This defines a new credential library type for ssh certificates.
It adds new repository methods to support CRUDL of the new ssh
certificate credential library.
Co-authored-by: Timothy Messier <tim.messier@gmail.com>
The wh_upsert_credential_group function was incorrectly attempting to
update the session connection fact table. There are a couple problems
with this:
1. At the time that this runs, there would be no session connection facts
for this session.
2. This function is meant to update the session fact table, there is a
separate function that associates the credential group with the
session connection facts.
This also fixes another bug that was causing expired rows of the
credential dimension to be included in the group membership. And finally
it fixes a typo in the function name.
* Key Rotation/Destruction (#2477)
* fix: Correct kms.CreateKeys comment
This method does not return anything.
* feat(kms): Add new ListKeys method
The new ListKeys method wraps the underlying KMS wrapper,
returning all the keys in the scope specified.
* feat(scopes): Add new scope actions for key management
Adds list-keys, rotate-keys and revoke-keys actions for scopes.
* feat(scopes): Add ListKeys API endpoint
This new endpoint lists all keys in a scope
* feat(api): Add ListKeys to Scopes client
This has to be a custom function because it is a custom action
and doesn't map well to any of the existing templates, or
generalises well in a way that would make it reasonable
to create a new template.
* feat(cli): Add new scopes list-keys command
* add RotateKeys function to the kms repository
* Add Rotate Keys Endpoint to Scopes Api (#2360)
* add rotate keys endpoint
* add tests for RotateKeys endpoint
* remove that one comment I forgot about
* addressing more PR comments
* Add Rotate Keys CLI Command (#2395)
* add cli command and client
* add bats tests
* fix some info text and pr comments
* write a new rotate keys description
* Add Missing DEK Foreign Keys (#2408)
* add missing fks
* mark key as nullable in gorm
* update tests to use a new wrapper with a real key_id
* fix formatting in test and add keys for auth_token test
* replace key values
* revert postgres_40_01_test.go
* style: reformat sql for readability
* refactor: change type of key_id columns to kms_private_id
* Store key_id and scope_id with oplog entries, re-type columns referencing data key version (#2431)
* fix(db): Correct types of data key version referencers
* fix(oplog): Fix missing error handling
* feat(oplog): Store key_id and scope_id with oplog entries
This migration truncates all existing oplog entries, as
migrating existing data would have been complex and
likely unnecessary.
* Update view references
* Always delete oplog entries when dropping keys
* Fix rebase issues
* Fix sql tests
* Add schema for new kms destruction jobs (#2479)
* feat: Add schema for new kms destruction jobs
The schema lets us manage destruction jobs per-table
while providing a guarantee that only one run is running
at a time.
* Apply suggestions from code review
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
* Fix table reference and tests
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
* update domain, api, and cli to all include key versions in outputs (#2472)
* update domain, api, and cli to all include key versions in outputs
* fix go sum
* add migration to fix immutable error
* fix final test issue as well as make gen issue
* rebase and fix
* address johan pr comments
* make gen, didn't realize comments were included
* update migrations based on new migration 55 file 03
* Move migrations to 56
* feat: Add key version rewrapping function registry (#2478)
The new RegisterTableRewrapFn can be used by a domain
to register a callback to use when rewrapping data in a
specific table name.
* feat(kms): Add scopeId to RewrapFn (#2539)
This makes it much easier for rewrap functions to look up
the correct wrapper and limit the number of rows searched.
* Update Root Cert Proto Definition (#2542)
* update root cert proto definition to properly identify public_key as the table primary key
* add the test fix as well
* Rewrap Functions for Encrypted Tables (#2532)
* add oidc rewrap
* add argon2 config rewrap
* add auth token rewrapping
* add worker auth cert rewrapping
* check the err
* add username password credential rewrapping
* add ssh private key credential rewrapping
* add vault client certificate rewrap function
* add host catalog secret rewrap function
* cleanup a little
* add host vault token rewrap function
* add session credential rewrap function
* add session rewrap function
* add worker auth rewrap function
* update test to include full assert gamut
* add session rewrap function TEST
* bring all tests up to current standards, make more readable, and include full assert gamut
* rework all rewrap functions to utilize scope id
* update comments, queries, sql refs, etc, in response to PR comments
* forgot a comment
* remove hmac updates and fix a couple comments again
* Rewrapping Registered Tables Test (#2555)
* add the registered table test as well as the two missing rewrap functions
* address pr comments, add db r/w conversions, cmp.diff, sql comment, remove (now) faulty immutable test
* Add ability to list key version destruction jobs, recurring jobs and destroying key versions (#2498)
* feat(kms): Add ability to list data key version destruction jobs
* feat(scopes): Add ListKeyVersionDestructionJobs
* feat(cli): Add list-key-version-destruction-jobs
* feat(kms): Add recurring job that performs table rewrapping
The new recurring job runs for each job table with a registered
rewrapping callback. It attempts to become the running run and
start its rewrapping, gracefully handling sudden interruptions
by resuming it's work if it finds evidence of sudden interruption.
* feat(kms): Add recurring job for destroying key versions
The new job monitors the database for data key version destruction
jobs that have finished rewrapping all its data, performing
the final data key version revocation.
* feat(kms): Add DestroyKeyVersion
DestroyKeyVersion immediately destroys a key version
if it is a root key version or a data key version
which encrypts no data. If the data key version
encrypts data which needs to be rewrapped, it
queues an asynchronous job to complete the rewrapping
operation.
* feat(scopes): Add DestroyKeyVersion API endpoint
* feat(cli): Add scopes destroy-key-version CLI command
* Ensure all secret updates include key ID (#2556)
* feat(all): Ensure all secret updates include key ID
When updating a secret, it is paramount that the key ID
is also updated, as it is the only means we have of ensuring
that we only destroy keys once there is no more data
associated with the key.
* Remove fix to session repository for now
This breaks the current private key derivation method
* add new encrypt/decrypt funcs and made necessary proto changes (#2557)
* add new encrypt/decrypt funcs and made necessary proto changes
* address all PR comments
* fix test panic
* add param checking to rewraps
* fix(schema): Correctly organize migrations again
* Review comments part 1
* Review comments part 2
* Review comments part 3
* Store cert private key, encrypt tofu token (#2583)
* fix(session): store cert private key, encrypt tofu token
Previously, we would derive a session certificate private key from
the session key used in each project, and not store the key. We
would also encrypt the tofu token with the database key but not
store a reference to this key in the database.
This change fixes this by replacing our key derivation with a key
generation step, and instead store the generated key, encrypted,
in the database. We also ensure that any new tofu tokens are
encrypted with the same key.
To handle existing sessions, we lazily rewrite the sessions whenever
a user lists them. There is a minor risk that a user could end up
destroying the database key that encrypts the tofu token before
that session has been rewrapped, but this is going to be rare and
temporary.
* feat(session): Allow the random source for secrets to be configured
* Review comments
* Minor fixes
* More minor fixes
* More small fixes
Co-authored-by: Danielle Miu <dani.miu@hashicorp.com>
Co-authored-by: Danielle <29378233+DanielleMiu@users.noreply.github.com>
Co-authored-by: Michael Gaffney <mike@gaffney.cc>
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
* fix(session): Unset session key ID when scope is deleted
Unsetting the key ID allows the session to live beyond the lifetime of
the scope, while allowing the scope to cascade delete its keys.
* fix(migrations): Rewrite migration 56 tests
These tests can no longer use the normal test helpers
as they try to use the new oplog table structure, so we
have to manually write all the interactions.
* fix(migrations): Rename migration 58 file name
This was the name used in the release branch, update
it to the new migration number.
* fix(e2e): Add some comments and debug to kms tests
* fix(session): Handle empty project and user IDs in read
When a project or user is deleted, the session is automatically
canceled and the respective field on the session is unset.
LookupSession did not handle this case gracefully, and would
error on decryption in this state. Skip decrypting sessions that
do not have either a user or project to avoid this error. The
decrypted values are not used for a canceled session.
* Fix worker test
* Increase test timeout
Co-authored-by: Danielle Miu <dani.miu@hashicorp.com>
Co-authored-by: Danielle <29378233+DanielleMiu@users.noreply.github.com>
Co-authored-by: Michael Gaffney <mike@gaffney.cc>
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
The schema changes introduced in 0.10.2 introduced a bug where an org
could not be deleted if there was a session for an org scoped user. It
would result in an error like:
scope.(Service).deleteFromRepo: unable to delete scope: \
iam.(Repository).DeleteScope: failed for o_VkNy46KwfS: \
iam.(Repository).delete: db.DoTx: iam.(Repository).delete: \
db.Delete: insert or update on table "session" violates foreign key constraint "target_fkey": integrity violation: error #1003
A worker around would be to first delete all projects in the org, then
finally delete the org.
This fix adds a regression test to the sqltests and updates several
constraints on the session table to be deferrable. Since the org delete
is a single transaction, this allows all of the necessary resources to
be deleted before attempting to enforce these constrains.
See: https://www.postgresql.org/docs/current/sql-set-constraints.html
Blame: 3a28ab614
* bug(vault): Correctly handle credential stores with expired tokens
Boundary makes use of a database view to perform CRUD operations on
Vault credential stores and libraries. This view did not include
credential stores with tokens that have expired in Vault, causing
errors when attempting to perform any action against them.
* feat(sql): Fork pgtap to support arm64
This forks pgtap-docker and builds the image locally,
and updates our references to use our forked image.
* fixup! feat(sql): Fork pgtap to support arm64
* feat(credentials): Refactor credential purposes
* Application credentials have been refactored to Brokered credentials
* Egress credentials have been refactored to Injected Application
credentials
Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
* Add support for ssh_private_key credential type in Vault libraries
* Add support for ssh_private_key credential type
* Support jsonpointer for Vault library mapping overrides
* bug(scheduler): Fix controller id length check
The job_run table has a foreign key to the server_controller private_id.
While this column is called a prviate_id it does not implement the wt_private_id
postgres domain type, and therefore does not have a minimum length of 10 characters.
* (refactor) change all sql references of user_password to username_password
* refactor(pkg) renamed pkg userpassword to usernamepassword
* refactor(proto) updated protocol buffers to use UsernamePassword
* refactor(code) updated references from UserPassword to UsernamePassword in golang files
* refactor(test) updated unit tests to reference UsernamePassword changes
* refactor(ddtest) updated references in dbtests to use UsernamePassword
* chore(sql-test) fixed spelling issue
* chore(sql) added and updated comments in migartion & tables. fixed indentations
* chore(proto) updated comments to reflect username_password changes
* refactor(tests) updated unit tests to replace user-password with username-password
* refactor(cmd) updated cmd help text to use username
* chore(tests) update test name & comments
* fix(cmd) fixed cmd usage definition for credentials update
* refactor(tests) removed out of scope changes
* fix(sql) incremented sql migration id & updated migration comments
* feature (db): add Db.UnderlyingDB()
This is needed to allow for integration with bits that need a *dbw.DB
* feature (kms): add new go-kms-wrapping/extras/kms dependency
* refactor (kms): schema changes required to adopt extras/kms pkg
* refactor (kms/iam): rename to DeprecateCreateKeysTx(...)
* refactor (kms): remove deprecated test
* refactor (kms): refactor Kms type
This refactor includes renaming the existing type to DeprecatedKms
and then refactoring the Kms type to become a wrapper of
go-kms-wrapping/extras/kms
* refactor (kms): delete all the unneeded bits
All this stuff is not needed now that we're using
go-kms-wrapping/extras/kms
* refactor (db): fixup tests after kms refactor
* refactor (kms/tests): use testing.TB for test helpers
Our test helper packages were not possible to use
with benchmarks. This refactor switches to testing.TB
to allow both tests and benchmarks to use the helpers.
* tests (session benchmarks): refactor to use new Kms type
* refactor (schema): rm test which relies on deprecated Kms code
* refactor (kms): post rebase on main changes required
* chore (kms refactor): re-add unit test from main
* refactor (kms): uses migrations that don't include KMS schema changes
Creates a new session_credential table and repository functions
to add and list credentials attached to a session. All credentials
are encrypted using the session scope id.
This change adds a credential type attribute to credential library and
allows it to be set when creating a credential library.
Specifying the type of credential returned from a library allows for new
features and additional error checking to be added over time. A
User Password credential type and an Unspecified credential type are
included with the expectation that additional credential types will be
added in the future. This change also adds the credential type attribute
to existing credential libraries and sets it to Unspecified.
Known Limitations:
- Credential type is only supported on the repository create method.
Support for the other CRUD methods will be added in the future.
This updates the docker image used for tests to support the new location
for sql migration files and the concept of editions. It continues to
process the old paths for now if the new directory does not exist, so
that the same image can be used during the transition.
This adds new dimension table to record credential information. Since a
session can have multiple credentials, the wh_session_accumulating_fact
is is linked to the credential_dimensions via bridge tables,
wh_credential_group and wh_credential_group_membership. When a session
is inserted, the credental group and credential dimensions will be
upserted. If the group changed in any way, a new group is inserted along
with all of the corresponding credentials.
These fields are being refactored so they conform with the new
wh_credential_dimension. This will inform Business Intelligence tools
that these attributes conform across dimensions.
The tables in the operational part of the Boundary database (meaning
non-warehouse tables) suffix primary key columns and foreign key columns
with `_id`. Many of these columns appear in the warehouse dimension and
fact tables as normal attributes, not primary keys or foreign keys. To
disambiguate ID columns from operational tables, the primary key column
for dimension tables will be renamed from `id` to `key` and the foreign
key columns in the fact tables will be renamed to change the suffix from
`_id` to `_key`.
Now when initializing the test database for sql tests,
it will load the colors persona data into the database. This will
provide a data set that tests can use without needing to call
`wtt_load`.
The main motivation is to allow for a separation of setup and test
execution that requires crossing a transaction boundary. The pgTap tests
are required to exectue as a single transaction, so that the rollback
can reset the state, and each test can be isolated. However, can cause
issues with some test senarios, particuarly with the use of some times
releated functions like `current_timestamp` and `now` which return the
time that the current transaction started. This creates an issue if a
test relies on some setup that sets a time via `now`, then an update
that expects a new time via `now`.
See: https://www.postgresql.org/docs/13/functions-datetime.html#FUNCTIONS-DATETIME-CURRENT
This adds new columns to the wh_user_dimension to provide additional
data from OIDC that does not apply to Password Auth.
Note: Given the specifics of the data, it is possible these columns may
be used by other auth methods in the future, hence the lack of `oidc` in
the column names.
The specific columns are:
- auth_method_external_id
For OIDC this is the Issuer
- auth_account_external_id
For OIDC this is the Subject
- auth_account_full_name
For OIDC this is the account's Full Name, and can be `None`.
- auth_account_email
For OIDC this is the account's Email, and can be `None`.
For all of these new columns, they will be `Not Applicable` if the auth
method is Password.
This sets up the configuration for running a new suite of tests that are
written in sql, to test the sql logic implemented in plpgsql functions
and triggers. It is primarily designed to provides tests for the data
warehouse functionality that is implemented purely in sql.
The infrastructure to run these tests leverages docker. It creates one
docker container using the `library/postgres` image and provisions the
database with the boundary sql migrations and test helper functions. A
separate docker container is run that has the pgtap extension and
pg_prove cli to execute the tests.
As noted, pgtap is used for the tests. This postgresql extension
provides a number of helpful assertion functions to make writing sql
tests easier. It also, along with the pg_prove cli, provides readable
test output.
Along with the new testing infrastructure this commit establishes a
baseline of tests for the wh_user_dimension:
- Unit tests for individual views and functions:
- whx_user_dimension_source
- whx_user_dimension_target
- wh_upsert_user
- Integration tests for that verify that the wh_user_dimension gets
populated correctly when sessions are inserted or updated. This
ensures that:
- the trigger runs on session insert
- the trigger results in the correct changes to the
wh_user_dimension.
This commit provides a `Makefile` to run the tests locally that provides
support for:
- Setting the postgres docker image to easily test multiple versions.
- Passing through options to pg_prove
- Passing the test list to run individual tests
- Additional targets to separately startup the database image to quickly
re-run tests while developing new tests.
Lastly configures circleci to run this test suite as a matrix build
in parallel with the other tests. The matrix build tests multiple
versions of postgres:
- latest
- 13-alpine
- 12-alpine
- 11-alpine
See:
https://pgtap.org/
Timothy Messier
HaotianandTimothy Messier
Damian Debkowski
Todd
Damian Debkowski
Louis Ruch
Jeff Malnick
Jim
irenarindos
Todd