{
-							Id:                "id",
-							Name:              "name",
-							Description:       "description",
-							CredentialStoreId: "credential-store-id",
-							Type:              "type",
-						},
-					},
+					SessionMaxSeconds:              &wrapperspb.UInt32Value{Value: 0},
+					SessionConnectionLimit:         &wrapperspb.Int32Value{Value: 0},
+					WorkerFilter:                   &wrapperspb.StringValue{Value: "worker-filter"},
 					ApplicationCredentialSourceIds: []string{"application-credential-source-id"},
 					ApplicationCredentialSources: []*pb.CredentialSource{
 						{
@@ -151,19 +141,9 @@ func TestTargets(t *testing.T) {
 							HostCatalogId: "host-catalog-id",
 						},
 					},
-					SessionMaxSeconds:               &wrapperspb.UInt32Value{Value: 0},
-					SessionConnectionLimit:          &wrapperspb.Int32Value{Value: 0},
-					WorkerFilter:                    &wrapperspb.StringValue{Value: "worker-filter"},
-					ApplicationCredentialLibraryIds: []string{"application-credential-library-id"},
-					ApplicationCredentialLibraries: []*pb.CredentialLibrary{
-						{
-							Id:                "id",
-							Name:              "name",
-							Description:       "description",
-							CredentialStoreId: "credential-store-id",
-							Type:              "type",
-						},
-					},
+					SessionMaxSeconds:              &wrapperspb.UInt32Value{Value: 0},
+					SessionConnectionLimit:         &wrapperspb.Int32Value{Value: 0},
+					WorkerFilter:                   &wrapperspb.StringValue{Value: "worker-filter"},
 					ApplicationCredentialSourceIds: []string{"application-credential-source-id"},
 					ApplicationCredentialSources: []*pb.CredentialSource{
 						{
@@ -253,13 +233,6 @@ func TestTargets(t *testing.T) {
 									Type:              "type",
 									CredentialType:    "credential-type",
 								},
-								CredentialLibrary: &pb.CredentialLibrary{
-									Id:                "id",
-									Name:              "name",
-									Description:       "description",
-									CredentialStoreId: "credential-store-id",
-									Type:              "type",
-								},
 								Secret: &pb.SessionSecret{
 									Raw: "raw-secrets",
 									Decoded: &structpb.Struct{
@@ -309,13 +282,6 @@ func TestTargets(t *testing.T) {
 									Type:              "type",
 									CredentialType:    "credential-type",
 								},
-								CredentialLibrary: &pb.CredentialLibrary{
-									Id:                "id",
-									Name:              "name",
-									Description:       "description",
-									CredentialStoreId: "credential-store-id",
-									Type:              "type",
-								},
 								Secret: &pb.SessionSecret{
 									Raw: encrypt.RedactedData,
 									Decoded: &structpb.Struct{

internal/tests/api/targets/target_test.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/credentiallibraries"
+	"github.com/hashicorp/boundary/api/credentials"
 	"github.com/hashicorp/boundary/api/credentialstores"
 	"github.com/hashicorp/boundary/api/hostcatalogs"
 	"github.com/hashicorp/boundary/api/hostsets"
@@ -45,7 +46,7 @@ func TestHostSetASD(t *testing.T) {
 	require.NotNil(hSet2)
 
 	tarClient := targets.NewClient(client)
-	tar, err := tarClient.Create(tc.Context(), "tcp", proj.GetPublicId(), targets.WithName("foo"))
+	tar, err := tarClient.Create(tc.Context(), "tcp", proj.GetPublicId(), targets.WithName("foo"), targets.WithTcpTargetDefaultPort(2))
 	require.NoError(err)
 	require.NotNil(tar)
 	assert.Empty(tar.Item.HostSetIds)
@@ -66,11 +67,7 @@ func TestHostSetASD(t *testing.T) {
 	assert.Empty(tar.Item.HostSetIds)
 }
 
-func defaultCredLibrary(r *credentiallibraries.CredentialLibrary) *targets.CredentialLibrary {
-	return &targets.CredentialLibrary{Id: r.Id, CredentialStoreId: r.CredentialStoreId}
-}
-
-func TestCredentialLibraryASD(t *testing.T) {
+func TestCredentialSourcesASD(t *testing.T) {
 	assert, require := assert.New(t), require.New(t)
 	tc := controller.NewTestController(t, nil)
 	defer tc.Shutdown()
@@ -82,44 +79,85 @@ func TestCredentialLibraryASD(t *testing.T) {
 	client := tc.Client().Clone()
 	client.SetToken(token.Token)
 
-	cs, err := credentialstores.NewClient(client).Create(tc.Context(), "vault", proj.GetPublicId(),
+	csVault, err := credentialstores.NewClient(client).Create(tc.Context(), "vault", proj.GetPublicId(),
 		credentialstores.WithVaultCredentialStoreAddress(vaultServ.Addr), credentialstores.WithVaultCredentialStoreToken(vaultTok))
 	require.NoError(err)
-	require.NotNil(cs)
+	require.NotNil(csVault)
 
 	lClient := credentiallibraries.NewClient(client)
-	r1, err := lClient.Create(tc.Context(), cs.Item.Id, credentiallibraries.WithVaultCredentialLibraryPath("something1"))
+	lib1, err := lClient.Create(tc.Context(), csVault.Item.Id, credentiallibraries.WithVaultCredentialLibraryPath("something1"))
 	require.NoError(err)
-	require.NotNil(r1)
+	require.NotNil(lib1)
 
-	r2, err := lClient.Create(tc.Context(), cs.Item.Id, credentiallibraries.WithVaultCredentialLibraryPath("something2"))
+	lib2, err := lClient.Create(tc.Context(), csVault.Item.Id, credentiallibraries.WithVaultCredentialLibraryPath("something2"))
 	require.NoError(err)
-	require.NotNil(r1)
+	require.NotNil(lib2)
+
+	csStatic, err := credentialstores.NewClient(client).Create(tc.Context(), "static", proj.GetPublicId())
+	require.NoError(err)
+	require.NotNil(csStatic)
+
+	cClient := credentials.NewClient(client)
+	cOpts := []credentials.Option{credentials.WithUsernamePasswordCredentialUsername("user"), credentials.WithUsernamePasswordCredentialPassword("pass")}
+	cred, err := cClient.Create(tc.Context(), "username_password", csStatic.Item.Id, cOpts...)
+	require.NoError(err)
+	require.NotNil(cred)
 
 	tarClient := targets.NewClient(client)
-	tar, err := tarClient.Create(tc.Context(), "tcp", proj.GetPublicId(), targets.WithName("foo"))
+	tar, err := tarClient.Create(tc.Context(), "tcp", proj.GetPublicId(), targets.WithName("foo"), targets.WithTcpTargetDefaultPort(2))
 	require.NoError(err)
 	require.NotNil(tar)
-	assert.Empty(tar.Item.ApplicationCredentialLibraryIds)
+	assert.Empty(tar.Item.ApplicationCredentialSourceIds)
 
-	tar, err = tarClient.AddCredentialLibraries(tc.Context(), tar.Item.Id, tar.Item.Version, targets.WithApplicationCredentialLibraryIds([]string{r1.Item.Id}))
+	// Add first Vault library
+	tar, err = tarClient.AddCredentialSources(tc.Context(), tar.Item.Id, tar.Item.Version,
+		targets.WithApplicationCredentialSourceIds([]string{lib1.Item.Id}))
 	require.NoError(err)
 	require.NotNil(tar)
-	assert.ElementsMatch(tar.Item.ApplicationCredentialLibraryIds, []string{r1.Item.Id})
-	assert.ElementsMatch(tar.Item.ApplicationCredentialLibraries, []*targets.CredentialLibrary{defaultCredLibrary(r1.Item)})
+	assert.ElementsMatch(tar.Item.ApplicationCredentialSourceIds, []string{lib1.Item.Id})
+	assert.ElementsMatch(tar.Item.ApplicationCredentialSources, []*targets.CredentialSource{
+		{
+			Id:                lib1.Item.Id,
+			CredentialStoreId: csVault.Item.Id,
+		},
+	})
 
-	tar, err = tarClient.SetCredentialLibraries(tc.Context(), tar.Item.Id, tar.Item.Version,
-		targets.WithApplicationCredentialLibraryIds([]string{r2.Item.Id}))
+	// Set second Vault library and a static credential
+	tar, err = tarClient.SetCredentialSources(tc.Context(), tar.Item.Id, tar.Item.Version,
+		targets.WithApplicationCredentialSourceIds([]string{lib2.Item.Id, cred.Item.Id}))
 	require.NoError(err)
 	require.NotNil(tar)
-	assert.ElementsMatch(tar.Item.ApplicationCredentialLibraryIds, []string{r2.Item.Id})
-	assert.ElementsMatch(tar.Item.ApplicationCredentialLibraries, []*targets.CredentialLibrary{defaultCredLibrary(r2.Item)})
+	assert.ElementsMatch(tar.Item.ApplicationCredentialSourceIds, []string{lib2.Item.Id, cred.Item.Id})
+	assert.ElementsMatch(tar.Item.ApplicationCredentialSources, []*targets.CredentialSource{
+		{
+			Id:                lib2.Item.Id,
+			CredentialStoreId: csVault.Item.Id,
+		},
+		{
+			Id:                cred.Item.Id,
+			CredentialStoreId: csStatic.Item.Id,
+		},
+	})
 
-	tar, err = tarClient.RemoveCredentialLibraries(tc.Context(), tar.Item.Id, tar.Item.Version,
-		targets.WithApplicationCredentialLibraryIds([]string{r2.Item.Id}))
+	// Remove second Vault library
+	tar, err = tarClient.RemoveCredentialSources(tc.Context(), tar.Item.Id, tar.Item.Version,
+		targets.WithApplicationCredentialSourceIds([]string{lib2.Item.Id}))
 	require.NoError(err)
 	require.NotNil(tar)
-	assert.Empty(tar.Item.ApplicationCredentialLibraryIds)
+	assert.ElementsMatch(tar.Item.ApplicationCredentialSourceIds, []string{cred.Item.Id})
+	assert.ElementsMatch(tar.Item.ApplicationCredentialSources, []*targets.CredentialSource{
+		{
+			Id:                cred.Item.Id,
+			CredentialStoreId: csStatic.Item.Id,
+		},
+	})
+
+	// Set empty credential sources
+	tar, err = tarClient.SetCredentialSources(tc.Context(), tar.Item.Id, tar.Item.Version,
+		targets.WithApplicationCredentialSourceIds([]string{}))
+	require.NoError(err)
+	require.NotNil(tar)
+	assert.Empty(tar.Item.ApplicationCredentialSourceIds)
 }
 
 func TestList(t *testing.T) {
@@ -160,7 +198,7 @@ func TestList(t *testing.T) {
 		expected = append(expected, &targets.Target{Name: fmt.Sprint(i)})
 	}
 
-	tcr, err := tarClient.Create(tc.Context(), "tcp", proj.GetPublicId(), targets.WithName(expected[0].Name))
+	tcr, err := tarClient.Create(tc.Context(), "tcp", proj.GetPublicId(), targets.WithName(expected[0].Name), targets.WithTcpTargetDefaultPort(2))
 	require.NoError(err)
 	expected[0] = tcr.Item
 
@@ -237,7 +275,7 @@ func TestCrud(t *testing.T) {
 
 	tarClient := targets.NewClient(client)
 
-	tar, err := tarClient.Create(tc.Context(), "tcp", proj.GetPublicId(), targets.WithName("foo"))
+	tar, err := tarClient.Create(tc.Context(), "tcp", proj.GetPublicId(), targets.WithName("foo"), targets.WithTcpTargetDefaultPort(2))
 	checkResource(t, "create", tar.Item, err, "foo", 1)
 
 	tar, err = tarClient.Read(tc.Context(), tar.Item.Id)
@@ -268,7 +306,7 @@ func TestSet_Errors(t *testing.T) {
 
 	tarClient := targets.NewClient(client)
 
-	tar, err := tarClient.Create(tc.Context(), "tcp", proj.GetPublicId(), targets.WithName("foo"))
+	tar, err := tarClient.Create(tc.Context(), "tcp", proj.GetPublicId(), targets.WithName("foo"), targets.WithTcpTargetDefaultPort(2))
 	require.NoError(err)
 	assert.NotNil(tar)