CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(credentials): Refactor credential purposes (#2260)

Browse Source 
* feat(credentials): Refactor credential purposes

 * Application credentials have been refactored to Brokered credentials
 * Egress credentials have been refactored to Injected Application
credentials

Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
This commit is contained in:
Louis RuchandJeff Mitchell authored and GitHub committed 2022-07-19 15:16:24 -07:00
1 parent 271cc8f781
commit a17e973712
49 files changed
+1516 -1051
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/tests/api/targets/classification_test.go
+14 -14
View File
@@ -71,11 +71,11 @@ func TestTargets(t *testing.T) {
HostCatalogId: "host-catalog-id",
},
},
SessionMaxSeconds: &wrapperspb.UInt32Value{Value: 0},
SessionConnectionLimit: &wrapperspb.Int32Value{Value: 0},
WorkerFilter: &wrapperspb.StringValue{Value: "worker-filter"},
ApplicationCredentialSourceIds: []string{"application-credential-source-id"},
ApplicationCredentialSources: []*pb.CredentialSource{
SessionMaxSeconds: &wrapperspb.UInt32Value{Value: 0},
SessionConnectionLimit: &wrapperspb.Int32Value{Value: 0},
WorkerFilter: &wrapperspb.StringValue{Value: "worker-filter"},
BrokeredCredentialSourceIds: []string{"brokered-credential-source-id"},
BrokeredCredentialSources: []*pb.CredentialSource{
{
Id: "id",
Name: "name",
@@ -85,8 +85,8 @@ func TestTargets(t *testing.T) {
CredentialType: "credential-type",
},
},
EgressCredentialSourceIds: []string{"egress-credential-source-id"},
EgressCredentialSources: []*pb.CredentialSource{
InjectedApplicationCredentialSourceIds: []string{"injected-app-credential-source-id"},
InjectedApplicationCredentialSources: []*pb.CredentialSource{
{
Id: "id",
Name: "name",
@@ -141,11 +141,11 @@ func TestTargets(t *testing.T) {
HostCatalogId: "host-catalog-id",
},
},
SessionMaxSeconds: &wrapperspb.UInt32Value{Value: 0},
SessionConnectionLimit: &wrapperspb.Int32Value{Value: 0},
WorkerFilter: &wrapperspb.StringValue{Value: "worker-filter"},
ApplicationCredentialSourceIds: []string{"application-credential-source-id"},
ApplicationCredentialSources: []*pb.CredentialSource{
SessionMaxSeconds: &wrapperspb.UInt32Value{Value: 0},
SessionConnectionLimit: &wrapperspb.Int32Value{Value: 0},
WorkerFilter: &wrapperspb.StringValue{Value: "worker-filter"},
BrokeredCredentialSourceIds: []string{"brokered-credential-source-id"},
BrokeredCredentialSources: []*pb.CredentialSource{
{
Id: "id",
Name: "name",
@@ -155,8 +155,8 @@ func TestTargets(t *testing.T) {
CredentialType: "credential-type",
},
},
EgressCredentialSourceIds: []string{"egress-credential-source-id"},
EgressCredentialSources: []*pb.CredentialSource{
InjectedApplicationCredentialSourceIds: []string{"injected-app-credential-source-id"},
InjectedApplicationCredentialSources: []*pb.CredentialSource{
{
Id: "id",
Name: "name",
internal/tests/api/targets/target_test.go
+144 -1
View File
@@ -107,13 +107,138 @@ func TestCredentialSourcesASD(t *testing.T) {
tar, err := tarClient.Create(tc.Context(), "tcp", proj.GetPublicId(), targets.WithName("foo"), targets.WithTcpTargetDefaultPort(2))
require.NoError(err)
require.NotNil(tar)
assert.Empty(tar.Item.BrokeredCredentialSourceIds)
// Add first Vault library
tar, err = tarClient.AddCredentialSources(tc.Context(), tar.Item.Id, tar.Item.Version,
targets.WithBrokeredCredentialSourceIds([]string{lib1.Item.Id}))
require.NoError(err)
require.NotNil(tar)
assert.ElementsMatch(tar.Item.BrokeredCredentialSourceIds, []string{lib1.Item.Id})
assert.ElementsMatch(tar.Item.BrokeredCredentialSources, []*targets.CredentialSource{
{
Id: lib1.Item.Id,
CredentialStoreId: csVault.Item.Id,
},
})
assert.ElementsMatch(tar.Item.ApplicationCredentialSourceIds, []string{lib1.Item.Id})
assert.ElementsMatch(tar.Item.ApplicationCredentialSources, []*targets.CredentialSource{
{
Id: lib1.Item.Id,
CredentialStoreId: csVault.Item.Id,
},
})
// Set second Vault library and a static credential
tar, err = tarClient.SetCredentialSources(tc.Context(), tar.Item.Id, tar.Item.Version,
targets.WithBrokeredCredentialSourceIds([]string{lib2.Item.Id, cred.Item.Id}))
require.NoError(err)
require.NotNil(tar)
assert.ElementsMatch(tar.Item.BrokeredCredentialSourceIds, []string{lib2.Item.Id, cred.Item.Id})
assert.ElementsMatch(tar.Item.BrokeredCredentialSources, []*targets.CredentialSource{
{
Id: lib2.Item.Id,
CredentialStoreId: csVault.Item.Id,
},
{
Id: cred.Item.Id,
CredentialStoreId: csStatic.Item.Id,
},
})
assert.ElementsMatch(tar.Item.ApplicationCredentialSourceIds, []string{lib2.Item.Id, cred.Item.Id})
assert.ElementsMatch(tar.Item.ApplicationCredentialSources, []*targets.CredentialSource{
{
Id: lib2.Item.Id,
CredentialStoreId: csVault.Item.Id,
},
{
Id: cred.Item.Id,
CredentialStoreId: csStatic.Item.Id,
},
})
// Remove second Vault library
tar, err = tarClient.RemoveCredentialSources(tc.Context(), tar.Item.Id, tar.Item.Version,
targets.WithBrokeredCredentialSourceIds([]string{lib2.Item.Id}))
require.NoError(err)
require.NotNil(tar)
assert.ElementsMatch(tar.Item.BrokeredCredentialSourceIds, []string{cred.Item.Id})
assert.ElementsMatch(tar.Item.BrokeredCredentialSources, []*targets.CredentialSource{
{
Id: cred.Item.Id,
CredentialStoreId: csStatic.Item.Id,
},
})
assert.ElementsMatch(tar.Item.ApplicationCredentialSourceIds, []string{cred.Item.Id})
assert.ElementsMatch(tar.Item.ApplicationCredentialSources, []*targets.CredentialSource{
{
Id: cred.Item.Id,
CredentialStoreId: csStatic.Item.Id,
},
})
// Set empty credential sources
tar, err = tarClient.SetCredentialSources(tc.Context(), tar.Item.Id, tar.Item.Version,
targets.WithBrokeredCredentialSourceIds([]string{}))
require.NoError(err)
require.NotNil(tar)
assert.Empty(tar.Item.BrokeredCredentialSourceIds)
assert.Empty(tar.Item.ApplicationCredentialSourceIds)
}
func TestDeprecatedCredentialSourcesASD(t *testing.T) {
assert, require := assert.New(t), require.New(t)
tc := controller.NewTestController(t, nil)
defer tc.Shutdown()
vaultServ := vault.NewTestVaultServer(t, vault.WithTestVaultTLS(vault.TestNoTLS))
_, vaultTok := vaultServ.CreateToken(t)
token := tc.Token()
_, proj := iam.TestScopes(t, tc.IamRepo(), iam.WithUserId(token.UserId))
client := tc.Client().Clone()
client.SetToken(token.Token)
csVault, err := credentialstores.NewClient(client).Create(tc.Context(), "vault", proj.GetPublicId(),
credentialstores.WithVaultCredentialStoreAddress(vaultServ.Addr), credentialstores.WithVaultCredentialStoreToken(vaultTok))
require.NoError(err)
require.NotNil(csVault)
lClient := credentiallibraries.NewClient(client)
lib1, err := lClient.Create(tc.Context(), csVault.Item.Id, credentiallibraries.WithVaultCredentialLibraryPath("something1"))
require.NoError(err)
require.NotNil(lib1)
lib2, err := lClient.Create(tc.Context(), csVault.Item.Id, credentiallibraries.WithVaultCredentialLibraryPath("something2"))
require.NoError(err)
require.NotNil(lib2)
csStatic, err := credentialstores.NewClient(client).Create(tc.Context(), "static", proj.GetPublicId())
require.NoError(err)
require.NotNil(csStatic)
cClient := credentials.NewClient(client)
cOpts := []credentials.Option{credentials.WithUsernamePasswordCredentialUsername("user"), credentials.WithUsernamePasswordCredentialPassword("pass")}
cred, err := cClient.Create(tc.Context(), "username_password", csStatic.Item.Id, cOpts...)
require.NoError(err)
require.NotNil(cred)
tarClient := targets.NewClient(client)
tar, err := tarClient.Create(tc.Context(), "tcp", proj.GetPublicId(), targets.WithName("foo"), targets.WithTcpTargetDefaultPort(2))
require.NoError(err)
require.NotNil(tar)
assert.Empty(tar.Item.BrokeredCredentialSourceIds)
// Add first Vault library
tar, err = tarClient.AddCredentialSources(tc.Context(), tar.Item.Id, tar.Item.Version,
targets.WithApplicationCredentialSourceIds([]string{lib1.Item.Id}))
require.NoError(err)
require.NotNil(tar)
assert.ElementsMatch(tar.Item.BrokeredCredentialSourceIds, []string{lib1.Item.Id})
assert.ElementsMatch(tar.Item.BrokeredCredentialSources, []*targets.CredentialSource{
{
Id: lib1.Item.Id,
CredentialStoreId: csVault.Item.Id,
},
})
assert.ElementsMatch(tar.Item.ApplicationCredentialSourceIds, []string{lib1.Item.Id})
assert.ElementsMatch(tar.Item.ApplicationCredentialSources, []*targets.CredentialSource{
{
@@ -127,6 +252,17 @@ func TestCredentialSourcesASD(t *testing.T) {
targets.WithApplicationCredentialSourceIds([]string{lib2.Item.Id, cred.Item.Id}))
require.NoError(err)
require.NotNil(tar)
assert.ElementsMatch(tar.Item.BrokeredCredentialSourceIds, []string{lib2.Item.Id, cred.Item.Id})
assert.ElementsMatch(tar.Item.BrokeredCredentialSources, []*targets.CredentialSource{
{
Id: lib2.Item.Id,
CredentialStoreId: csVault.Item.Id,
},
{
Id: cred.Item.Id,
CredentialStoreId: csStatic.Item.Id,
},
})
assert.ElementsMatch(tar.Item.ApplicationCredentialSourceIds, []string{lib2.Item.Id, cred.Item.Id})
assert.ElementsMatch(tar.Item.ApplicationCredentialSources, []*targets.CredentialSource{
{
@@ -138,12 +274,18 @@ func TestCredentialSourcesASD(t *testing.T) {
CredentialStoreId: csStatic.Item.Id,
},
})
// Remove second Vault library
tar, err = tarClient.RemoveCredentialSources(tc.Context(), tar.Item.Id, tar.Item.Version,
targets.WithApplicationCredentialSourceIds([]string{lib2.Item.Id}))
require.NoError(err)
require.NotNil(tar)
assert.ElementsMatch(tar.Item.BrokeredCredentialSourceIds, []string{cred.Item.Id})
assert.ElementsMatch(tar.Item.BrokeredCredentialSources, []*targets.CredentialSource{
{
Id: cred.Item.Id,
CredentialStoreId: csStatic.Item.Id,
},
})
assert.ElementsMatch(tar.Item.ApplicationCredentialSourceIds, []string{cred.Item.Id})
assert.ElementsMatch(tar.Item.ApplicationCredentialSources, []*targets.CredentialSource{
{
@@ -157,6 +299,7 @@ func TestCredentialSourcesASD(t *testing.T) {
targets.WithApplicationCredentialSourceIds([]string{}))
require.NoError(err)
require.NotNil(tar)
assert.Empty(tar.Item.BrokeredCredentialSourceIds)
assert.Empty(tar.Item.ApplicationCredentialSourceIds)
}