When issuing credentials from vault credential libraries, only persist
the vault credential if it is revokable. A credential that is revokable
has a valid lease id that can be used to revoke the lease in vault. If
the credential is not revokable it is also not renewable since renewing
also requires a lease id.
See: https://developer.hashicorp.com/vault/docs/concepts/lease
This defines a new credential library type for ssh certificates.
It adds new repository methods to support CRUDL of the new ssh
certificate credential library.
Co-authored-by: Timothy Messier <tim.messier@gmail.com>
Allows for new issuing credential library implementations in the future.
Moved db and decrypt logic to privateCredentialLibraryAllTypes from
issueCredentialLibrary.
This also removes sessionId from retrieveCredential, it was not needed
and removing allows retrieveCredential to be reused for credentials
issued outside current workflow.
* chore: remove duplicate import
* feat: Add job run cleaner
The new job cleans job runs older than a configured interval.
Configure the job to clean jobs older than 1 minute.
* feat: default to using primary auth method with authenticating
* Add ability to specify scope ID flag in authenticate method
---------
Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
* Fix target port handling
This fixes two issues that compounded on each other (see the Changelog
update for more information):
* The verification logic for hosts was not correct for update operations
(in multiple ways) which meant that a host could be updated after
creation to have a port. Targets had a previously fixed bug where they
did not require a default port, which meant that ports could be used
from hosts
* A recent (unreleased) change had prioritized any port coming from the
host over the default port, which would mean there was no way if a
host had a port specified to use it in multiple targets.
This fixes the update verification logic, and strikes a middle ground
between breaking things and not by allowing existing addresses with
ports to be used with targets but ignoring that port, instead requiring
targets to have default port set at authorize time (currently there is
backwards compat that does not require this due to the original optional
port bug).
* Update CHANGELOG.md
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
If an update call was made to a target that removed an address, for a
target that already did not have an address, the incorrect number of
rows updated was being reported. During the update the target's version
was correctly being updated, resulting in one row being updated.
However then the delete call would result in zero rows being deleted,
since there was no address associated with the target, and this would
replace the value for the returned rowsUpdated. This resulted in the
target service thinking that no update happened, and it would report an
error.
The wh_upsert_credential_group function was incorrectly attempting to
update the session connection fact table. There are a couple problems
with this:
1. At the time that this runs, there would be no session connection facts
for this session.
2. This function is meant to update the session fact table, there is a
separate function that associates the credential group with the
session connection facts.
This also fixes another bug that was causing expired rows of the
credential dimension to be included in the group membership. And finally
it fixes a typo in the function name.
Creates a target using an address for boundary dev and when first
init-ing boundary (boundary database init).
It also makes this newly created target the default one
(ttcp_1234567890). The target using host sources is now a secondary
target (ttcp_0987654321).
This test uses the target domain repository code to test the ingress
& egress worker filter. With our changes we have updated the target
domain repository logic to fetch the target address. When this migration
test is invoked, the target_address table does not exist and the domain
code will always return an error making this test invalid.
This commit adds CLI support for addresses to be attached directly to a
Target, for all current types of Target (ssh and tcp).
It also clarifies the relevant documentation regarding the autogen of
API option functionality.
* testing(perms): Add Parse fuzz test
I ran this for a few minutes and it didn't discover anything catastrophic.
* Add roundtrip tests
* Fix invalid unicode parsing, empty output fields
* Do the unicode conversion once on input
* Remove incorrect fix for empty output fields
* Allow empty output_fields
This is the same behavior as output_fields=,
* Add tests back, make JSON behaviour consistent
* Rework the output fields mechanism to fix some bugs such as properly handling no fields
* Change signature of Fields
Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
Timothy Messier
Haotian
Danielle
Cameron Perera
Todd
Irena Rindos
Johan Brandhorst-Satzkorn
Jeff MalnickandJeff Mitchell
Hugo
Jim
Damian Debkowski