From fbcc256742ceff066e8f8140d8704016db111508 Mon Sep 17 00:00:00 2001 From: Hugo <10965479+hugoghx@users.noreply.github.com> Date: Tue, 13 May 2025 13:39:02 +0100 Subject: [PATCH] feat(handlers): Allow UPD brokered creds to be associated w/ Targets + Session auth --- .../handlers/targets/credentials.go | 20 +- .../handlers/targets/target_service.go | 3 + .../targets/tcp/target_service_test.go | 154 ++++++++++++++- .../api/resources/targets/v1/target.proto | 12 ++ .../api/resources/targets/target.pb.go | 177 ++++++++++++------ 5 files changed, 308 insertions(+), 58 deletions(-) diff --git a/internal/daemon/controller/handlers/targets/credentials.go b/internal/daemon/controller/handlers/targets/credentials.go index a1a80fe14..83b329533 100644 --- a/internal/daemon/controller/handlers/targets/credentials.go +++ b/internal/daemon/controller/handlers/targets/credentials.go @@ -211,7 +211,25 @@ func staticToSessionCredential(ctx context.Context, cred credential.Static) (*pb if err != nil { return nil, errors.Wrap(ctx, err, op, errors.WithMsg("creating proto struct for username password credential")) } - + case *credstatic.UsernamePasswordDomainCredential: + var err error + credType = string(globals.UsernamePasswordDomainCredentialType) + credData, err = handlers.ProtoToStruct( + ctx, + &pb.UsernamePasswordDomainCredential{ + Username: c.GetUsername(), + Password: string(c.GetPassword()), + Domain: c.GetDomain(), + }, + ) + secret = map[string]any{ + "username": c.GetUsername(), + "password": string(c.GetPassword()), + "domain": c.GetDomain(), + } + if err != nil { + return nil, errors.Wrap(ctx, err, op, errors.WithMsg("creating proto struct for username password domain credential")) + } case *credstatic.SshPrivateKeyCredential: var err error credType = string(globals.SshPrivateKeyCredentialType) diff --git a/internal/daemon/controller/handlers/targets/target_service.go b/internal/daemon/controller/handlers/targets/target_service.go index 07cb83ac8..570d6b9a9 100644 --- a/internal/daemon/controller/handlers/targets/target_service.go +++ b/internal/daemon/controller/handlers/targets/target_service.go @@ -2048,6 +2048,7 @@ func validateAddCredentialSourcesRequest(req *pbs.AddTargetCredentialSourcesRequ globals.VaultCredentialLibraryPrefix, globals.UsernamePasswordCredentialPrefix, globals.UsernamePasswordCredentialPreviousPrefix, + globals.UsernamePasswordDomainCredentialPrefix, globals.SshPrivateKeyCredentialPrefix, globals.JsonCredentialPrefix) { badFields[globals.BrokeredCredentialSourceIdsField] = fmt.Sprintf("Incorrectly formatted credential source identifier %q.", cl) @@ -2084,6 +2085,7 @@ func validateSetCredentialSourcesRequest(req *pbs.SetTargetCredentialSourcesRequ globals.VaultCredentialLibraryPrefix, globals.UsernamePasswordCredentialPrefix, globals.UsernamePasswordCredentialPreviousPrefix, + globals.UsernamePasswordDomainCredentialPrefix, globals.SshPrivateKeyCredentialPrefix, globals.JsonCredentialPrefix) { badFields[globals.BrokeredCredentialSourceIdsField] = fmt.Sprintf("Incorrectly formatted credential source identifier %q.", cl) @@ -2124,6 +2126,7 @@ func validateRemoveCredentialSourcesRequest(req *pbs.RemoveTargetCredentialSourc globals.VaultCredentialLibraryPrefix, globals.UsernamePasswordCredentialPrefix, globals.UsernamePasswordCredentialPreviousPrefix, + globals.UsernamePasswordDomainCredentialPrefix, globals.SshPrivateKeyCredentialPrefix, globals.JsonCredentialPrefix) { badFields[globals.BrokeredCredentialSourceIdsField] = fmt.Sprintf("Incorrectly formatted credential source identifier %q.", cl) diff --git a/internal/daemon/controller/handlers/targets/tcp/target_service_test.go b/internal/daemon/controller/handlers/targets/tcp/target_service_test.go index c28bfa6d1..580f3b3c2 100644 --- a/internal/daemon/controller/handlers/targets/tcp/target_service_test.go +++ b/internal/daemon/controller/handlers/targets/tcp/target_service_test.go @@ -3084,6 +3084,7 @@ func TestAddTargetCredentialSources(t *testing.T) { storeStatic := credstatic.TestCredentialStore(t, conn, wrapper, proj.GetPublicId()) creds := credstatic.TestUsernamePasswordCredentials(t, conn, wrapper, "user", "pass", storeStatic.GetPublicId(), proj.GetPublicId(), 2) + updCreds := credstatic.TestUsernamePasswordDomainCredentials(t, conn, wrapper, "user", "pass", "domain", storeStatic.GetPublicId(), proj.GetPublicId(), 2) addCases := []struct { name string @@ -3103,6 +3104,12 @@ func TestAddTargetCredentialSources(t *testing.T) { addSources: []string{creds[1].GetPublicId()}, resultSourceIds: []string{creds[1].GetPublicId()}, }, + { + name: "Add static upd cred on empty target", + tar: tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "empty for static_upd sources"), + addSources: []string{updCreds[1].GetPublicId()}, + resultSourceIds: []string{updCreds[1].GetPublicId()}, + }, { name: "Add library on library populated target", tar: tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "populated for lib-lib sources", target.WithCredentialLibraries([]*target.CredentialLibrary{target.TestNewCredentialLibrary("", cls[0].GetPublicId(), credential.BrokeredPurpose)})), @@ -3115,18 +3122,36 @@ func TestAddTargetCredentialSources(t *testing.T) { addSources: []string{cls[1].GetPublicId()}, resultSourceIds: []string{creds[0].GetPublicId(), cls[1].GetPublicId()}, }, + { + name: "Add library on static upd cred populated target", + tar: tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "populated for lib-static_upd sources", target.WithStaticCredentials([]*target.StaticCredential{target.TestNewStaticCredential("", updCreds[0].GetPublicId(), credential.BrokeredPurpose)})), + addSources: []string{cls[1].GetPublicId()}, + resultSourceIds: []string{updCreds[0].GetPublicId(), cls[1].GetPublicId()}, + }, { name: "Add static cred on library populated target", tar: tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "populated for static-lib sources", target.WithCredentialLibraries([]*target.CredentialLibrary{target.TestNewCredentialLibrary("", cls[0].GetPublicId(), credential.BrokeredPurpose)})), addSources: []string{creds[1].GetPublicId()}, resultSourceIds: []string{cls[0].GetPublicId(), creds[1].GetPublicId()}, }, + { + name: "Add upd static cred on library populated target", + tar: tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "populated for static_upd-lib sources", target.WithCredentialLibraries([]*target.CredentialLibrary{target.TestNewCredentialLibrary("", cls[0].GetPublicId(), credential.BrokeredPurpose)})), + addSources: []string{updCreds[1].GetPublicId()}, + resultSourceIds: []string{cls[0].GetPublicId(), updCreds[1].GetPublicId()}, + }, { name: "Add static cred on static cred populated target", tar: tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "populated for static-static sources", target.WithStaticCredentials([]*target.StaticCredential{target.TestNewStaticCredential("", creds[0].GetPublicId(), credential.BrokeredPurpose)})), addSources: []string{creds[1].GetPublicId()}, resultSourceIds: []string{creds[0].GetPublicId(), creds[1].GetPublicId()}, }, + { + name: "Add static upd cred on static cred populated target", + tar: tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "populated for static_upd-static sources", target.WithStaticCredentials([]*target.StaticCredential{target.TestNewStaticCredential("", creds[0].GetPublicId(), credential.BrokeredPurpose)})), + addSources: []string{updCreds[1].GetPublicId()}, + resultSourceIds: []string{creds[0].GetPublicId(), updCreds[1].GetPublicId()}, + }, { name: "Add duplicated sources on library populated target", tar: tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "duplicated for lib sources", target.WithCredentialLibraries([]*target.CredentialLibrary{target.TestNewCredentialLibrary("", cls[0].GetPublicId(), credential.BrokeredPurpose)})), @@ -3139,6 +3164,12 @@ func TestAddTargetCredentialSources(t *testing.T) { addSources: []string{cls[1].GetPublicId(), cls[1].GetPublicId(), creds[1].GetPublicId(), creds[1].GetPublicId()}, resultSourceIds: []string{creds[0].GetPublicId(), cls[1].GetPublicId(), creds[1].GetPublicId()}, }, + { + name: "Add duplicated sources on static upd cred populated target", + tar: tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "duplicated for static upd sources", target.WithStaticCredentials([]*target.StaticCredential{target.TestNewStaticCredential("", updCreds[0].GetPublicId(), credential.BrokeredPurpose)})), + addSources: []string{cls[1].GetPublicId(), cls[1].GetPublicId(), updCreds[1].GetPublicId(), updCreds[1].GetPublicId()}, + resultSourceIds: []string{updCreds[0].GetPublicId(), cls[1].GetPublicId(), updCreds[1].GetPublicId()}, + }, } for _, tc := range addCases { @@ -3264,6 +3295,7 @@ func TestSetTargetCredentialSources(t *testing.T) { storeStatic := credstatic.TestCredentialStore(t, conn, wrapper, proj.GetPublicId()) creds := credstatic.TestUsernamePasswordCredentials(t, conn, wrapper, "user", "pass", storeStatic.GetPublicId(), proj.GetPublicId(), 2) + updCreds := credstatic.TestUsernamePasswordDomainCredentials(t, conn, wrapper, "user", "pass", "domain", storeStatic.GetPublicId(), proj.GetPublicId(), 2) setCases := []struct { name string @@ -3283,6 +3315,12 @@ func TestSetTargetCredentialSources(t *testing.T) { setCredentialSources: []string{creds[1].GetPublicId()}, resultCredentialSourceIds: []string{creds[1].GetPublicId()}, }, + { + name: "Set static_upd on empty target", + tar: tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "empty static_upd"), + setCredentialSources: []string{updCreds[1].GetPublicId()}, + resultCredentialSourceIds: []string{updCreds[1].GetPublicId()}, + }, { name: "Set library on library populated target", tar: tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "populated library-library", target.WithCredentialLibraries([]*target.CredentialLibrary{target.TestNewCredentialLibrary("", cls[0].GetPublicId(), credential.BrokeredPurpose)})), @@ -3295,18 +3333,42 @@ func TestSetTargetCredentialSources(t *testing.T) { setCredentialSources: []string{creds[1].GetPublicId()}, resultCredentialSourceIds: []string{creds[1].GetPublicId()}, }, + { + name: "Set static_upd on library populated target", + tar: tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "populated static_upd-library", target.WithCredentialLibraries([]*target.CredentialLibrary{target.TestNewCredentialLibrary("", cls[0].GetPublicId(), credential.BrokeredPurpose)})), + setCredentialSources: []string{updCreds[1].GetPublicId()}, + resultCredentialSourceIds: []string{updCreds[1].GetPublicId()}, + }, { name: "Set library on static populated target", tar: tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "populated library-static", target.WithStaticCredentials([]*target.StaticCredential{target.TestNewStaticCredential("", creds[0].GetPublicId(), credential.BrokeredPurpose)})), setCredentialSources: []string{cls[1].GetPublicId()}, resultCredentialSourceIds: []string{cls[1].GetPublicId()}, }, + { + name: "Set library on static_upd populated target", + tar: tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "populated library-static_upd", target.WithStaticCredentials([]*target.StaticCredential{target.TestNewStaticCredential("", updCreds[0].GetPublicId(), credential.BrokeredPurpose)})), + setCredentialSources: []string{cls[1].GetPublicId()}, + resultCredentialSourceIds: []string{cls[1].GetPublicId()}, + }, { name: "Set static on static populated target", tar: tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "populated static-static", target.WithStaticCredentials([]*target.StaticCredential{target.TestNewStaticCredential("", creds[0].GetPublicId(), credential.BrokeredPurpose)})), setCredentialSources: []string{creds[1].GetPublicId()}, resultCredentialSourceIds: []string{creds[1].GetPublicId()}, }, + { + name: "Set static_upd on static populated target", + tar: tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "populated static_upd-static", target.WithStaticCredentials([]*target.StaticCredential{target.TestNewStaticCredential("", creds[0].GetPublicId(), credential.BrokeredPurpose)})), + setCredentialSources: []string{updCreds[1].GetPublicId()}, + resultCredentialSourceIds: []string{updCreds[1].GetPublicId()}, + }, + { + name: "Set static on static_upd populated target", + tar: tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "populated static-static_upd", target.WithStaticCredentials([]*target.StaticCredential{target.TestNewStaticCredential("", updCreds[0].GetPublicId(), credential.BrokeredPurpose)})), + setCredentialSources: []string{creds[1].GetPublicId()}, + resultCredentialSourceIds: []string{creds[1].GetPublicId()}, + }, { name: "Set duplicate library on populated target", tar: tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "duplicate library", target.WithCredentialLibraries([]*target.CredentialLibrary{target.TestNewCredentialLibrary("", cls[0].GetPublicId(), credential.BrokeredPurpose)})), @@ -3319,11 +3381,19 @@ func TestSetTargetCredentialSources(t *testing.T) { setCredentialSources: []string{creds[1].GetPublicId(), creds[1].GetPublicId()}, resultCredentialSourceIds: []string{creds[1].GetPublicId()}, }, + { + name: "Set duplicate static_upd on populated target", + tar: tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "duplicate static_upd", target.WithStaticCredentials([]*target.StaticCredential{target.TestNewStaticCredential("", updCreds[0].GetPublicId(), credential.BrokeredPurpose)})), + setCredentialSources: []string{updCreds[1].GetPublicId(), updCreds[1].GetPublicId()}, + resultCredentialSourceIds: []string{updCreds[1].GetPublicId()}, + }, { name: "Set empty on populated target", tar: tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "another populated", target.WithCredentialLibraries([]*target.CredentialLibrary{target.TestNewCredentialLibrary("", cls[0].GetPublicId(), credential.BrokeredPurpose)}), - target.WithStaticCredentials([]*target.StaticCredential{target.TestNewStaticCredential("", creds[0].GetPublicId(), credential.BrokeredPurpose)})), + target.WithStaticCredentials([]*target.StaticCredential{target.TestNewStaticCredential("", creds[0].GetPublicId(), credential.BrokeredPurpose)}), + target.WithStaticCredentials([]*target.StaticCredential{target.TestNewStaticCredential("", updCreds[0].GetPublicId(), credential.BrokeredPurpose)}), + ), setCredentialSources: []string{}, resultCredentialSourceIds: nil, }, @@ -3438,6 +3508,7 @@ func TestRemoveTargetCredentialSources(t *testing.T) { csStatic := credstatic.TestCredentialStores(t, conn, wrapper, proj.GetPublicId(), 1)[0] creds := credstatic.TestUsernamePasswordCredentials(t, conn, wrapper, "u", "p", csStatic.GetPublicId(), proj.GetPublicId(), 2) + updCreds := credstatic.TestUsernamePasswordDomainCredentials(t, conn, wrapper, "user", "pass", "domain", csStatic.GetPublicId(), proj.GetPublicId(), 2) removeCases := []struct { name string @@ -3458,6 +3529,12 @@ func TestRemoveTargetCredentialSources(t *testing.T) { removeCredentialSources: []string{creds[1].GetPublicId()}, wantErr: true, }, + { + name: "Remove static_upd from empty", + tar: tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "empty static_upd"), + removeCredentialSources: []string{updCreds[1].GetPublicId()}, + wantErr: true, + }, { name: "Remove 1 of 2 libraries", tar: tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "remove partial lib", @@ -3478,6 +3555,16 @@ func TestRemoveTargetCredentialSources(t *testing.T) { removeCredentialSources: []string{creds[1].GetPublicId()}, resultCredentialSourceIds: []string{creds[0].GetPublicId()}, }, + { + name: "Remove 1 of 2 static_upd credentials", + tar: tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "remove partial static_upd", + target.WithStaticCredentials([]*target.StaticCredential{ + target.TestNewStaticCredential("", updCreds[0].GetPublicId(), credential.BrokeredPurpose), + target.TestNewStaticCredential("", updCreds[1].GetPublicId(), credential.BrokeredPurpose), + })), + removeCredentialSources: []string{updCreds[1].GetPublicId()}, + resultCredentialSourceIds: []string{updCreds[0].GetPublicId()}, + }, { name: "Remove 1 duplicate set of 2 libraries", tar: tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "remove duplicate lib", @@ -3502,6 +3589,18 @@ func TestRemoveTargetCredentialSources(t *testing.T) { }, resultCredentialSourceIds: []string{creds[0].GetPublicId()}, }, + { + name: "Remove 1 duplicate set of 2 static_upd credentials", + tar: tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "remove duplicate static_upd", + target.WithStaticCredentials([]*target.StaticCredential{ + target.TestNewStaticCredential("", updCreds[0].GetPublicId(), credential.BrokeredPurpose), + target.TestNewStaticCredential("", updCreds[1].GetPublicId(), credential.BrokeredPurpose), + })), + removeCredentialSources: []string{ + updCreds[1].GetPublicId(), updCreds[1].GetPublicId(), + }, + resultCredentialSourceIds: []string{updCreds[0].GetPublicId()}, + }, { name: "Remove mixed sources from target", tar: tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "remove mixed", @@ -3512,12 +3611,14 @@ func TestRemoveTargetCredentialSources(t *testing.T) { target.WithStaticCredentials([]*target.StaticCredential{ target.TestNewStaticCredential("", creds[0].GetPublicId(), credential.BrokeredPurpose), target.TestNewStaticCredential("", creds[1].GetPublicId(), credential.BrokeredPurpose), + target.TestNewStaticCredential("", updCreds[0].GetPublicId(), credential.BrokeredPurpose), + target.TestNewStaticCredential("", updCreds[1].GetPublicId(), credential.BrokeredPurpose), })), removeCredentialSources: []string{ - cls[1].GetPublicId(), creds[0].GetPublicId(), + cls[1].GetPublicId(), creds[0].GetPublicId(), updCreds[0].GetPublicId(), }, resultCredentialSourceIds: []string{ - cls[0].GetPublicId(), creds[1].GetPublicId(), + cls[0].GetPublicId(), creds[1].GetPublicId(), updCreds[1].GetPublicId(), }, }, { @@ -3530,10 +3631,13 @@ func TestRemoveTargetCredentialSources(t *testing.T) { target.WithStaticCredentials([]*target.StaticCredential{ target.TestNewStaticCredential("", creds[0].GetPublicId(), credential.BrokeredPurpose), target.TestNewStaticCredential("", creds[1].GetPublicId(), credential.BrokeredPurpose), + target.TestNewStaticCredential("", updCreds[0].GetPublicId(), credential.BrokeredPurpose), + target.TestNewStaticCredential("", updCreds[1].GetPublicId(), credential.BrokeredPurpose), })), removeCredentialSources: []string{ cls[0].GetPublicId(), cls[1].GetPublicId(), creds[0].GetPublicId(), creds[1].GetPublicId(), + updCreds[0].GetPublicId(), updCreds[1].GetPublicId(), }, resultCredentialSourceIds: []string{}, }, @@ -4125,6 +4229,22 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) { require.NoError(t, err) require.NotNil(t, upCredResp) + updCredResp, err := credService.CreateCredential(ctx, &pbs.CreateCredentialRequest{Item: &credpb.Credential{ + CredentialStoreId: staticStore.GetPublicId(), + Type: credential.UsernamePasswordDomainSubtype.String(), + Name: wrapperspb.String("UPD Cred Name"), + Description: wrapperspb.String("UPD Cred Description"), + Attrs: &credpb.Credential_UsernamePasswordDomainAttributes{ + UsernamePasswordDomainAttributes: &credpb.UsernamePasswordDomainAttributes{ + Username: wrapperspb.String("static-username"), + Password: wrapperspb.String("static-password"), + Domain: wrapperspb.String("static-domain"), + }, + }, + }}) + require.NoError(t, err) + require.NotNil(t, updCredResp) + sshPkCredResp, err := credService.CreateCredential(ctx, &pbs.CreateCredentialRequest{Item: &credpb.Credential{ CredentialStoreId: staticStore.GetPublicId(), Type: credential.SshPrivateKeySubtype.String(), @@ -4350,6 +4470,34 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) { }, wantedConnectionLimit: 1000, }, + { + name: "static-UsernamePasswordDomain", + hostSourceId: shs.GetPublicId(), + credSourceId: updCredResp.GetItem().GetId(), + wantedHostId: h.GetPublicId(), + wantedEndpoint: h.GetAddress(), + wantedCred: &pb.SessionCredential{ + CredentialSource: &pb.CredentialSource{ + Id: updCredResp.GetItem().GetId(), + Name: updCredResp.GetItem().GetName().GetValue(), + Description: updCredResp.GetItem().GetDescription().GetValue(), + CredentialStoreId: staticStore.GetPublicId(), + Type: credstatic.Subtype.String(), + CredentialType: string(globals.UsernamePasswordDomainCredentialType), + }, + Credential: func() *structpb.Struct { + data := map[string]any{ + "password": "static-password", + "username": "static-username", + "domain": "static-domain", + } + st, err := structpb.NewStruct(data) + require.NoError(t, err) + return st + }(), + }, + wantedConnectionLimit: 1000, + }, { name: "static-ssh-private-key", hostSourceId: shs.GetPublicId(), diff --git a/internal/proto/controller/api/resources/targets/v1/target.proto b/internal/proto/controller/api/resources/targets/v1/target.proto index bd75ccf35..2d7db8e9d 100644 --- a/internal/proto/controller/api/resources/targets/v1/target.proto +++ b/internal/proto/controller/api/resources/targets/v1/target.proto @@ -434,6 +434,18 @@ message UsernamePasswordCredential { string password = 2; // @gotags: `class:"secret"` } +// The layout of the struct for "credential" field in SessionCredential for a username_password_domain credential type. +message UsernamePasswordDomainCredential { + // Username of the credential + string username = 1; // @gotags: `class:"sensitive"` + + // Password of the credential + string password = 2; // @gotags: `class:"secret"` + + // Domain of the credential + string domain = 3; // @gotags: `class:"sensitive"` +} + // The layout of the struct for "credential" field in SessionCredential for a ssh_private_key credential type. message SshPrivateKeyCredential { // Username of the credential diff --git a/sdk/pbs/controller/api/resources/targets/target.pb.go b/sdk/pbs/controller/api/resources/targets/target.pb.go index c974fe319..423152778 100644 --- a/sdk/pbs/controller/api/resources/targets/target.pb.go +++ b/sdk/pbs/controller/api/resources/targets/target.pb.go @@ -1351,6 +1351,70 @@ func (x *UsernamePasswordCredential) GetPassword() string { return "" } +// The layout of the struct for "credential" field in SessionCredential for a username_password_domain credential type. +type UsernamePasswordDomainCredential struct { + state protoimpl.MessageState `protogen:"open.v1"` + // Username of the credential + Username string `protobuf:"bytes,1,opt,name=username,proto3" json:"username,omitempty" class:"sensitive"` // @gotags: `class:"sensitive"` + // Password of the credential + Password string `protobuf:"bytes,2,opt,name=password,proto3" json:"password,omitempty" class:"secret"` // @gotags: `class:"secret"` + // Domain of the credential + Domain string `protobuf:"bytes,3,opt,name=domain,proto3" json:"domain,omitempty" class:"sensitive"` // @gotags: `class:"sensitive"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *UsernamePasswordDomainCredential) Reset() { + *x = UsernamePasswordDomainCredential{} + mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[14] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *UsernamePasswordDomainCredential) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*UsernamePasswordDomainCredential) ProtoMessage() {} + +func (x *UsernamePasswordDomainCredential) ProtoReflect() protoreflect.Message { + mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[14] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use UsernamePasswordDomainCredential.ProtoReflect.Descriptor instead. +func (*UsernamePasswordDomainCredential) Descriptor() ([]byte, []int) { + return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{14} +} + +func (x *UsernamePasswordDomainCredential) GetUsername() string { + if x != nil { + return x.Username + } + return "" +} + +func (x *UsernamePasswordDomainCredential) GetPassword() string { + if x != nil { + return x.Password + } + return "" +} + +func (x *UsernamePasswordDomainCredential) GetDomain() string { + if x != nil { + return x.Domain + } + return "" +} + // The layout of the struct for "credential" field in SessionCredential for a ssh_private_key credential type. type SshPrivateKeyCredential struct { state protoimpl.MessageState `protogen:"open.v1"` @@ -1366,7 +1430,7 @@ type SshPrivateKeyCredential struct { func (x *SshPrivateKeyCredential) Reset() { *x = SshPrivateKeyCredential{} - mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[14] + mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[15] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1378,7 +1442,7 @@ func (x *SshPrivateKeyCredential) String() string { func (*SshPrivateKeyCredential) ProtoMessage() {} func (x *SshPrivateKeyCredential) ProtoReflect() protoreflect.Message { - mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[14] + mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[15] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1391,7 +1455,7 @@ func (x *SshPrivateKeyCredential) ProtoReflect() protoreflect.Message { // Deprecated: Use SshPrivateKeyCredential.ProtoReflect.Descriptor instead. func (*SshPrivateKeyCredential) Descriptor() ([]byte, []int) { - return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{14} + return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{15} } func (x *SshPrivateKeyCredential) GetUsername() string { @@ -1561,7 +1625,11 @@ const file_controller_api_resources_targets_v1_target_proto_rawDesc = "" + "\x14session_recording_id\x18s \x01(\tR\x14session_recording_id\"T\n" + "\x1aUsernamePasswordCredential\x12\x1a\n" + "\busername\x18\x01 \x01(\tR\busername\x12\x1a\n" + - "\bpassword\x18\x02 \x01(\tR\bpassword\"\x8c\x01\n" + + "\bpassword\x18\x02 \x01(\tR\bpassword\"r\n" + + " UsernamePasswordDomainCredential\x12\x1a\n" + + "\busername\x18\x01 \x01(\tR\busername\x12\x1a\n" + + "\bpassword\x18\x02 \x01(\tR\bpassword\x12\x16\n" + + "\x06domain\x18\x03 \x01(\tR\x06domain\"\x8c\x01\n" + "\x17SshPrivateKeyCredential\x12\x1a\n" + "\busername\x18\x01 \x01(\tR\busername\x12\x1f\n" + "\vprivate_key\x18\x02 \x01(\tR\n" + @@ -1580,70 +1648,71 @@ func file_controller_api_resources_targets_v1_target_proto_rawDescGZIP() []byte return file_controller_api_resources_targets_v1_target_proto_rawDescData } -var file_controller_api_resources_targets_v1_target_proto_msgTypes = make([]protoimpl.MessageInfo, 15) +var file_controller_api_resources_targets_v1_target_proto_msgTypes = make([]protoimpl.MessageInfo, 16) var file_controller_api_resources_targets_v1_target_proto_goTypes = []any{ - (*Alias)(nil), // 0: controller.api.resources.targets.v1.Alias - (*TargetAliasAttributes)(nil), // 1: controller.api.resources.targets.v1.TargetAliasAttributes - (*AuthorizeSessionArguments)(nil), // 2: controller.api.resources.targets.v1.AuthorizeSessionArguments - (*HostSource)(nil), // 3: controller.api.resources.targets.v1.HostSource - (*CredentialSource)(nil), // 4: controller.api.resources.targets.v1.CredentialSource - (*SessionSecret)(nil), // 5: controller.api.resources.targets.v1.SessionSecret - (*SessionCredential)(nil), // 6: controller.api.resources.targets.v1.SessionCredential - (*Target)(nil), // 7: controller.api.resources.targets.v1.Target - (*TcpTargetAttributes)(nil), // 8: controller.api.resources.targets.v1.TcpTargetAttributes - (*SshTargetAttributes)(nil), // 9: controller.api.resources.targets.v1.SshTargetAttributes - (*WorkerInfo)(nil), // 10: controller.api.resources.targets.v1.WorkerInfo - (*SessionAuthorizationData)(nil), // 11: controller.api.resources.targets.v1.SessionAuthorizationData - (*SessionAuthorization)(nil), // 12: controller.api.resources.targets.v1.SessionAuthorization - (*UsernamePasswordCredential)(nil), // 13: controller.api.resources.targets.v1.UsernamePasswordCredential - (*SshPrivateKeyCredential)(nil), // 14: controller.api.resources.targets.v1.SshPrivateKeyCredential - (*structpb.Struct)(nil), // 15: google.protobuf.Struct - (*scopes.ScopeInfo)(nil), // 16: controller.api.resources.scopes.v1.ScopeInfo - (*wrapperspb.StringValue)(nil), // 17: google.protobuf.StringValue - (*timestamppb.Timestamp)(nil), // 18: google.protobuf.Timestamp - (*wrapperspb.UInt32Value)(nil), // 19: google.protobuf.UInt32Value - (*wrapperspb.Int32Value)(nil), // 20: google.protobuf.Int32Value - (*wrapperspb.BoolValue)(nil), // 21: google.protobuf.BoolValue + (*Alias)(nil), // 0: controller.api.resources.targets.v1.Alias + (*TargetAliasAttributes)(nil), // 1: controller.api.resources.targets.v1.TargetAliasAttributes + (*AuthorizeSessionArguments)(nil), // 2: controller.api.resources.targets.v1.AuthorizeSessionArguments + (*HostSource)(nil), // 3: controller.api.resources.targets.v1.HostSource + (*CredentialSource)(nil), // 4: controller.api.resources.targets.v1.CredentialSource + (*SessionSecret)(nil), // 5: controller.api.resources.targets.v1.SessionSecret + (*SessionCredential)(nil), // 6: controller.api.resources.targets.v1.SessionCredential + (*Target)(nil), // 7: controller.api.resources.targets.v1.Target + (*TcpTargetAttributes)(nil), // 8: controller.api.resources.targets.v1.TcpTargetAttributes + (*SshTargetAttributes)(nil), // 9: controller.api.resources.targets.v1.SshTargetAttributes + (*WorkerInfo)(nil), // 10: controller.api.resources.targets.v1.WorkerInfo + (*SessionAuthorizationData)(nil), // 11: controller.api.resources.targets.v1.SessionAuthorizationData + (*SessionAuthorization)(nil), // 12: controller.api.resources.targets.v1.SessionAuthorization + (*UsernamePasswordCredential)(nil), // 13: controller.api.resources.targets.v1.UsernamePasswordCredential + (*UsernamePasswordDomainCredential)(nil), // 14: controller.api.resources.targets.v1.UsernamePasswordDomainCredential + (*SshPrivateKeyCredential)(nil), // 15: controller.api.resources.targets.v1.SshPrivateKeyCredential + (*structpb.Struct)(nil), // 16: google.protobuf.Struct + (*scopes.ScopeInfo)(nil), // 17: controller.api.resources.scopes.v1.ScopeInfo + (*wrapperspb.StringValue)(nil), // 18: google.protobuf.StringValue + (*timestamppb.Timestamp)(nil), // 19: google.protobuf.Timestamp + (*wrapperspb.UInt32Value)(nil), // 20: google.protobuf.UInt32Value + (*wrapperspb.Int32Value)(nil), // 21: google.protobuf.Int32Value + (*wrapperspb.BoolValue)(nil), // 22: google.protobuf.BoolValue } var file_controller_api_resources_targets_v1_target_proto_depIdxs = []int32{ 1, // 0: controller.api.resources.targets.v1.Alias.attributes:type_name -> controller.api.resources.targets.v1.TargetAliasAttributes 2, // 1: controller.api.resources.targets.v1.TargetAliasAttributes.authorize_session_arguments:type_name -> controller.api.resources.targets.v1.AuthorizeSessionArguments - 15, // 2: controller.api.resources.targets.v1.SessionSecret.decoded:type_name -> google.protobuf.Struct + 16, // 2: controller.api.resources.targets.v1.SessionSecret.decoded:type_name -> google.protobuf.Struct 4, // 3: controller.api.resources.targets.v1.SessionCredential.credential_source:type_name -> controller.api.resources.targets.v1.CredentialSource 5, // 4: controller.api.resources.targets.v1.SessionCredential.secret:type_name -> controller.api.resources.targets.v1.SessionSecret - 15, // 5: controller.api.resources.targets.v1.SessionCredential.credential:type_name -> google.protobuf.Struct - 16, // 6: controller.api.resources.targets.v1.Target.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo - 17, // 7: controller.api.resources.targets.v1.Target.name:type_name -> google.protobuf.StringValue - 17, // 8: controller.api.resources.targets.v1.Target.description:type_name -> google.protobuf.StringValue - 18, // 9: controller.api.resources.targets.v1.Target.created_time:type_name -> google.protobuf.Timestamp - 18, // 10: controller.api.resources.targets.v1.Target.updated_time:type_name -> google.protobuf.Timestamp + 16, // 5: controller.api.resources.targets.v1.SessionCredential.credential:type_name -> google.protobuf.Struct + 17, // 6: controller.api.resources.targets.v1.Target.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo + 18, // 7: controller.api.resources.targets.v1.Target.name:type_name -> google.protobuf.StringValue + 18, // 8: controller.api.resources.targets.v1.Target.description:type_name -> google.protobuf.StringValue + 19, // 9: controller.api.resources.targets.v1.Target.created_time:type_name -> google.protobuf.Timestamp + 19, // 10: controller.api.resources.targets.v1.Target.updated_time:type_name -> google.protobuf.Timestamp 3, // 11: controller.api.resources.targets.v1.Target.host_sources:type_name -> controller.api.resources.targets.v1.HostSource - 19, // 12: controller.api.resources.targets.v1.Target.session_max_seconds:type_name -> google.protobuf.UInt32Value - 20, // 13: controller.api.resources.targets.v1.Target.session_connection_limit:type_name -> google.protobuf.Int32Value - 17, // 14: controller.api.resources.targets.v1.Target.worker_filter:type_name -> google.protobuf.StringValue - 17, // 15: controller.api.resources.targets.v1.Target.egress_worker_filter:type_name -> google.protobuf.StringValue - 17, // 16: controller.api.resources.targets.v1.Target.ingress_worker_filter:type_name -> google.protobuf.StringValue + 20, // 12: controller.api.resources.targets.v1.Target.session_max_seconds:type_name -> google.protobuf.UInt32Value + 21, // 13: controller.api.resources.targets.v1.Target.session_connection_limit:type_name -> google.protobuf.Int32Value + 18, // 14: controller.api.resources.targets.v1.Target.worker_filter:type_name -> google.protobuf.StringValue + 18, // 15: controller.api.resources.targets.v1.Target.egress_worker_filter:type_name -> google.protobuf.StringValue + 18, // 16: controller.api.resources.targets.v1.Target.ingress_worker_filter:type_name -> google.protobuf.StringValue 4, // 17: controller.api.resources.targets.v1.Target.brokered_credential_sources:type_name -> controller.api.resources.targets.v1.CredentialSource 4, // 18: controller.api.resources.targets.v1.Target.injected_application_credential_sources:type_name -> controller.api.resources.targets.v1.CredentialSource - 15, // 19: controller.api.resources.targets.v1.Target.attributes:type_name -> google.protobuf.Struct + 16, // 19: controller.api.resources.targets.v1.Target.attributes:type_name -> google.protobuf.Struct 8, // 20: controller.api.resources.targets.v1.Target.tcp_target_attributes:type_name -> controller.api.resources.targets.v1.TcpTargetAttributes 9, // 21: controller.api.resources.targets.v1.Target.ssh_target_attributes:type_name -> controller.api.resources.targets.v1.SshTargetAttributes - 17, // 22: controller.api.resources.targets.v1.Target.address:type_name -> google.protobuf.StringValue + 18, // 22: controller.api.resources.targets.v1.Target.address:type_name -> google.protobuf.StringValue 0, // 23: controller.api.resources.targets.v1.Target.aliases:type_name -> controller.api.resources.targets.v1.Alias 0, // 24: controller.api.resources.targets.v1.Target.with_aliases:type_name -> controller.api.resources.targets.v1.Alias - 19, // 25: controller.api.resources.targets.v1.TcpTargetAttributes.default_port:type_name -> google.protobuf.UInt32Value - 19, // 26: controller.api.resources.targets.v1.TcpTargetAttributes.default_client_port:type_name -> google.protobuf.UInt32Value - 19, // 27: controller.api.resources.targets.v1.SshTargetAttributes.default_port:type_name -> google.protobuf.UInt32Value - 19, // 28: controller.api.resources.targets.v1.SshTargetAttributes.default_client_port:type_name -> google.protobuf.UInt32Value - 17, // 29: controller.api.resources.targets.v1.SshTargetAttributes.storage_bucket_id:type_name -> google.protobuf.StringValue - 21, // 30: controller.api.resources.targets.v1.SshTargetAttributes.enable_session_recording:type_name -> google.protobuf.BoolValue - 16, // 31: controller.api.resources.targets.v1.SessionAuthorizationData.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo - 18, // 32: controller.api.resources.targets.v1.SessionAuthorizationData.created_time:type_name -> google.protobuf.Timestamp - 18, // 33: controller.api.resources.targets.v1.SessionAuthorizationData.expiration:type_name -> google.protobuf.Timestamp + 20, // 25: controller.api.resources.targets.v1.TcpTargetAttributes.default_port:type_name -> google.protobuf.UInt32Value + 20, // 26: controller.api.resources.targets.v1.TcpTargetAttributes.default_client_port:type_name -> google.protobuf.UInt32Value + 20, // 27: controller.api.resources.targets.v1.SshTargetAttributes.default_port:type_name -> google.protobuf.UInt32Value + 20, // 28: controller.api.resources.targets.v1.SshTargetAttributes.default_client_port:type_name -> google.protobuf.UInt32Value + 18, // 29: controller.api.resources.targets.v1.SshTargetAttributes.storage_bucket_id:type_name -> google.protobuf.StringValue + 22, // 30: controller.api.resources.targets.v1.SshTargetAttributes.enable_session_recording:type_name -> google.protobuf.BoolValue + 17, // 31: controller.api.resources.targets.v1.SessionAuthorizationData.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo + 19, // 32: controller.api.resources.targets.v1.SessionAuthorizationData.created_time:type_name -> google.protobuf.Timestamp + 19, // 33: controller.api.resources.targets.v1.SessionAuthorizationData.expiration:type_name -> google.protobuf.Timestamp 10, // 34: controller.api.resources.targets.v1.SessionAuthorizationData.worker_info:type_name -> controller.api.resources.targets.v1.WorkerInfo - 16, // 35: controller.api.resources.targets.v1.SessionAuthorization.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo - 18, // 36: controller.api.resources.targets.v1.SessionAuthorization.created_time:type_name -> google.protobuf.Timestamp - 18, // 37: controller.api.resources.targets.v1.SessionAuthorization.expiration:type_name -> google.protobuf.Timestamp + 17, // 35: controller.api.resources.targets.v1.SessionAuthorization.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo + 19, // 36: controller.api.resources.targets.v1.SessionAuthorization.created_time:type_name -> google.protobuf.Timestamp + 19, // 37: controller.api.resources.targets.v1.SessionAuthorization.expiration:type_name -> google.protobuf.Timestamp 6, // 38: controller.api.resources.targets.v1.SessionAuthorization.credentials:type_name -> controller.api.resources.targets.v1.SessionCredential 39, // [39:39] is the sub-list for method output_type 39, // [39:39] is the sub-list for method input_type @@ -1668,7 +1737,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() { GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: unsafe.Slice(unsafe.StringData(file_controller_api_resources_targets_v1_target_proto_rawDesc), len(file_controller_api_resources_targets_v1_target_proto_rawDesc)), NumEnums: 0, - NumMessages: 15, + NumMessages: 16, NumExtensions: 0, NumServices: 0, },