CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
410 Commits 7 Branches 2 Tags
a67d5c8abb6cbeaa79e1d6bb5b41aba341bcaab4
Commit Graph
72 Commits
Author SHA1 Message Date
Jeff Mitchell 37e9fed2e3 Allow not destroying dev databases (#366) 
This also shifts some logic around to better prepare for non-dev-mode
workloads, although it does not actually call the KMS creation functions
and initial auth method creation from non-dev commands yet.
 2020-09-16 10:10:06 -04:00
Jeff Mitchell c4e2b88022 Add database URL. (#365) 
* Add database URL.

This allows specification of either a file://, env://, or other string.
If it starts with file:// or env:// the actual value will be read from
those resources.

* Tidy up the KMS output

* Also run migrations in test mode when specifying the URL
 2020-09-16 09:28:39 -04:00
Jeff Mitchell 570e52cabb Add missing set-grants to role command 2020-09-16 07:03:11 -04:00
Jeff Mitchell f4ad22b247 Move default port to a TCP target attribute (#361) 2020-09-15 15:20:49 -04:00
Jeff Mitchell eb88d0381a Fix default port update handling 2020-09-15 02:15:33 -04:00
Jeff Mitchell a598fdfb13 Fix targets CLI command 2020-09-15 02:09:07 -04:00
Jeff Mitchell 97985883df Fix token storage 2020-09-15 02:07:10 -04:00
Jeff Mitchell a00ee7a948 Add Result types to Go SDK and properly populate body/map fields (#358) 2020-09-15 01:08:21 -04:00
Jeff Mitchell 1b2f73d1d4 Fix some old logic in some CLI commands (#357) 2020-09-14 12:45:56 -04:00
Jeff Mitchell 6201357902 Use scope-specific token DEKs (#342) 2020-09-14 12:30:11 -04:00
Todd Knight 33e7b4538e WorkerCoordination and GetSession API refactoring (#354) 
* Possible api changes.

* Worker API update.

* Updating import alias name.

* Moving session down a level as a member of the GetSessionResponse.

* Marshal the auth flag into the GetSessionResponse proto instead of the session.
 2020-09-12 21:54:18 -07:00
Jeff Mitchell 2914b4c14c Use base58 for a few more user-facing values (#356) 2020-09-12 21:43:08 -04:00
Jeff Mitchell 1f80edbffc Add missing default-port flag to targets command (#355) 2020-09-12 14:06:28 -04:00
Jeff Mitchell c689af4306 Implement a TOFU mechanism on auth to worker (#348) 
This sets us up to better support multiple connections per session at
some future point.
 2020-09-10 23:25:40 -04:00
Jeff Mitchell f8237fb945 Move some packages into SDK, out of internal 2020-09-09 01:24:25 -04:00
Jeff Mitchell 36f975a952 Add some recovery KMS functions needed for external clients (#339) 2020-09-09 01:15:29 -04:00
Todd Knight c3ecea172d Generate new version of SDK resources and Add Tests (#331) 2020-09-08 16:27:51 -04:00
Jeff Mitchell 23156afa11 Add in most of the proxy flow (#326) 2020-09-03 13:24:34 -04:00
Jeff Mitchell a4c20164f3 Add add/remove/set hosts functions to host-sets command (#316) 2020-08-31 10:06:21 -04:00
Jeff Mitchell b8c8d29008 Switch ordering of CLI create/update vs static commands (#314) 2020-08-28 13:31:20 -04:00
Jeff Mitchell 1f065316ee Initial (#313) 2020-08-28 01:28:26 -04:00
Jeff Mitchell 20aef738c4 Add host-catalogs CLI command. (#312) 2020-08-28 00:17:09 -04:00
Jeff Mitchell 17ecb6f2ce Separate accounts/host catalogs/host sets into their own packages (#311) 2020-08-27 20:43:33 -04:00
Jeff Mitchell 28df6eb7b0 Update config encrypt/decrypt CLI command (#309) 
This updates the command to our emergent standards. It also enables
using a separate config file for a config kms, which allows non-string
values to be encrypted.

This allowed some nice cleanup as well.
 2020-08-27 16:38:44 -04:00
Jeff Mitchell b53812a5c1 Add ability to skip automatic auth method creation (#306) 
This is useful if you, for instance, want Terraform to be 100%
responsible for creation of resources (outside of the static ones that
cannot be removed or modified, like u_anon). This will mean using the
recovery mechanism for initial setup, but that isn't an issue once TF
supports that :-)
 2020-08-26 23:27:46 -04:00
Jeff Mitchell 490be8a7e4 Add ability to skip role creation on scope create (#308) 
* Initial work on scope creation skipping

* Fix things
 2020-08-26 23:27:25 -04:00
Jeff Mitchell 8f579c75c3 paum -> ampw (#303) 2020-08-25 00:21:08 -04:00
Jeff Mitchell 74544f6324 Encrypt tokens on the way out and decrypt on the way in (#302) 
* Encrypt tokens on the way out and decrypt on the way in

This isn't a security feature related to tokens specifically; it's so
that we can discard cryptographically bad tokens before we ever hit the
DB. This way we can't pass through a DDoS to the database due to
fetching obviously invalid token values.

I'm using base58 to encode the resulting value as there aren't great
base62 options, and allowing base64 / and + values can hamper usability
by creating copying/highlighting breaks.
 2020-08-25 00:20:50 -04:00
Jeff Mitchell 414a2ab2c3 Remove some dead, dead, dead, dead code 2020-08-20 17:58:29 -04:00
Jeff Mitchell b47cca0329 Add (non-db aspects of) the recovery key workflow (#286) 2020-08-20 13:34:03 -04:00
Todd Knight d5678c4f80 Handler for Host CRUDL actions (#287) 2020-08-20 08:20:26 -07:00
Jim 9570897032 basic keys mgmt repo (#264) 2020-08-19 16:47:18 -04:00
Jeff Mitchell adfc5681be Auth methods CLI (#277) 2020-08-18 17:46:34 -04:00
Jeff Mitchell 282177afc2 Remove the default org (#270) 2020-08-17 15:38:41 -04:00
Jeff Mitchell fff15bc9f3 Rename KMS purpose 'controller' to 'root' 2020-08-14 10:12:31 -04:00
Jeff Mitchell efaf58b568 Add users CLI command and do some cleanup (#269) 2020-08-13 20:59:32 -04:00
Jeff Mitchell 6080d93f8f Add authtokens CLI command (#268) 2020-08-13 20:25:28 -04:00
Jeff Mitchell d3a1cd949b Update password auth method flags to fit current standards 2020-08-13 18:32:58 -04:00
Jeff Mitchell e89e9d1349 Add groups CLI command (#266) 2020-08-13 17:35:55 -04:00
Jeff Mitchell b75a6fc5e5 Update scopes CLI command in the model of the roles command (#262) 
* Update scopes CLI command in the model of the roles command

* Pull help functions to helper methods
 2020-08-13 11:20:22 -04:00
Jeff Mitchell 5d104a7a01 Migrate off Vault's internalshared folder to the separated-out repo 2020-08-12 16:12:45 -04:00
Jeff Mitchell 203e2b5dc2 Initial worker porting steps (#232) 2020-08-12 00:40:39 -04:00
Jeff Mitchell 4cfab04307 Migrate user name to login name (#255) 2020-08-11 17:25:00 -04:00
Jeff Mitchell 6661117d4c The name. The name. The name! 2020-08-10 17:15:02 -04:00
Jeff Mitchell bbd200101f Move update versioning to query parameter, and fix up scope API tests (#244) 
* Move update versioning to query parameter, and fix up scope API tests

* Add version checks for update requests in other services
 2020-08-07 17:56:55 -04:00
Jeff Mitchell f07bb9dae6 Fix breakage after change to template from previous PR 2020-08-07 15:18:44 -04:00
Todd Knight f84991c0f1 Use authenticate and Auth Method repo functions (#242) 2020-08-07 10:18:40 -07:00
Jeff Mitchell 908a299ea3 Convert SDK to the new options API (#238) 2020-08-07 12:55:02 -04:00
Jeff Mitchell 2bbc1163c4 Save the entire token, not just the ID (#211) 
This allows us to use the token's scope to set the default scope for an
action in the client instead of relying on env vars.
 2020-07-22 15:02:58 -04:00
Jeff Mitchell 388a13b10d Convert scopes to the new paradigm (#206) 2020-07-22 00:14:28 -04:00