CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use the intercepted token always. If the keyring matches, use it from there (#4355)

Browse Source 
* Use the intercepted token if present, use it through the keyring if keyring contains it

* fixup! Use the intercepted token if present, use it through the keyring if keyring contains it

* Apply suggestions from code review

Co-authored-by: Jim <jlambert@hashicorp.com>

---------

Co-authored-by: Jim <jlambert@hashicorp.com>
This commit is contained in:
ToddandJim committed 2024-02-06 11:46:28 -08:00
1 parent 66c7f274bb
commit eb6d0dbd6a
4 files changed
+79 -50
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/cmd/base/keyring.go
+16 -11
View File
@@ -14,6 +14,7 @@ import (
"github.com/hashicorp/boundary/api/authtokens"
nkeyring "github.com/jefferai/keyring"
"github.com/mitchellh/cli"
zkeyring "github.com/zalando/go-keyring"
)
@@ -108,7 +109,7 @@ func (c *Command) DiscoverKeyringTokenInfo() (string, string, error) {
return keyringType, tokenName, nil
}
func (c *Command) ReadTokenFromKeyring(keyringType, tokenName string) *authtokens.AuthToken {
func ReadTokenFromKeyring(ui cli.Ui, keyringType, tokenName string) *authtokens.AuthToken {
var token string
var err error
@@ -120,10 +121,10 @@ func (c *Command) ReadTokenFromKeyring(keyringType, tokenName string) *authtoken
token, err = zkeyring.Get(StoredTokenName, tokenName)
if err != nil {
if err == zkeyring.ErrNotFound {
c.UI.Error("No saved credential found, continuing without")
ui.Error("No saved credential found, continuing without")
} else {
c.UI.Error(fmt.Sprintf("Error reading auth token from keyring: %s", err))
c.UI.Warn("Token must be provided via BOUNDARY_TOKEN env var or -token flag. Reading the token can also be disabled via -keyring-type=none.")
ui.Error(fmt.Sprintf("Error reading auth token from keyring: %s", err))
ui.Warn("Token must be provided via BOUNDARY_TOKEN env var or -token flag. Reading the token can also be disabled via -keyring-type=none.")
}
token = ""
}
@@ -137,15 +138,15 @@ func (c *Command) ReadTokenFromKeyring(keyringType, tokenName string) *authtoken
kr, err := nkeyring.Open(krConfig)
if err != nil {
c.UI.Error(fmt.Sprintf("Error opening keyring: %s", err))
c.UI.Warn("Token must be provided via BOUNDARY_TOKEN env var or -token flag. Reading the token can also be disabled via -keyring-type=none.")
ui.Error(fmt.Sprintf("Error opening keyring: %s", err))
ui.Warn("Token must be provided via BOUNDARY_TOKEN env var or -token flag. Reading the token can also be disabled via -keyring-type=none.")
break
}
item, err := kr.Get(tokenName)
if err != nil {
c.UI.Error(fmt.Sprintf("Error fetching token from keyring: %s", err))
c.UI.Warn("Token must be provided via BOUNDARY_TOKEN env var or -token flag. Reading the token can also be disabled via -keyring-type=none.")
ui.Error(fmt.Sprintf("Error fetching token from keyring: %s", err))
ui.Warn("Token must be provided via BOUNDARY_TOKEN env var or -token flag. Reading the token can also be disabled via -keyring-type=none.")
break
}
@@ -156,13 +157,13 @@ func (c *Command) ReadTokenFromKeyring(keyringType, tokenName string) *authtoken
tokenBytes, err := base64.RawStdEncoding.DecodeString(token)
switch {
case err != nil:
c.UI.Error(fmt.Errorf("Error base64-unmarshaling stored token from system credential store: %w", err).Error())
ui.Error(fmt.Errorf("Error base64-unmarshaling stored token from system credential store: %w", err).Error())
case len(tokenBytes) == 0:
c.UI.Error("Zero length token after decoding stored token from system credential store")
ui.Error("Zero length token after decoding stored token from system credential store")
default:
var authToken authtokens.AuthToken
if err := json.Unmarshal(tokenBytes, &authToken); err != nil {
c.UI.Error(fmt.Sprintf("Error unmarshaling stored token information after reading from system credential store: %s", err))
ui.Error(fmt.Sprintf("Error unmarshaling stored token information after reading from system credential store: %s", err))
} else {
return &authToken
}
@@ -171,6 +172,10 @@ func (c *Command) ReadTokenFromKeyring(keyringType, tokenName string) *authtoken
return nil
}
func (c *Command) ReadTokenFromKeyring(keyringType, tokenName string) *authtokens.AuthToken {
return ReadTokenFromKeyring(c.UI, keyringType, tokenName)
}
func TokenIdFromToken(token string) (string, error) {
split := strings.Split(token, "_")
if len(split) < 3 {
internal/cmd/commands/authenticate/funcs.go
+3 -8
View File
@@ -25,6 +25,9 @@ func saveAndOrPrintToken(c *base.Command, result *authmethods.AuthenticateResult
return base.CommandCliError
}
opts := base.GetOpts(opt...)
if opts.WithInterceptedToken != nil {
*opts.WithInterceptedToken = token.Token
}
switch base.Format(c.UI) {
case "table":
@@ -98,18 +101,10 @@ func saveAndOrPrintToken(c *base.Command, result *authmethods.AuthenticateResult
switch {
case gotErr:
c.UI.Warn(fmt.Sprintf("The token was not successfully saved to a system keyring. The token is:\n\n%s\n\nIt must be manually passed in via the BOUNDARY_TOKEN env var or -token flag. Storing the token can also be disabled via -keyring-type=none.", token.Token))
if opts.WithInterceptedToken != nil {
*opts.WithInterceptedToken = token.Token
}
case c.FlagKeyringType == "none":
c.UI.Warn("\nStoring the token in a keyring was disabled. The token is:")
c.UI.Output(token.Token)
c.UI.Warn("Please be sure to store it safely!")
if opts.WithInterceptedToken != nil {
*opts.WithInterceptedToken = token.Token
}
}
return base.CommandSuccess