This also then removes support for docker-based containing starting (for
now) from platforms other than windows/darwin/linux as there are build
issues on several.
I don't think the conditions exist here that necessitated it being
introduced into Vault, but I do sometimes see a baffling condition where
the address coming from the flag is empty. I don't think we need this so
take it out.
This also shifts some logic around to better prepare for non-dev-mode
workloads, although it does not actually call the KMS creation functions
and initial auth method creation from non-dev commands yet.
* Add database URL.
This allows specification of either a file://, env://, or other string.
If it starts with file:// or env:// the actual value will be read from
those resources.
* Tidy up the KMS output
* Also run migrations in test mode when specifying the URL
This updates the command to our emergent standards. It also enables
using a separate config file for a config kms, which allows non-string
values to be encrypted.
This allowed some nice cleanup as well.
This is useful if you, for instance, want Terraform to be 100%
responsible for creation of resources (outside of the static ones that
cannot be removed or modified, like u_anon). This will mean using the
recovery mechanism for initial setup, but that isn't an issue once TF
supports that :-)
* Encrypt tokens on the way out and decrypt on the way in
This isn't a security feature related to tokens specifically; it's so
that we can discard cryptographically bad tokens before we ever hit the
DB. This way we can't pass through a DDoS to the database due to
fetching obviously invalid token values.
I'm using base58 to encode the resulting value as there aren't great
base62 options, and allowing base64 / and + values can hamper usability
by creating copying/highlighting breaks.
* Allow updating accounts (not username or pw).
* Updating new field names to LoginName.
* Adding creation with password test.
* Fixing documentation for WithLoginName
Jeff Mitchell
Jim
Todd Knight