luxolus
/
open-vault
2
0
Fork 0
Code Issues 1 Pull Requests Releases Activity

prevent deleting MFA method through an invalid path (#15482) 

* prevent deleting MFA method through an invalid path

* Adding CL
This commit is contained in:
Hamid Ghaf 2022-05-31 14:22:04 -04:00 committed by GitHub
parent e9595f8f5f
commit bf087f9d0d
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 36 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
changelog/15482.txt Normal file
View File

@ -0,0 +1,3 @@
```release-note:bug
auth: Prevent deleting a valid MFA method ID using the endpoint for a different MFA method type
```

6
vault/external_tests/mfa/login_mfa_test.go
View File

@ -187,6 +187,12 @@ func TestLoginMFA_Method_CRUD(t *testing.T) {
t.Fatal("expected response id to match existing method id but it didn't") t.Fatal("expected response id to match existing method id but it didn't")
} }
// delete with invalid path should fail
_, err = client.Logical().Delete(invalidPath)
if err == nil {
t.Fatal("expected deleting an MFA method ID with invalid path to fail")
}
// delete it // delete it
_, err = client.Logical().Delete(myNewPath) _, err = client.Logical().Delete(myNewPath)
if err != nil { if err != nil {

8
vault/identity_store.go
View File

@ -221,7 +221,7 @@ func mfaPaths(i *IdentityStore) []*framework.Path {
Summary: "Update or create a configuration for the given MFA method", Summary: "Update or create a configuration for the given MFA method",
}, },
logical.DeleteOperation: &framework.PathOperation{ logical.DeleteOperation: &framework.PathOperation{
Callback: i.handleMFAMethodDelete, Callback: i.handleMFAMethodTOTPDelete,
Summary: "Delete a configuration for the given MFA method", Summary: "Delete a configuration for the given MFA method",
}, },
}, },
@ -335,7 +335,7 @@ func mfaPaths(i *IdentityStore) []*framework.Path {
Summary: "Update or create a configuration for the given MFA method", Summary: "Update or create a configuration for the given MFA method",
}, },
logical.DeleteOperation: &framework.PathOperation{ logical.DeleteOperation: &framework.PathOperation{
Callback: i.handleMFAMethodDelete, Callback: i.handleMFAMethodOKTADelete,
Summary: "Delete a configuration for the given MFA method", Summary: "Delete a configuration for the given MFA method",
}, },
}, },
@ -391,7 +391,7 @@ func mfaPaths(i *IdentityStore) []*framework.Path {
Summary: "Update or create a configuration for the given MFA method", Summary: "Update or create a configuration for the given MFA method",
}, },
logical.DeleteOperation: &framework.PathOperation{ logical.DeleteOperation: &framework.PathOperation{
Callback: i.handleMFAMethodDelete, Callback: i.handleMFAMethodDUODelete,
Summary: "Delete a configuration for the given MFA method", Summary: "Delete a configuration for the given MFA method",
}, },
}, },
@ -431,7 +431,7 @@ func mfaPaths(i *IdentityStore) []*framework.Path {
Summary: "Update or create a configuration for the given MFA method", Summary: "Update or create a configuration for the given MFA method",
}, },
logical.DeleteOperation: &framework.PathOperation{ logical.DeleteOperation: &framework.PathOperation{
Callback: i.handleMFAMethodDelete, Callback: i.handleMFAMethodPingIDDelete,
Summary: "Delete a configuration for the given MFA method", Summary: "Delete a configuration for the given MFA method",
}, },
}, },

26
vault/login_mfa.go
View File

@ -384,12 +384,28 @@ func (i *IdentityStore) handleMFAMethodPingIDUpdate(ctx context.Context, req *lo
return i.handleMFAMethodUpdateCommon(ctx, req, d, mfaMethodTypePingID) return i.handleMFAMethodUpdateCommon(ctx, req, d, mfaMethodTypePingID)
} }
func (i *IdentityStore) handleMFAMethodDelete(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) { func (i *IdentityStore) handleMFAMethodTOTPDelete(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
return i.handleMFAMethodDeleteCommon(ctx, req, d, mfaMethodTypeTOTP)
}
func (i *IdentityStore) handleMFAMethodOKTADelete(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
return i.handleMFAMethodDeleteCommon(ctx, req, d, mfaMethodTypeOkta)
}
func (i *IdentityStore) handleMFAMethodDUODelete(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
return i.handleMFAMethodDeleteCommon(ctx, req, d, mfaMethodTypeDuo)
}
func (i *IdentityStore) handleMFAMethodPingIDDelete(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
return i.handleMFAMethodDeleteCommon(ctx, req, d, mfaMethodTypePingID)
}
func (i *IdentityStore) handleMFAMethodDeleteCommon(ctx context.Context, req *logical.Request, d *framework.FieldData, methodType string) (*logical.Response, error) {
methodID := d.Get("method_id").(string) methodID := d.Get("method_id").(string)
if methodID == "" { if methodID == "" {
return logical.ErrorResponse("missing method ID"), nil return logical.ErrorResponse("missing method ID"), nil
} }
return nil, i.mfaBackend.deleteMFAConfigByMethodID(ctx, methodID, memDBLoginMFAConfigsTable, loginMFAConfigPrefix) return nil, i.mfaBackend.deleteMFAConfigByMethodID(ctx, methodID, methodType, memDBLoginMFAConfigsTable, loginMFAConfigPrefix)
} }
func (i *IdentityStore) handleLoginMFAGenerateUpdate(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) { func (i *IdentityStore) handleLoginMFAGenerateUpdate(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
@ -2559,7 +2575,7 @@ func (b *LoginMFABackend) MemDBDeleteMFALoginEnforcementConfigByNameAndNamespace
return nil return nil
} }
func (b *LoginMFABackend) deleteMFAConfigByMethodID(ctx context.Context, configID, tableName, prefix string) error { func (b *LoginMFABackend) deleteMFAConfigByMethodID(ctx context.Context, configID, methodType, tableName, prefix string) error {
var err error var err error
if configID == "" { if configID == "" {
@ -2601,6 +2617,10 @@ func (b *LoginMFABackend) deleteMFAConfigByMethodID(ctx context.Context, configI
return nil return nil
} }
if mConfig.Type != methodType {
return fmt.Errorf("method type does not match the MFA config type")
}
mfaNs, err := b.Core.NamespaceByID(ctx, mConfig.NamespaceID) mfaNs, err := b.Core.NamespaceByID(ctx, mConfig.NamespaceID)
if err != nil { if err != nil {
return err return err