For requests to the target authorize session endpoint we support passing
a target name instead of an id. This means that `req.GetId()` might not
be the target's public id. Since the first thing authorize session does
includes retrieving the target as part of the authorization checks, this
subtype check can leverage the public id of the target instead of using
the request.
Fixes: 6178dd516e
This adds a new Job type that is for generic session state monitoring. Monitoring sessions does not include any information about specific connections.
This commit fixes the behaviour of scopes where whitespace was allowed
(and thus persisted) in the Name and Description fields.
It also adds some more tests for scope Create and Updateto cover more
error cases.
For scope update, `handlers.ValidateUpdateRequest` exists, however this
was not used as it does not work properly for requests where the
`global` scope is updated.
In `ValidateUpdateRequest`, an ID check is performed and it assumes
there's always a resource prefix (eg: "p", "o") and an identifier
(random numbers and letters) after the prefix. This fails for `global`.
See `handlers.ValidId`.
Most of the changes here are changes or enhancements that are useful for
tests. The crux of the issue was that I had pulled up one var to the
package level so it could be read from tests, but that var was not being
reset between tests. It's not even used in tests anymore, so I put it
back to function-local.
This makes it much easier to figure out when and why rotation is
happening and control it for tests/debugging.
Remove cert skew
Cherry-picked from release/0.12.x
Do not allow PKI-KMS workers to have names updated via API
This would cause their public IDs to change, which we do not want.
Descriptions are also disallowed, since those come from the config file.
This also adds logic to allow upgrading from old KMS method to new, with
a test.
Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com>
This adds a new mechanism for worker authentication that uses the
third-party arbitration of the original KMS flow by leveraging
recently-added capabilities in nodeenrollment to support a registration
wrapper. This allows for workers to be registered to the system with
just a name and a matching wrapper, while at the same time allowing
these workers to be used for private Vault access and multi-hop as they
contain per-worker encryption keys and support rotation.
Nodes using this mode will generate and rotate credentials in-memory
(using another recently added nodeenrollment capability) so will have a
new set of keys on every startup. This has the side effect of ensuring
that there is never a conflict or re-use of these credentials.
Note that the normal test worker flow was using the now-deprecated KMS
method; there is still a test that uses this (explicitly) but all other
tests using test workers that did not specify a specific PKI flow now
actually use this mechanism. This means there is fairly decent test
coverage in a general sense, plus the specific tests updated/added for
this feature.
This also adds a new KMS type that can be used to have
distinct KMSes for upstream authentication vs. accepting from
downstream.
- Refactor the Target domain repository functions so that they no longer return 4 different types.
`Target` struct now contains `HostSource` & `CredentialSources` with Getters & Setters
- Extending `Target` to contain `HostSource` & `CredentialSources` enables `funcs` to just return `Target` instead of multiple return types.
This also allows easy future refactors and extensions of `Target`
This adds several relationships into the resource package that are then
made use of to improve the grant validation that runs during Parse. By
understanding mappings between ID and resource type the validation
checks can far better align with actual allowed grant formats so we can
find several common misunderstandings before they simply result in an
authorization failure.
In the future some of these functions could be used in the logic in the
actual ACL checks but it's not currently necessary and I don't want to
lump that change in with this.
Note that the tests have not meaningfully changed, but they _have_ had
to be updated because the stricter validation is actually catching
issues.
Jeff Mitchell
Timothy Messier
Todd
Jim
Johan Brandhorst-Satzkorn
Louis Ruch
Danielle Miu
Damian Debkowski
Michael Milton
Hugo
Elim Tsiagbey
Haotian