* internal/handlers/managed_groups: ensure membership lookup is unlimited
Previously, we would only show the first 10,000 members in the group,
giving the impression that a complete list was performed. Now we
list all members.
* internal/handlers/accounts: ensure group lookup is unlimited
Previously, we would only show the first 10,000 managed group
memberships. Now we list all group memberships of an account.
This commit changes the logic around selecting jobs to run. Before this,
Boundary used a view "job_jobs_to_run" which was a collation of all jobs
that were not running and scheduled to run. When jobs were requested to
run, Boundary would look at this view, grab a certain amount of jobs and
insert them into the "job_run" table. Importantly, while the amount of
jobs to be scheduled at once defaulted to 1 in the scheduler package,
this was entirely overriden in the controller package to -1 (no limit,
run all jobs that the query would return).
With this commit, Boundary now looks at the "job" table directly for
jobs to run, regardless of job run status. This was done to improve DB
performance as the view (which queried all "job_run" rows) was causing
significant DB contention.
Additionally, the option to limit job runs is now removed since it was
already hardcoded to -1 and not user-configurable anyways.
Should the need arise to implement this limit again, this will have to
be done in a different way since the new query does not account for
running jobs and limiting the rows returned after jobs are already
running would yield a no-op (the new query inserts nothing into
"job_run" if any given job is already running).
Before this change, upon the completion of a job run, the scheduler
would update a job_run entry with the completed status as well as the
number of objects affected by the run. Additionally, we then had a
cleaner job whose scope was deleting these completed entries from
job_run.
This commit changes this design to drop the cleaner job the and rolls
its functionality directly into the scheduler. Now, when any given job
run is complete, the scheduler will automatically delete it from the
job_run table itself.
In addition, the completed status has been removed as a valid status as
it is not set anymore.
This change follows a decision that given the data in these job_run
entries is already being deleted by the cleaner job, updating its state
when a job completes just to have it deleted is not efficient.
Additionally, no use-case for this data was surfaced.
This removes the Cartesian product in the DB for GrantsForUser in favor
of returning the actual grant scope information and dealing with it in
application code.
(cherry picked from commit 913cd536823d73994acc4f4d833208c1cc05f91b)
The target authorize session endpoint allows for alternative target
identifiers besides the public id. For this to function correctly, the
grpc gateway path definition for the endpoint deviates from the common
pattern used for other endpoints that include ids. When this change was
done, it was not accounted for in the logic used to capture the
prometheus metrics for api requests to this particular endpoint,
resulting in the metrics never incrementing for the authorize session
endpoint.
This fix updates the matching logic used for the metrics to ensure that
the metrics are incremented for this endpoint.
See: c149bc4a79
Propagate the downstream worker timeout into the
downstream receiver and downstream ticker
so we have a configurable consistent timeout
value to use for worker to worker interactions.
Also change the atomic.Pointer to an atomic.Int64
for consistency with other values.
This commit modifies the OIDC authentication start method to return a 400 (Bad Request) error
if a client attempts to start the authentication flow against an OIDC auth method that is set to
inactive. This is something we noticed in our error logs in HCP Boundary that is impacting our
SLOs.
Previously this returned its own error code which is mapped to a 500 response. Tests have been updated
to catch this new scenario.
Signed-off-by: David Bond <davidsbond93@gmail.com>
* feat: Add support for capturing URL actions in request info
- Pass request context to services to validate actions.
- Validate actions for auth methods during authentication. `/v1/auth-methods/{{AUTH_METHOD_ID}}:authenticate:callback` is currently only supported on `OIDC` auth methods. An error is thrown if `:callback` is not supported
Add `WithDisablePathLengthFallback()` runtime option to the grpc-gateway mux HTTP server. This prevents the issue where the request method can be overridden with a `X-HTTP-Method-Override` header.
Add validation for the port number in LDAP URLs. If a port number is provided, it is checked to ensure it is a valid integer and within the valid range. This validation helps prevent errors when configuring LDAP authentication.
This adds grant_scope_ids in the output of role listing. The lookup for grant scope IDs was changed to allow taking in a set of roles instead of just a single role, and the results are collated afterwards.
---------
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* api: remove deprecated grant_scope_id field
The grant_scope_id field was deprecated in 0.15.0, so we can remove
it for 0.17.0.
* Fix tests
* Fix more tests
* Remove an option and some related code that stuck around
* Fix bats tests
---------
Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
* Allow names and descriptions to contain newlines and other whitespace
* separate validate name from validate description
* update changelog
---------
Co-authored-by: Danielle Miu <29378233+DanielleMiu@users.noreply.github.com>
This commit makes modifications to the OIDC request handlers to return appropriate gRPC
status codes on errors. Before this change, boundary presents the internal error codes to
clients. This causes problems for reverse proxies, as these status codes are mapped to
non-standard HTTP response codes which are ultimately all turned into 500 responses when
4xx status codes are more appropriate and descriptive of the error returned.
Some modifications in this commit include calls to `event.WriteError` so that the
internal error is written to the controller log for visibility. Comments about
potential duplicate logs are now removed as `event.WriteError` is not called when using
functions from the `handlers` package.
Signed-off-by: David Bond <davidsbond93@gmail.com>
* test(billing): Calculate time deltas from a fixed time
Some time calculations are impacted when using the current day vs. the start of the month.
* test(db): Conditionally skip tests at end of month
Certain tests fail when run on the last day of the month because of edge cases in the setup of test data (for example, if today is May 31 and NZ time is June 1). This adds conditional logic to skip those tests when run on the last day of a month.
* CR: typo
The cluster listener supports a `max_request_duration` option, and
defaults to 90 seconds. However, this configuration was not being use
when processing grpc requests from the listener. This meant that
requests from worker to controller could hang indefinitely and
contributed to the recently fixed issue with database connections being
stuck in `idle in transaction`.
This commit adds a grpc interceptor that ensures each request has a
deadline set to the max request duration for the listener.
Refs: 29cd7bc9d6
* Add ListResolvableAliases to the user service
There are a few non common ways this method uses our ACL
and grant system. A user is able to list resolvable
aliases for another user if they are granted permission
to do so. That means we had to load the grants for
the user being listed for and not the requester when
determining if an alias is able to resolve to a destination
for which the requested user has permission.
Similarly, the grant hash used for the list pagination
is required to be that of the user being listed and not
the requester.
David Kanney
Johan Brandhorst-Satzkorn
Elim Tsiagbey
Hugo
daniandDamian Debkowski
Irena Rindos
Jeff Mitchell
Timothy Messier
David Bond
Sorawis Nilparuk (Bo)
Michael Li
Todd
Louis Ruch