This adds several relationships into the resource package that are then
made use of to improve the grant validation that runs during Parse. By
understanding mappings between ID and resource type the validation
checks can far better align with actual allowed grant formats so we can
find several common misunderstandings before they simply result in an
authorization failure.
In the future some of these functions could be used in the logic in the
actual ACL checks but it's not currently necessary and I don't want to
lump that change in with this.
Note that the tests have not meaningfully changed, but they _have_ had
to be updated because the stricter validation is actually catching
issues.
* feature (auth): required schema changes for auth ldap method (#2669)
chore (auth/ldap): move schema changes to next avail migration number
* feature (auth/ldap): define AuthMethod and all its value objects (#2703)
* feature (auth/ldap): storage protos
* feature (auth/ldap): define AuthMethod and all its value objects
* feature (auth/ldap): add repo and reading an auth method (#2718)
* feature (auth/ldap): add Repository.CreateAuthMethod(...) and Repository.DeleteAuthMethod(...) (#2724)
* feature (auth/ldap): add Repository.UpdateAuthMethod(...) (#2739)
* feature (auth/ldap): add Account
* feature (auth/ldap): add AuthMethod.EnableGroups
* fix (auth/ldap): refactor AuthMethod.oplog to enforce proper constraints
* feature (auth/ldap): add Account repo functions
* refactor (auth/ldap): remove entry attributes from account
Realized the entry attributes could have absolutely anything in them
(including binary data) and since we absolutely don't have to have them
there's just no reason to take on the risk.
* feature (auth/ldap): add AuthMethod.UseTokenGroups
* feature (auth/ldap): add Authenticate(...)
* refactor (auth/ldap): ensure options take a context as the 1st parameter
* feature (auth/ldap): add Account attribute maps
* chore (auth/ldap): make fmt deltas
* feature (auth/ldap): add managed groups (#2760)
* tests (auth/ldap): add missing unit test to Repository.DeleteAccount(...)
Add bits to test the delete operation when you're not able to generate
oplog metadata
* feature (auth/ldap): add managed groups
fixup! feature (auth/ldap): add managed groups (#2760)
* feature (auth/ldap): service proto definition (#2761)
* feature (handlers/authmethods): add handlers for ldap auth method operations (#2794)
* feature (auth/ldap): add Account attribute maps
* chore (auth/ldap): update cap/ldap to latest version
* feature (auth/ldap): add ldap api generation definitions
* feature (authmethods): add ldap repo NewService(...)
* feature (authmethods/ldap): add proper mask_mapping to protobufs
* feature (authmethods): add support to get an ldap auth method
* refactor (auth/ldap): export TestGenerateCA(...)
* feature (authmethods): add support to create an ldap auth method
* feature (authmethods): add support to delete an ldap auth method
* feature (authmethods): add support to list ldap auth methods
* refactor (auth/ldap): make urls optional for NewAuthMethod(...)
* refactor (auth/ldap): export ldap.TestInvalidPem
* chore: make fmt changes
* fix (auth/ldap): properly handle group search config
Add constraints and tests to ensure when an ldap AuthMethod.EnableGroups
is true, and UseTokenGroups is false; that there's a GroupDn configured
for finding a user's associated groups
* feature (authmethods): add support to update an ldap auth methods
* chore (db/ldap): tmp mv migrations so there's no conflict with ongoing work
* feature (verifier): add ldap auth method to verifier bits
* fix (controller): prevent panic when controller stops when there's no listener
* feature (authmethods): add support to authenticate via ldap auth methods
* chore (migrations): fix whitespace in stmt
* chore: fmt fixup
* tests (auth/ldap): invalid err msg
* feature (cli/authmethods): add support for ldap auth-methods CRUD and authenticate (#2810)
* feature (authmethods): add CLI support for ldap auth methods CRUD
* tests (api/auth): ldap auth method classification tests
* feature (authmethods): add CLI support for ldap auth authenticate
* feature (auth/ldap): set request timeouts for ldap server connections
* feature (handlers/authmethods): handle u_anon listing properly.
* feature (account/handers): ldap account and managed group CRUDL APIs (#2852)
* feature (auth/ldap) add repository Listing of ManagedGroupMemberAccount
* feature (controller/handlers): add ldapRepoFn to accounts service
* feature (auth/ldap) register ldap managed group subtype
* feature (account/handlers): ldap account CRUDL APIs
* feature (controller/handlers): add ldapRepo to managed groups service
* feature (account/handlers): ldap managed group CRUDL APIs
* docs (domain): add LDAP accounts, auth-methods and managed groups (#2857)
* feature (ldap/cli) add ldap accounts and managed groups CRUDL commands (#2856)
* fix (handlers/authmethods): fix ldap authorized actions (#2892)
* feature (cli/ldap/authenticate): use primary auth method if none is provided (#2890)
* fix (auth/ldap): support setting the state attribute
* feature (cli/ldap/authenticate): use primary auth method if none is provided
* feature (wh/ldap) add tests for new ldap auth method and accounts (#2919)
* refactor (migrations/ldap): mv to correct directory
* chore: add copyright headers
* fix (api/authmethods/ldap): renumber new LdapAuthMethodAttributes field
* fix (auth/ldap): allow the auth method state to be updated (#2951)
* chore: update sdk and api versions for llb - this is tmp until merging
* tests (managed groups): add required errContains for new test
* refactor (kms): add GetWrapperer for RewrapFn parameter
* tests (kms): add MockWrapper and MockGetWrapperer
Make it a bit easier to write unhappy path tests which depend on
a Wrapper or GetWrapperer
* Key Rotation/Destruction (#2477)
* fix: Correct kms.CreateKeys comment
This method does not return anything.
* feat(kms): Add new ListKeys method
The new ListKeys method wraps the underlying KMS wrapper,
returning all the keys in the scope specified.
* feat(scopes): Add new scope actions for key management
Adds list-keys, rotate-keys and revoke-keys actions for scopes.
* feat(scopes): Add ListKeys API endpoint
This new endpoint lists all keys in a scope
* feat(api): Add ListKeys to Scopes client
This has to be a custom function because it is a custom action
and doesn't map well to any of the existing templates, or
generalises well in a way that would make it reasonable
to create a new template.
* feat(cli): Add new scopes list-keys command
* add RotateKeys function to the kms repository
* Add Rotate Keys Endpoint to Scopes Api (#2360)
* add rotate keys endpoint
* add tests for RotateKeys endpoint
* remove that one comment I forgot about
* addressing more PR comments
* Add Rotate Keys CLI Command (#2395)
* add cli command and client
* add bats tests
* fix some info text and pr comments
* write a new rotate keys description
* Add Missing DEK Foreign Keys (#2408)
* add missing fks
* mark key as nullable in gorm
* update tests to use a new wrapper with a real key_id
* fix formatting in test and add keys for auth_token test
* replace key values
* revert postgres_40_01_test.go
* style: reformat sql for readability
* refactor: change type of key_id columns to kms_private_id
* Store key_id and scope_id with oplog entries, re-type columns referencing data key version (#2431)
* fix(db): Correct types of data key version referencers
* fix(oplog): Fix missing error handling
* feat(oplog): Store key_id and scope_id with oplog entries
This migration truncates all existing oplog entries, as
migrating existing data would have been complex and
likely unnecessary.
* Update view references
* Always delete oplog entries when dropping keys
* Fix rebase issues
* Fix sql tests
* Add schema for new kms destruction jobs (#2479)
* feat: Add schema for new kms destruction jobs
The schema lets us manage destruction jobs per-table
while providing a guarantee that only one run is running
at a time.
* Apply suggestions from code review
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
* Fix table reference and tests
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
* update domain, api, and cli to all include key versions in outputs (#2472)
* update domain, api, and cli to all include key versions in outputs
* fix go sum
* add migration to fix immutable error
* fix final test issue as well as make gen issue
* rebase and fix
* address johan pr comments
* make gen, didn't realize comments were included
* update migrations based on new migration 55 file 03
* Move migrations to 56
* feat: Add key version rewrapping function registry (#2478)
The new RegisterTableRewrapFn can be used by a domain
to register a callback to use when rewrapping data in a
specific table name.
* feat(kms): Add scopeId to RewrapFn (#2539)
This makes it much easier for rewrap functions to look up
the correct wrapper and limit the number of rows searched.
* Update Root Cert Proto Definition (#2542)
* update root cert proto definition to properly identify public_key as the table primary key
* add the test fix as well
* Rewrap Functions for Encrypted Tables (#2532)
* add oidc rewrap
* add argon2 config rewrap
* add auth token rewrapping
* add worker auth cert rewrapping
* check the err
* add username password credential rewrapping
* add ssh private key credential rewrapping
* add vault client certificate rewrap function
* add host catalog secret rewrap function
* cleanup a little
* add host vault token rewrap function
* add session credential rewrap function
* add session rewrap function
* add worker auth rewrap function
* update test to include full assert gamut
* add session rewrap function TEST
* bring all tests up to current standards, make more readable, and include full assert gamut
* rework all rewrap functions to utilize scope id
* update comments, queries, sql refs, etc, in response to PR comments
* forgot a comment
* remove hmac updates and fix a couple comments again
* Rewrapping Registered Tables Test (#2555)
* add the registered table test as well as the two missing rewrap functions
* address pr comments, add db r/w conversions, cmp.diff, sql comment, remove (now) faulty immutable test
* Add ability to list key version destruction jobs, recurring jobs and destroying key versions (#2498)
* feat(kms): Add ability to list data key version destruction jobs
* feat(scopes): Add ListKeyVersionDestructionJobs
* feat(cli): Add list-key-version-destruction-jobs
* feat(kms): Add recurring job that performs table rewrapping
The new recurring job runs for each job table with a registered
rewrapping callback. It attempts to become the running run and
start its rewrapping, gracefully handling sudden interruptions
by resuming it's work if it finds evidence of sudden interruption.
* feat(kms): Add recurring job for destroying key versions
The new job monitors the database for data key version destruction
jobs that have finished rewrapping all its data, performing
the final data key version revocation.
* feat(kms): Add DestroyKeyVersion
DestroyKeyVersion immediately destroys a key version
if it is a root key version or a data key version
which encrypts no data. If the data key version
encrypts data which needs to be rewrapped, it
queues an asynchronous job to complete the rewrapping
operation.
* feat(scopes): Add DestroyKeyVersion API endpoint
* feat(cli): Add scopes destroy-key-version CLI command
* Ensure all secret updates include key ID (#2556)
* feat(all): Ensure all secret updates include key ID
When updating a secret, it is paramount that the key ID
is also updated, as it is the only means we have of ensuring
that we only destroy keys once there is no more data
associated with the key.
* Remove fix to session repository for now
This breaks the current private key derivation method
* add new encrypt/decrypt funcs and made necessary proto changes (#2557)
* add new encrypt/decrypt funcs and made necessary proto changes
* address all PR comments
* fix test panic
* add param checking to rewraps
* fix(schema): Correctly organize migrations again
* Review comments part 1
* Review comments part 2
* Review comments part 3
* Store cert private key, encrypt tofu token (#2583)
* fix(session): store cert private key, encrypt tofu token
Previously, we would derive a session certificate private key from
the session key used in each project, and not store the key. We
would also encrypt the tofu token with the database key but not
store a reference to this key in the database.
This change fixes this by replacing our key derivation with a key
generation step, and instead store the generated key, encrypted,
in the database. We also ensure that any new tofu tokens are
encrypted with the same key.
To handle existing sessions, we lazily rewrite the sessions whenever
a user lists them. There is a minor risk that a user could end up
destroying the database key that encrypts the tofu token before
that session has been rewrapped, but this is going to be rare and
temporary.
* feat(session): Allow the random source for secrets to be configured
* Review comments
* Minor fixes
* More minor fixes
* More small fixes
Co-authored-by: Danielle Miu <dani.miu@hashicorp.com>
Co-authored-by: Danielle <29378233+DanielleMiu@users.noreply.github.com>
Co-authored-by: Michael Gaffney <mike@gaffney.cc>
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
* fix(session): Unset session key ID when scope is deleted
Unsetting the key ID allows the session to live beyond the lifetime of
the scope, while allowing the scope to cascade delete its keys.
* fix(migrations): Rewrite migration 56 tests
These tests can no longer use the normal test helpers
as they try to use the new oplog table structure, so we
have to manually write all the interactions.
* fix(migrations): Rename migration 58 file name
This was the name used in the release branch, update
it to the new migration number.
* fix(e2e): Add some comments and debug to kms tests
* fix(session): Handle empty project and user IDs in read
When a project or user is deleted, the session is automatically
canceled and the respective field on the session is unset.
LookupSession did not handle this case gracefully, and would
error on decryption in this state. Skip decrypting sessions that
do not have either a user or project to avoid this error. The
decrypted values are not used for a canceled session.
* Fix worker test
* Increase test timeout
Co-authored-by: Danielle Miu <dani.miu@hashicorp.com>
Co-authored-by: Danielle <29378233+DanielleMiu@users.noreply.github.com>
Co-authored-by: Michael Gaffney <mike@gaffney.cc>
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
* chore(deps): Update grpc-gateway dependency
This fixes an issue which would allow an attacker to trigger a
(recovered) panic in the gateway handler.
* fix(server): Use cmp.Diff instead of assert.Equal
Testify is not great at handling protobuf types, and
was for some reason returning a diff here when in
reality there is none. Switch to go-cmp for the
comparison to remove the error.
* chore: update go-dbw dependencies
This update included an update of the upstream gorm dependency.
In the latest update, gorm appears to have become more sensitive when
a slice is passed into operations. The ptr to slice must now
be a ptr to slice of ptrs. This change required an update to how
boundary handles slices of PrincipalRole, which now must return a ptr
to PrincipalRole. There were also some tests that needed to be
updated because of this change.
* fixup! chore: update go-dbw dependencies
* Move the server daemons into their own package
With this change the internal/server package now is dedicated to the server domain (workers and controllers) and not to the server daemons.
The hope is that this will make it easier to keep the daemons decoupled from the representation of the servers in the database.
Our test helper packages were not possible to use
with benchmarks. This refactor switches to testing.TB
to allow both tests and benchmarks to use the helpers.
* Install buf with go install
This reduces the impact of using buf on our dependency
closure, which was significant. It also avoids potential
issues with building buf given our own internal dependency
constraints. This has caused issues (including crashes!)
in the past.
See https://github.com/cockroachdb/cockroach/issues/67216#issuecomment-874176186
for more discussion on using tool dependencies generally, and
https://github.com/bufbuild/buf/issues/52
for an example of where this sort of thing caused an issue for a user.
* Upgrade buf version
We should migrate to v1 sooner rather than later, as it has some
breaking changes from v0.
* Change buf lint/breaking commands
These commands were moved up one level for v1
* Migrate to buf.yaml to v1
* Remove unused imports
These were uncovered by using "buf lint".
* Use buf v1.3.1
* Depend on googleapis and grpc-gateway via BSR
* Switch to buf for proto generation
* Remove third party dependency
* Remove unused tools and scripts
* Move local protos up one level
* Temporarily don't fail on breaking changes
* Generate CI config
* Fix generation of controller.json
* Replace use of deprecated flag
* Remove unused import, regenerate files
* Remove temporary skipping over breaking check
* chore: Add new dbw dependency
* refactor: Convert to use dbw.DB
* refactor (db): Change GetTicket(...) signature
* feature (db tests): Added TestDeleteWhere(...)
Adding this allows us to eliminate a leak of the gorm library
* refactor: Add ctx to ScanRows(...) signature
This is required to refactor all the deprecated errors pkg calls.
This refactor required adding a context to quite a few call chains
and in particular the job scheduler bits
* feature (db/tests): Add support for test opt: WithTestLogLevel(...)
This test only option allows callers to specify a log level for the
underlying db package (where supported/applicable) when calling
TestSetup(...)
* refactor (db): Simplify Db type
Only store the underlying *DB and create the *RW on demand when
needed.
* refactor (oplog): Port to using dbw pkg for db operations
* refactor (db): Remove gormDB(...) func
* tests (db): Add unit tests for TestDeleteWhere(...)
* chore: make fmt changes to formatting
* refactor (controller): Use a grpc server for the grpc-gateway
This starts a grpc server for the grpc-gateway. The new gateway
server uses an in-memory listener which also supports "dialing", so
the http proxy can connect to the in-memory listener.
This change allows us to use all grpc server features and was in part
motivated by a need for an interceptor of inbound requests. With that
said, having a "proper" grpc server for the gateway will provide a lot
more flexibility and capabilities moving forward.
The request context will still be verified via middleware in the
http proxy (see wrapHandlerWithCommonFuncs). This verified context
will be serialized into a protobuf and sent along to the grpc-gateway
via metadata where an interceptor will add the verified request
info to the request's context (see requestCtxInterceptor). The
interceptor will verify the serialized request info via a shared ticket
with it's companion in-memory http proxy. FYI: the ticket is simply
random base62 string (see db.NewPrivateId).
This change also necessitated a minor change to services. We need to
return an empty response instead of nil, nil when there are no errors
and the response is empty.
* refactor (handlers): Rename gRPC Gateway filter
Originally, this was called an OutgoingInterceptor, which is an
unfortunate name since it's not an interceptor. Now that we're
refactoring the gateway stuff and have proper interceptors, renaming
this should remove ambiguity
* refactor: Rework how 204 with empty msg is handled
Recent changes to grpc gateway has necessitated a change to how
204s are handled by the gateway
* tests (bats): Check status codes for delete operations
* refact: Changes required for gorm v2
* refact: Add db.DB wrapper and refact all test fixtures to use it
Stop leaking the gorm abstraction within our unit tests.
* refact: Migrate direct calls to pq to pgx driver
The refactor will remove the remaining direct dependencies on
the pq driver which has been deprecated in favor of the pgx
driver.
It includes the addition of common.SqlOpen which is a wrapper around
sql.Open, which is needed to deal with the driver name changing from
"postgres" to "pgx" but in our code base the dialect and driver are
synonyms.
* add new error funcs which take a ctx and deprecate existing funcs
* use context where available when writing error events
* remove circular internal/errors pkg dep
* suppress some chatty errors using errors.WithoutEvent()
* convert auth oidc funcs to take context where needed to write events
Co-authored-by: Jim <jlambert@hashicorp.com>
This is very useful when trying to write managed groups filters as you
can directly look at the structure of the claims for the accounts you're
trying to filter.
The output of the claims in text format on the CLI currently leaves
something to be desired. I started revamping some of the formatting
functions and it quickly got very fragile. Fundamentally at this point
we're likely better off -- now that we have a good idea what our output
format/standards are like -- rewriting the formatting code. I'll take
that as a tasker as I have a lot of ideas...
Jeff Mitchell
Jim
Johan Brandhorst-Satzkorn
Todd
Irena Rindos
Damian Debkowski
Timothy Messier
Oleg Butuzov
Todd Knight
s-christoffandJim