luxolus/open-vault
2
0
Fork 0
Code Issues 1 Pull requests Releases Activity

Merge pull request #1751 from hashicorp/fix-aws-ec2-ttl

Browse source 
aws-ec2: se max_ttl when ttl is not set, during login
This commit is contained in:
Vishal Nayak 2016-08-18 16:08:49 -04:00 committed by GitHub
parent 6fc9a956bc 7ce631f1dc
commit fa4c80412d
1 changed files with 18 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
builtin/credential/aws-ec2/path_login.go
View file

@ -406,10 +406,15 @@ func (b *backend) pathLoginUpdate(
} }
// Cap the TTL value. // Cap the TTL value.
if shortestMaxTTL < roleEntry.TTL { shortestTTL := b.System().DefaultLeaseTTL()
resp.AddWarning(fmt.Sprintf("Role ttl of %d exceeded the effective max_ttl of %d; ttl value is capped appropriately", roleEntry.TTL/time.Second, shortestMaxTTL/time.Second)) if roleEntry.TTL > time.Duration(0) && roleEntry.TTL < shortestTTL {
resp.Auth.TTL = shortestMaxTTL shortestTTL = roleEntry.TTL
} }
if shortestMaxTTL < shortestTTL {
resp.AddWarning(fmt.Sprintf("Effective ttl of %q exceeded the effective max_ttl of %q; ttl value is capped appropriately", (shortestTTL / time.Second).String(), (shortestMaxTTL / time.Second).String()))
shortestTTL = shortestMaxTTL
}
resp.Auth.TTL = shortestTTL
return resp, nil return resp, nil
@ -549,6 +554,15 @@ func (b *backend) pathLoginRenew(
longestMaxTTL = rTagMaxTTL longestMaxTTL = rTagMaxTTL
} }
// Cap the TTL value.
shortestTTL := b.System().DefaultLeaseTTL()
if roleEntry.TTL > time.Duration(0) && roleEntry.TTL < shortestTTL {
shortestTTL = roleEntry.TTL
}
if shortestMaxTTL < shortestTTL {
shortestTTL = shortestMaxTTL
}
// Only LastUpdatedTime and ExpirationTime change and all other fields remain the same. // Only LastUpdatedTime and ExpirationTime change and all other fields remain the same.
currentTime := time.Now() currentTime := time.Now()
storedIdentity.LastUpdatedTime = currentTime storedIdentity.LastUpdatedTime = currentTime
@ -558,7 +572,7 @@ func (b *backend) pathLoginRenew(
return nil, err return nil, err
} }
return framework.LeaseExtend(req.Auth.TTL, shortestMaxTTL, b.System())(req, data) return framework.LeaseExtend(shortestTTL, shortestMaxTTL, b.System())(req, data)
} }
// Struct to represent items of interest from the EC2 instance identity document. // Struct to represent items of interest from the EC2 instance identity document.