Merge pull request #1886 from hashicorp/approle-upgrade-notes

upgrade notes entry for approle constraint and warning on role read

CHANGELOG.md

@@ -1,6 +1,6 @@
 ## 0.6.2 (Unreleased)
 
-DEPRECATIONS/BREAKING CHANGES:
+DEPRECATIONS/CHANGES:
 
 IMPROVEMENTS:
 
@@ -41,7 +41,7 @@ BUG FIXES:
 
 ## 0.6.1 (August 22, 2016)
 
-DEPRECATIONS/BREAKING CHANGES:
+DEPRECATIONS/CHANGES:
 
  * Once the active node is 0.6.1, standby nodes must also be 0.6.1 in order to
    connect to the HA cluster. We recommend following our [general upgrade
@@ -238,7 +238,7 @@ SECURITY:
    confusion, we have simply removed `auth/token/revoke-prefix` in 0.6, and
    `sys/revoke-prefix` will be meant for both leases and tokens instead.
 
-DEPRECATIONS/BREAKING CHANGES:
+DEPRECATIONS/CHANGES:
 
  * `auth/token/revoke-prefix` has been removed. See the security notice for
    details. [GH-1280]
@@ -513,7 +513,7 @@ BUG FIXES:
 
 ## 0.5.1 (February 25th, 2016)
  
-DEPRECATIONS/BREAKING CHANGES:
+DEPRECATIONS/CHANGES:
 
  * RSA keys less than 2048 bits are no longer supported in the PKI backend.
    1024-bit keys are considered unsafe and are disallowed in the Internet PKI.
@@ -597,7 +597,7 @@ SECURITY:
    would be a denial of service against a legitimate rekey operation by sending
    cancel requests over and over. Thanks to Josh Snyder for the report!
 
-DEPRECATIONS/BREAKING CHANGES:
+DEPRECATIONS/CHANGES:
 
  * `s3` physical backend: Environment variables are now preferred over
    configuration values. This makes it behave similar to the rest of Vault,
@@ -782,7 +782,7 @@ against Go 1.5.3, there are no changes from 0.4.0.
 
 ## 0.4.0 (December 10, 2015)
 
-DEPRECATIONS/BREAKING CHANGES:
+DEPRECATIONS/CHANGES:
 
  * Policy Name Casing: Policy names are now normalized to lower-case on write,
    helping prevent accidental case mismatches. For backwards compatibility,
@@ -932,7 +932,7 @@ MISC:
 
 ## 0.3.0 (September 28, 2015)
 
-DEPRECATIONS/BREAKING CHANGES:
+DEPRECATIONS/CHANGES:
 
 Note: deprecations and breaking changes in upcoming releases are announced
 ahead of time on the "vault-tool" mailing list.

builtin/credential/approle/path_role.go

@@ -521,13 +521,9 @@ func (b *backend) pathRoleSecretIDList(req *logical.Request, data *framework.Fie
 	return logical.ListResponse(listItems), nil
 }
 
-// setRoleEntry grabs a write lock and stores the options on an role into the storage.
-// Also creates a reverse index from the role's RoleID to the role itself.
-func (b *backend) setRoleEntry(s logical.Storage, roleName string, role *roleStorageEntry, previousRoleID string) error {
-	if roleName == "" {
-		return fmt.Errorf("missing role name")
-	}
-
+// validateRoleConstraints checks if the role has at least one constraint
+// enabled.
+func validateRoleConstraints(role *roleStorageEntry) error {
 	if role == nil {
 		return fmt.Errorf("nil role")
 	}
@@ -540,6 +536,26 @@ func (b *backend) setRoleEntry(s logical.Storage, roleName string, role *roleSto
 		return fmt.Errorf("at least one constraint should be enabled on the role")
 	}
 
+	return nil
+}
+
+// setRoleEntry grabs a write lock and stores the options on an role into the
+// storage. Also creates a reverse index from the role's RoleID to the role
+// itself.
+func (b *backend) setRoleEntry(s logical.Storage, roleName string, role *roleStorageEntry, previousRoleID string) error {
+	if roleName == "" {
+		return fmt.Errorf("missing role name")
+	}
+
+	if role == nil {
+		return fmt.Errorf("nil role")
+	}
+
+	// Check if role constraints are properly set
+	if err := validateRoleConstraints(role); err != nil {
+		return err
+	}
+
 	// Create a storage entry for the role
 	entry, err := logical.StorageEntryJSON("role/"+strings.ToLower(roleName), role)
 	if err != nil {
@@ -743,9 +759,15 @@ func (b *backend) pathRoleRead(req *logical.Request, data *framework.FieldData)
 		delete(data, "role_id")
 		delete(data, "hmac_key")
 
-		return &logical.Response{
+		resp := &logical.Response{
 			Data: data,
-		}, nil
+		}
+
+		if err := validateRoleConstraints(role); err != nil {
+			resp.AddWarning("Role does not have any constraints set on it. Updates to this role will require a constraint to be set")
+		}
+
+		return resp, nil
 	}
 }
 

website/source/docs/install/upgrade-to-0.6.2.html.md

@@ -10,3 +10,11 @@ description: |-
 
 This page contains the list of breaking changes for Vault 0.6.2. Please read it
 carefully.
+
+## AppRole Role Constraints
+
+Creating or updating a role now requires at least one constraint to be enabled.
+Currently there are only 2 constraints: `bind_secret_id` and `bound_cidr_list`.
+`bind_secret_id` is enabled by default. Roles which had `bind_secret_id`
+disabled and `bound_cidr_list` not set, will require a constraint to be
+speficied during further updates.