Michael Gaffney
c317901db4
This change adds a credential type attribute to credential library and allows it to be set when creating a credential library. Specifying the type of credential returned from a library allows for new features and additional error checking to be added over time. A User Password credential type and an Unspecified credential type are included with the expectation that additional credential types will be added in the future. This change also adds the credential type attribute to existing credential libraries and sets it to Unspecified. Known Limitations: - Credential type is only supported on the repository create method. Support for the other CRUD methods will be added in the future.
125 lines
3.3 KiB
Go
125 lines
3.3 KiB
Go
package vault
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/hashicorp/boundary/internal/credential"
|
|
"github.com/hashicorp/boundary/internal/credential/vault/store"
|
|
"github.com/hashicorp/boundary/internal/errors"
|
|
"github.com/hashicorp/boundary/internal/oplog"
|
|
"google.golang.org/protobuf/proto"
|
|
)
|
|
|
|
// A Method represents an HTTP method used for communicating with Vault.
|
|
type Method string
|
|
|
|
// HTTP methods use for communicating with Vault.
|
|
const (
|
|
MethodGet Method = "GET"
|
|
MethodPost Method = "POST"
|
|
)
|
|
|
|
// A CredentialLibrary contains a Vault path and is owned by a credential
|
|
// store.
|
|
type CredentialLibrary struct {
|
|
*store.CredentialLibrary
|
|
tableName string `gorm:"-"`
|
|
|
|
MappingOverride MappingOverride `gorm:"-"`
|
|
}
|
|
|
|
// NewCredentialLibrary creates a new in memory CredentialLibrary
|
|
// for a Vault backend at vaultPath assigned to storeId.
|
|
// Name, description, method, request body, credential type, and mapping
|
|
// override are the only valid options. All other options are ignored.
|
|
func NewCredentialLibrary(storeId string, vaultPath string, opt ...Option) (*CredentialLibrary, error) {
|
|
const op = "vault.NewCredentialLibrary"
|
|
opts := getOpts(opt...)
|
|
|
|
l := &CredentialLibrary{
|
|
MappingOverride: opts.withMappingOverride,
|
|
CredentialLibrary: &store.CredentialLibrary{
|
|
StoreId: storeId,
|
|
Name: opts.withName,
|
|
Description: opts.withDescription,
|
|
VaultPath: vaultPath,
|
|
HttpRequestBody: opts.withRequestBody,
|
|
HttpMethod: string(opts.withMethod),
|
|
CredentialType: string(opts.withCredentialType),
|
|
},
|
|
}
|
|
|
|
return l, nil
|
|
}
|
|
|
|
func (l *CredentialLibrary) validate(ctx context.Context, caller errors.Op) error {
|
|
switch {
|
|
case !validMappingOverride(l.MappingOverride, l.CredentialType()):
|
|
return errors.New(ctx, errors.VaultInvalidMappingOverride, caller, "invalid credential type for mapping override")
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func allocCredentialLibrary() *CredentialLibrary {
|
|
return &CredentialLibrary{
|
|
CredentialLibrary: &store.CredentialLibrary{},
|
|
}
|
|
}
|
|
|
|
func (l *CredentialLibrary) clone() *CredentialLibrary {
|
|
var m MappingOverride
|
|
if l.MappingOverride != nil {
|
|
m = l.MappingOverride.clone()
|
|
}
|
|
|
|
cp := proto.Clone(l.CredentialLibrary)
|
|
return &CredentialLibrary{
|
|
MappingOverride: m,
|
|
CredentialLibrary: cp.(*store.CredentialLibrary),
|
|
}
|
|
}
|
|
|
|
func (l *CredentialLibrary) setId(i string) {
|
|
l.PublicId = i
|
|
if l.MappingOverride != nil {
|
|
l.MappingOverride.setLibraryId(i)
|
|
}
|
|
}
|
|
|
|
// TableName returns the table name.
|
|
func (l *CredentialLibrary) TableName() string {
|
|
if l.tableName != "" {
|
|
return l.tableName
|
|
}
|
|
return "credential_vault_library"
|
|
}
|
|
|
|
// SetTableName sets the table name.
|
|
func (l *CredentialLibrary) SetTableName(n string) {
|
|
l.tableName = n
|
|
}
|
|
|
|
func (l *CredentialLibrary) oplog(op oplog.OpType) oplog.Metadata {
|
|
metadata := oplog.Metadata{
|
|
"resource-public-id": []string{l.PublicId},
|
|
"resource-type": []string{"credential-vault-library"},
|
|
"op-type": []string{op.String()},
|
|
}
|
|
if l.StoreId != "" {
|
|
metadata["store-id"] = []string{l.StoreId}
|
|
}
|
|
return metadata
|
|
}
|
|
|
|
// CredentialType returns the type of credential the library retrieves.
|
|
func (l *CredentialLibrary) CredentialType() credential.Type {
|
|
switch ct := l.GetCredentialType(); ct {
|
|
case "":
|
|
return credential.UnspecifiedType
|
|
default:
|
|
return credential.Type(ct)
|
|
}
|
|
}
|
|
|
|
var _ credential.Library = (*CredentialLibrary)(nil)
|