From bd30ff414087d9c0173d2f29d862289d54b5f27f Mon Sep 17 00:00:00 2001 From: Justen Walker Date: Thu, 10 Feb 2022 15:59:57 -0500 Subject: [PATCH] fix(controller/targets): authorize-session should allow h_ ids (#1853) * fix(controller/targets): authorize-session should allow h_ ids The targets controller previously only allowed hosts from a static catalog since it checked for the ID subtype from the static package. This change validates host ids with the plugin.Subtype as well Fixes: #1850 * test: cover authorize-session with host id Add a regression test to cover the case where an explicit host ID was given when calling AuthorizeSession --- .../servers/controller/handlers/targets/target_service.go | 2 +- .../controller/handlers/targets/tcp/target_service_test.go | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/internal/servers/controller/handlers/targets/target_service.go b/internal/servers/controller/handlers/targets/target_service.go index d49d7a20b..2b1278d03 100644 --- a/internal/servers/controller/handlers/targets/target_service.go +++ b/internal/servers/controller/handlers/targets/target_service.go @@ -2102,7 +2102,7 @@ func validateAuthorizeSessionRequest(req *pbs.AuthorizeSessionRequest) error { } if req.GetHostId() != "" { switch host.SubtypeFromId(req.GetHostId()) { - case static.Subtype: + case static.Subtype, plugin.Subtype: default: badFields[globals.HostIdField] = "Incorrectly formatted identifier." } diff --git a/internal/servers/controller/handlers/targets/tcp/target_service_test.go b/internal/servers/controller/handlers/targets/tcp/target_service_test.go index 6424d9b8d..0d90f182d 100644 --- a/internal/servers/controller/handlers/targets/tcp/target_service_test.go +++ b/internal/servers/controller/handlers/targets/tcp/target_service_test.go @@ -2776,6 +2776,12 @@ func TestAuthorizeSession(t *testing.T) { assert.NotEmpty(t, cmp.Diff(asRes1.GetItem().GetCredentials(), asRes2.GetItem().GetCredentials(), protocmp.Transform()), "the credentials aren't unique per request authorized session") + _, err = s.AuthorizeSession(ctx, &pbs.AuthorizeSessionRequest{ + Id: tar.GetPublicId(), + HostId: asRes2.GetItem().GetHostId(), + }) + require.NoError(t, err, "session must authorize with explicit host ID") + wantedHostId := tc.wantedHostId if tc.wantedHostId == "?" { wantedHostId = asRes2.GetItem().GetHostId()