Michael Gaffney
c317901db4
This change adds a credential type attribute to credential library and allows it to be set when creating a credential library. Specifying the type of credential returned from a library allows for new features and additional error checking to be added over time. A User Password credential type and an Unspecified credential type are included with the expectation that additional credential types will be added in the future. This change also adds the credential type attribute to existing credential libraries and sets it to Unspecified. Known Limitations: - Credential type is only supported on the repository create method. Support for the other CRUD methods will be added in the future.
99 lines
2.9 KiB
Go
99 lines
2.9 KiB
Go
package vault
|
|
|
|
import (
|
|
"github.com/hashicorp/boundary/internal/credential"
|
|
"github.com/hashicorp/boundary/internal/credential/vault/store"
|
|
"github.com/hashicorp/boundary/internal/db/sanitize"
|
|
"github.com/hashicorp/boundary/internal/db/sentinel"
|
|
"google.golang.org/protobuf/proto"
|
|
)
|
|
|
|
// validMappingOverride reports whether the given mapping override is valid
|
|
// for the given credential type.
|
|
func validMappingOverride(m MappingOverride, ct credential.Type) bool {
|
|
switch m.(type) {
|
|
case nil:
|
|
return true // it is always valid to not specify a mapping override
|
|
case *UserPasswordOverride:
|
|
return ct == credential.UserPasswordType
|
|
default:
|
|
return false // an unknown mapping override type is never valid
|
|
}
|
|
}
|
|
|
|
// A MappingOverride is an interface holding one of the mapping override
|
|
// types: UserPasswordOverride.
|
|
type MappingOverride interface {
|
|
clone() MappingOverride
|
|
setLibraryId(i string)
|
|
|
|
// sanitize replaces all sentinel values in the MappingOverride with
|
|
// zero values. It is called before a MappingOverride is returned from
|
|
// the domain layer when the MappingOverride has been loaded from the
|
|
// database.
|
|
sanitize()
|
|
}
|
|
|
|
// A UserPasswordOverride contains optional values for overriding the
|
|
// default mappings used to map a Vault secret to a UserPassword credential
|
|
// type for the credential library that owns it.
|
|
type UserPasswordOverride struct {
|
|
*store.UserPasswordOverride
|
|
tableName string `gorm:"-"`
|
|
}
|
|
|
|
var _ MappingOverride = (*UserPasswordOverride)(nil)
|
|
|
|
// NewUserPasswordOverride creates a new in memory UserPasswordOverride.
|
|
// WithOverrideUsernameAttribute and WithOverridePasswordAttribute are the
|
|
// only valid options. All other options are ignored.
|
|
func NewUserPasswordOverride(opt ...Option) *UserPasswordOverride {
|
|
opts := getOpts(opt...)
|
|
o := &UserPasswordOverride{
|
|
UserPasswordOverride: &store.UserPasswordOverride{
|
|
UsernameAttribute: sanitize.String(opts.withOverrideUsernameAttribute),
|
|
PasswordAttribute: sanitize.String(opts.withOverridePasswordAttribute),
|
|
},
|
|
}
|
|
return o
|
|
}
|
|
|
|
func allocUserPasswordOverride() *UserPasswordOverride {
|
|
return &UserPasswordOverride{
|
|
UserPasswordOverride: &store.UserPasswordOverride{},
|
|
}
|
|
}
|
|
|
|
func (o *UserPasswordOverride) clone() MappingOverride {
|
|
cp := proto.Clone(o.UserPasswordOverride)
|
|
return &UserPasswordOverride{
|
|
UserPasswordOverride: cp.(*store.UserPasswordOverride),
|
|
}
|
|
}
|
|
|
|
func (o *UserPasswordOverride) setLibraryId(i string) {
|
|
o.LibraryId = i
|
|
}
|
|
|
|
func (o *UserPasswordOverride) sanitize() {
|
|
if sentinel.Is(o.UsernameAttribute) {
|
|
o.UsernameAttribute = ""
|
|
}
|
|
if sentinel.Is(o.PasswordAttribute) {
|
|
o.PasswordAttribute = ""
|
|
}
|
|
}
|
|
|
|
// TableName returns the table name.
|
|
func (o *UserPasswordOverride) TableName() string {
|
|
if o.tableName != "" {
|
|
return o.tableName
|
|
}
|
|
return "credential_vault_library_user_password_mapping_override"
|
|
}
|
|
|
|
// SetTableName sets the table name.
|
|
func (o *UserPasswordOverride) SetTableName(n string) {
|
|
o.tableName = n
|
|
}
|