luxolus/open-vault
2
0
Fork 0
Code Issues 1 Pull requests Releases Activity

Update logic on renew paths

Browse source
This commit is contained in:
Calvin Leung Huang 2017-12-15 16:26:42 -05:00
parent 643451d46a
commit fe7ce434e4
1 changed files with 10 additions and 23 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

33
builtin/credential/aws/path_login.go
View file

@ -983,13 +983,12 @@ func (b *backend) pathLoginRenewIam(
}
}
// If 'Period' is set on the role, then the token should never expire.
if roleEntry.Period > time.Duration(0) {
req.Auth.TTL = roleEntry.Period
return &logical.Response{Auth: req.Auth}, nil
} else {
return framework.LeaseExtend(roleEntry.TTL, roleEntry.MaxTTL, b.System())(req, data)
resp, err := framework.LeaseExtend(roleEntry.TTL, roleEntry.MaxTTL, b.System())(req, data)
if err != nil {
return nil, err
}
resp.Auth.Period = roleEntry.Period
return resp, nil
}
func (b *backend) pathLoginRenewEc2(
@ -1070,24 +1069,12 @@ func (b *backend) pathLoginRenewEc2(
return nil, err
}
// If 'Period' is set on the role, then the token should never expire. Role
// tag does not have a 'Period' field. So, regarless of whether the token
// was issued using a role login or a role tag login, the period set on the
// role should take effect.
if roleEntry.Period > time.Duration(0) {
req.Auth.TTL = roleEntry.Period
return &logical.Response{Auth: req.Auth}, nil
} else {
// Cap the TTL value
shortestTTL := b.System().DefaultLeaseTTL()
if roleEntry.TTL > time.Duration(0) && roleEntry.TTL < shortestTTL {
shortestTTL = roleEntry.TTL
}
if shortestMaxTTL < shortestTTL {
shortestTTL = shortestMaxTTL
}
return framework.LeaseExtend(shortestTTL, shortestMaxTTL, b.System())(req, data)
resp, err := framework.LeaseExtend(roleEntry.TTL, roleEntry.MaxTTL, b.System())(req, data)
if err != nil {
return nil, err
}
resp.Auth.Period = roleEntry.Period
return resp, nil
}
func (b *backend) pathLoginUpdateIam(