This addresses the issue of a user being created in a normal or
dev environment that is given access to authorize sessions against
specific targets but the permission hasn't been configured for the UI
clients to actually list them.
Resolves#1791
This feature allows the user to set the `controllers` field to a string
that points to either an environment variable or file.
We then dynamically pull out the value and parse it into the config.
This feature allows the user to set the `tags` field to a string
that points to either an environment variable or file.
We then dynamically pull out the value and parse it into the config.
This can also be done at the keys level, where you set your keys
directly in Boundary's config file, but point the values to env/file.
* Add plugin-based host entry to CHANGELOG.md
* Amend to de-emphasize domain language
This should hopefully make it more obvious that the plugin system is
currently internal and one cannot yet write 3rd party plugins for
Boundary.
This stores worker connection nonces within the database to ensure
uniqueness of connections. Prior the connection required any attacker to
be able to decrypt the incoming encrypted authentication message in
order to replay (and if the attacker has access to the KMS you have
bigger problems), but with this change even if an attacker does have
access to the KMS key, they cannot reuse the same message. (If they're
able to encrypt against the KMS key, they can still act as a worker with
a new message, so this only really helps if they only have decryption
capabilities.)
This also affected credential libraries and managed groups. It seems
that any end-to-end tests of these grants currently had them included in
wildcards instead of individually, but these types were never added to
the valid list for resources. Additionally, credential store wasn't
added as a valid top level type for pinning purposes.
The existing logic was to ignore Forbidden errors when recursively
listing in favor of looking for downstream scopes with appropriate
permissions. The problem is that when there is actually no
authentication token at all, what comes back is an Unauthenticated
error. Therefore if you didn't have permissions on the ingress scope
(e.g. the default of `global`) but did downstream for the anonymous
user, you'd get back an error.
I don't think there's any security issue with doing this; the user could
always have simply started the search at a downstream scope to begin
with so nothing more is being revealed, this just fixes behavior to
match expectations in this case.
A test was added for one of the services; the code is exactly the same
across them. The reason that the existing tests that were added with the
output fields testing didn't catch this is that even though they were
specifying `u_anon` as the user, the disabled test context skipped the
logic that would return a 401 in this case. It turns out that fixing
this is very complicated because we don't have a great way in most tests
of defining grants to put onto the generated scopes, so even if a true
anonymous context was added each test would require the anonymous user
to have list permissions on whatever resource was under test, requiring
a lot of role and grant and principal finagling. This is probably a good
longer-term TODO but not one that seemed worth it for this fix.
Fixes ICU-2301
Although we document that this is allowed, and the ACL code handles it,
some of the validation code did not. This would cause a semi
intermittent problem because that validation code is used only in some
code paths; specifically we skip it (for now) to avoid erroring out on
some deprecated grant string formats when reading grants from the DB,
but we use it to error out when validating incoming grants.
* server: Add back controller shutdown on worker startup failure
This adds back the controller shutdown call on worker failure.
This was added in a15961e4 to address a panic discovered in testing, and
was mistakenly thought to be unnecessary. This, however, covers
multi-role scenarios where we have already started the controller, which
needs to be shut down gracefully if possible if we can't start the
worker.
A nil check has been added to ensure the panic does not resurface.
Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
* updated dockerfile to support multi-arch; added new section in Make for multi-arch
* adding a line to changelog
* switching base image to hashicorp mirror
This is very useful when trying to write managed groups filters as you
can directly look at the structure of the claims for the accounts you're
trying to filter.
The output of the claims in text format on the CLI currently leaves
something to be desired. I started revamping some of the formatting
functions and it quickly got very fragile. Fundamentally at this point
we're likely better off -- now that we have a good idea what our output
format/standards are like -- rewriting the formatting code. I'll take
that as a tasker as I have a lot of ideas...
Jeff Mitchell
Irena Rindos
Louis Ruch
Chris Marchesi
Hugo Vieira
Jim
Irena Rindos
Irena Rindos
Randall Morey
Michael Gaffney
Jacob Mammoliti
Joe Thompson