luxolus
/
open-vault
2
0
Fork 0
Code Issues 1 Pull Requests Releases Activity

Merge pull request #1751 from hashicorp/fix-aws-ec2-ttl 

aws-ec2: se max_ttl when ttl is not set, during login
This commit is contained in:
Vishal Nayak 2016-08-18 16:08:49 -04:00 committed by GitHub
parent 6fc9a956bc 7ce631f1dc
commit fa4c80412d
1 changed files with 18 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
builtin/credential/aws-ec2/path_login.go
View File

@ -406,10 +406,15 @@ func (b *backend) pathLoginUpdate(
}
// Cap the TTL value.
if shortestMaxTTL < roleEntry.TTL {
resp.AddWarning(fmt.Sprintf("Role ttl of %d exceeded the effective max_ttl of %d; ttl value is capped appropriately", roleEntry.TTL/time.Second, shortestMaxTTL/time.Second))
resp.Auth.TTL = shortestMaxTTL
shortestTTL := b.System().DefaultLeaseTTL()
if roleEntry.TTL > time.Duration(0) && roleEntry.TTL < shortestTTL {
shortestTTL = roleEntry.TTL
}
if shortestMaxTTL < shortestTTL {
resp.AddWarning(fmt.Sprintf("Effective ttl of %q exceeded the effective max_ttl of %q; ttl value is capped appropriately", (shortestTTL / time.Second).String(), (shortestMaxTTL / time.Second).String()))
shortestTTL = shortestMaxTTL
}
resp.Auth.TTL = shortestTTL
return resp, nil
@ -549,6 +554,15 @@ func (b *backend) pathLoginRenew(
longestMaxTTL = rTagMaxTTL
}
// Cap the TTL value.
shortestTTL := b.System().DefaultLeaseTTL()
if roleEntry.TTL > time.Duration(0) && roleEntry.TTL < shortestTTL {
shortestTTL = roleEntry.TTL
}
if shortestMaxTTL < shortestTTL {
shortestTTL = shortestMaxTTL
}
// Only LastUpdatedTime and ExpirationTime change and all other fields remain the same.
currentTime := time.Now()
storedIdentity.LastUpdatedTime = currentTime
@ -558,7 +572,7 @@ func (b *backend) pathLoginRenew(
return nil, err
}
return framework.LeaseExtend(req.Auth.TTL, shortestMaxTTL, b.System())(req, data)
return framework.LeaseExtend(shortestTTL, shortestMaxTTL, b.System())(req, data)
}
// Struct to represent items of interest from the EC2 instance identity document.