* Fixed null token panic from 'v1/auth/token/' endpoints and returned proper error response
* added changelog entry for PR #13233
* changed error message from 'bad token' to 'null token'
* rebased off of main
* Revert "changed error message from 'bad token' to 'null token'"
This reverts commit 381ed9b32c5ddd5e47adb1643ef7e46fb768bc76.
* changed 'bad token' error message to 'invalid token' after revert
* remove unnecessary vault-data folder
We don't check for errors in the consul storage TLS setup. We might fail here
because of a missing certificate, bad permissions, etc. If anything is wrong,
vault just ignores the issues and continues, resulting in a lot of confusion.
Instead, lets return an error to the caller if this fails.
* Update entity-alias.mdx
it was not clear for approle what the name should be the approle name or the role_id.
* Update website/content/api-docs/secret/identity/entity-alias.mdx
Co-authored-by: Yoko Hyakuna <yoko@hashicorp.com>
Co-authored-by: Yoko Hyakuna <yoko@hashicorp.com>
* Upgrade guidance updates from VLT-172
Trying to clarify some upgrade questions. Learn update to follow in
separate PR.
* Apply suggestions from code review
Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>
Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>
* CLI changes for new mount tune config parameter allowed_managed_keys
* Correct allowed_managed_keys description in auth and secrets
* Documentation update for secrets and removed changes for auth
* Add changelog and remove documentation changes for auth
* removed changelog
* Correct the field description
* Replace - with : when listing certificate serials
* Update browserslist
* Add browserslistrc
* ember-cli-update --to 3.26, fix conflicts
* Run codemodes that start with ember-*
* More codemods - before cp*
* More codemods (curly data-test-*)
* WIP ember-basic-dropdown template errors
* updates ember-basic-dropdown and related deps to fix build issues
* updates basic dropdown instances to new version API
* updates more deps -- ember-template-lint is working again
* runs no-implicit-this codemod
* creates and runs no-quoteless-attributes codemod
* runs angle brackets codemod
* updates lint:hbs globs to only touch hbs files
* removes yield only templates
* creates and runs deprecated args transform
* supresses lint error for invokeAction on LinkTo component
* resolves remaining ambiguous path lint errors
* resolves simple-unless lint errors
* adds warnings for deprecated tagName arg on LinkTo components
* adds warnings for remaining curly component invocation
* updates global template lint rules
* resolves remaining template lint errors
* disables some ember specfic lint rules that target pre octane patterns
* js lint fix run
* resolves remaining js lint errors
* fixes test run
* adds npm-run-all dep
* fixes test attribute issues
* fixes console acceptance tests
* fixes tests
* adds yield only wizard/tutorial-active template
* fixes more tests
* attempts to fix more flaky tests
* removes commented out settled in transit test
* updates deprecations workflow and adds initializer to filter by version
* updates flaky policies acl old test
* updates to flaky transit test
* bumps ember deps down to LTS version
* runs linters after main merge
* fixes client count tests after bad merge conflict fixes
* fixes client count history test
* more updates to lint config
* another round of hbs lint fixes after extending stylistic rule
* updates lint-staged commands
* removes indent eslint rule since it seems to break things
* fixes bad attribute in transform-edit-form template
* test fixes
* fixes enterprise tests
* adds changelog
* removes deprecated ember-concurrency-test-waiters dep and adds @ember/test-waiters
* flaky test fix
Co-authored-by: hashishaw <cshaw@hashicorp.com>
This way we can have an OSS action, and an ENT action. We'll be able to
keep the backport-assistant workflows the same on OSS and ENT for normal
PRs, and have a separate labeling system on OSS for docs backports.
We should delete the backport-docs.yml file on ENT.
* feat: add `backport.yml`
* feat: check releases over labels for latest
* chore: Do not automerge for non `stable-website`
* chore: Do not automerge to not `stable-website`
* Update .github/workflows/backport.yml
Co-authored-by: Meggie <meggie@hashicorp.com>
Co-authored-by: Meggie <meggie@hashicorp.com>
* Add allowed_uri_sans_template
Enables identity templating for the allowed_uri_sans field in PKI cert roles.
Implemented as suggested in #8509
* changelog++
* Update docs with URI SAN templating
* github auth: use org id to verify creds
* add check for required org param; add test case
* update UTs
* add nil check for org
* add changelog
* fix typo in ut
* set org ID if it is unset; add more ut coverage
* add optional organization_id
* move client instantiation
* refactor parse URL; add UT for setting org ID
* fix comment in UT
* add nil check
* don't update org name on change; return warning
* refactor verifyCredentials
* error when unable to fetch org ID on config write; add warnings
* fix bug in log message
* update UT and small refactor
* update comments and log msg
* use getter for org ID
* Allow universal default for key_bits
This allows the key_bits field to take a universal default value, 0,
which, depending on key_type, gets adjusted appropriately into a
specific default value (rsa->2048, ec->256, ignored under ed25519).
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Handle universal default key size in certutil
Also move RSA < 2048 error message into certutil directly, instead of in
ca_util/path_roles.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add missing RSA key sizes to pki/backend_test.go
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Switch to returning updated values
When determining the default, don't pass in pointer types, but instead
return the newly updated value.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add changelog entry
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Re-add fix for ed25519 from #13254
Ed25519 internally specifies a hash length; by changing the default from
256 to 0, we fail validation in ValidateSignatureLength(...) unless we
specify the key algorithm.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Support clearing an identity alias' custom_metadata
Previously, an update to an entity alias supported updating the
custom_metadata as long as the update was not empty, which makes it
impossible to clear the metadata values completely.
Fixes:
- empty custom_metadata parameters are honoured on entity alias update
- update related tests
- drop dependency on mapstructure
- reformat with gofumpt
