* bug(vault): Correctly handle credential stores with expired tokens
Boundary makes use of a database view to perform CRUD operations on
Vault credential stores and libraries. This view did not include
credential stores with tokens that have expired in Vault, causing
errors when attempting to perform any action against them.
This adds an action to the API that allows pulling out an activation
token that can be given to a worker in its config (directly or via env
or file). The worker can pass this along with its normal request in
place of its normal nonce and the server will automatically accept it.
Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com>
This add the generated code and additional configuration to support
sending the ssh target subtype to the api via the sdk or cli.
The cli now supports an additional subcommand for the ssh target
subtype:
boundary targets create ssh
boundary targets update ssh
* feat(credentials): Refactor credential purposes
* Application credentials have been refactored to Brokered credentials
* Egress credentials have been refactored to Injected Application
credentials
Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
* Add support for ssh_private_key credential type in Vault libraries
* Add support for ssh_private_key credential type
* Support jsonpointer for Vault library mapping overrides
* (refactor) change all sql references of user_password to username_password
* refactor(pkg) renamed pkg userpassword to usernamepassword
* refactor(proto) updated protocol buffers to use UsernamePassword
* refactor(code) updated references from UserPassword to UsernamePassword in golang files
* refactor(test) updated unit tests to reference UsernamePassword changes
* refactor(ddtest) updated references in dbtests to use UsernamePassword
* chore(sql-test) fixed spelling issue
* chore(sql) added and updated comments in migartion & tables. fixed indentations
* chore(proto) updated comments to reflect username_password changes
* refactor(tests) updated unit tests to replace user-password with username-password
* refactor(cmd) updated cmd help text to use username
* chore(tests) update test name & comments
* fix(cmd) fixed cmd usage definition for credentials update
* refactor(tests) removed out of scope changes
* fix(sql) incremented sql migration id & updated migration comments
* Remove the server_id from session table, change it to worker_id on session_connection
This is step 1 in updating the worker table. The worker is becoming a public resource so it must have
a public id. We drop the server_id column on the session_connection table and add the worker_id column
so we can use the wt_public_key type. Since db migrations are applied while the controller is offline,
it should be safe to assume all session connections are not in a running state, thus allowing us to null
out all the worker ids in the session_connection table.
For now we don't have very good enforcement of the wt_public_id constraints, since the id is currently
defined in the worker config, but this will soon change and the worker's id will be generated by the
controller.
This updates the target resources to use a oneof for attributes. This
allows requests to the targets service to leverage the new
subtypes.AttributeTransformerInterceptor so that attributes are strongly
typed prior to the service handler.
This updates the credential store resources to use a oneof for
attributes. This allows requests to the credential store service to
leverage the new subtypes.AttributeTransformerInterceptor so that
attributes are strongly typed prior to the service handler.
This updates the credential library resources to use a oneof for
attributes. This allows requests to the credential library service to
leverage the new subtypes.AttributeTransformerInterceptor so that
attributes are strongly typed prior to the service handler.
This updates the credential store resources to use a oneof for
attributes. This allows requests to the credential store service to
leverage the new subtypes.AttributeTransformerInterceptor so that
attributes are strongly typed prior to the service handler.
Louis Ruch
Jeff MitchellandIrena Rindos
irenarindos
Timothy Messier
Haotian
Damian Debkowski
Todd
Jim
Johan Brandhorst-Satzkorn