* Add documentation for Managed Keys
- Add concept, sys/api and pki updates related to managed keys
* Review feedback
- Reworked quite a bit of the existing documentation based on feedback
and a re-reading
- Moved the managed keys out of the concepts section and into the
enterprise section
* Address broken links and a few grammar tweaks
* Add duration/count metrics to PKI issue and revoke flows
* docs, changelog
* tidy
* last tidy
* remove err
* Update callsites
* Simple returns
* Handle the fact that test cases don't have namespaces
* Add mount point to the request
* fmt
* Handle empty mount point, and add it to unit tests
* improvement
* Turns out sign-verbatim is tricky, it can take a role but doesn't have to
* Get around the field schema problem
* Use application/pem-certificate-chain for PEMs
As mentioned in #10948, it appears we're incorrectly using the
`application/pkix-cert` media type for PEM blobs, when
`application/x-pem-file` is more appropriate. Per RFC 5280 Section
4.2.1.13, `application/pkix-crl` is only appropriate when the CRL is in
DER form. Likewise, Section 4.2.2.1 states that `application/pkix-cert`
is only applicable when a single DER certificate is used.
Per recommendation in RFC 8555 ("ACME"), Section 7.4.2 and 9.1, we use
the newer `application/pem-certificate-chain` media type for
certificates. However, this is not applicable for CRLs, so we use fall
back to `application/x-pem-file` for these. Notably, no official IETF
source is present for the latter. On the OpenSSL PKI tutorial
(https://pki-tutorial.readthedocs.io/en/latest/mime.html), this type is
cited as coming from S/MIME's predecessor, PEM, but neither of the main
PEM RFCs (RFC 934, 1421, 1422, 1423, or 1424) mention this type.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add changelog entry
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* updates regex-validator component to optionally show pattern input and adds capture groups support
* adds form-field-label component
* adds autocomplete-input component
* updates kv-object-editor component to yield block for value and glimmerizes
* updates transform template model
* adds transform-advanced-templating component
* updates form-field with child component changes
* updates transform template serializer to handle differences in regex named capture groups
* fixes regex-validator test
* adds changelog entry
* updates for pr review feedback
* reverts kv-object-editor guidFor removal
* Include full chain in /cert/ca_chain response
This allows callers to get the full chain (including issuing
certificates) from a call to /cert/ca_chain. Previously, most endpoints
(including during issuance) do not include the root authority, requiring
an explicit call to /cert/ca to fetch. This allows full chains to be
constructed without without needing multiple calls to the API.
Resolves: #13489
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add test case for full CA issuance
We test three main scenarios:
1. A root-only CA's `/cert/ca_chain`'s `.data.ca_chain` field should
contain only the root,
2. An intermediate CA (with root provide) should contain both the root
and the intermediate.
3. An external (e.g., `/config/ca`-provided) CA with both root and
intermediate should contain both certs.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add documentation for new ca_chain field
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add changelog entry
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add note about where to find the entire chain
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add check for OIDC provider to permit a non-exact redirect URI from OIDC client if it is the IPv4 or IPv6 loopback address.
* Update changelog/13871.txt
Co-authored-by: Austin Gebauer <34121980+austingebauer@users.noreply.github.com>
* Update redirectURI check to match that for the OIDC auth method.
Co-authored-by: Austin Gebauer <34121980+austingebauer@users.noreply.github.com>
This resolves a rendering issue in the Azure API documentation which caused a section to be rendered in its raw markdown form instead of the rich documentation that was expected.
Seal wrap storage entries of the ManagedKeyRegistry.
Specify the managed key registry's path in SealWrapStorage in the SystemBackend.
Enable SealWrap in the system mount entry.
* [api] Add LDAP auth method
This commit adds LDAP to the available Vault API auth methods.
* Add changelog entry for PR 13841
* Obtain password for LDAPAuth from File/EnvVar
* Fix name of package in error message
Adding a note on the parameter necessary for deletion on a key deletion example seems like a good idea.
From my limited research I found other people that had trouble finding the relevant part of the documentation.
Though I'm not sure this is the best wording or formatting for it.
The field "replication_per_mode" was renamed before this feature was
released, but the docs have never been updated. Update the documentation
to present the correct name.
* Switch parse-pki-cert from node-forge to PKI.js
This replaces the implementation of parse-pki-cert to use PKI.js rather
than node-forge for two reasons:
- PKI.js uses Web Crypto rather than maintaining a built-in
implementation of several algorithms.
- node-forge presently lacks support for ECDSA and Ed25519
certificates.
Related: #13680
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add dependency on PKI.js
$ yarn add -D asn1js pvutils pkijs
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Remove dependency on node-forge
$ yarn remove node-forge
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add changelog entry
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
Added an example to explicitly show how to perform a Rekey operation when the Vault cluster is using Auto Unseal. This is placed as the second example.
The existing example code combines with the PGP keys so added a simple example without the PGP keys.
* adding docs for the framework Required field
* minor fix
* Update sdk/framework/backend.go
Co-authored-by: Jim Kalafut <jkalafut@hashicorp.com>
Co-authored-by: Jim Kalafut <jkalafut@hashicorp.com>
* Make backport assistant work with ENT backport tags
I want the regexp to include word characters and the plus sign on
enterprise. I'm confused about the levels of escaping required, because
this is a shell env var that gets passed to a go program as a regular
expression. I didn't escape the square brackets because the parens
weren't escaped. I matched what was done previously with the '.'s for
the '+' because I also want that literal, but it was unclear from
playing around with https://regex101.com/ and go regexps whether the
extra backslashes were required for the '+' char.
* Update .github/workflows/backport.yml
Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>
Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>
* add timestamp to attribution
* create usage stat component
* updates stat text boxes
* remove flex-header css
* remove comment
* add empty state if no data
* update monthly serializer
* remove empty state - unnecessary
* change tab to 'history'
* add usage stats to history view
* change css styling for upcased grey subtitle
* correctly exports namespace and auth data
* close modal on download
* test making a service?
* fix monthly attrs
* update csv content format
* remove component and make downloadCsv a service
* update function name
* wip//add warning labels, fixing up current and history tabs
* wip//clean up serializer fix with real data
* fix link styling:
* add conditionals for no data, add warning for 1.9 counting changes
* naming comment
* fix tooltip formatting
* fix number format and consolidate actions
* remove outdated test
* add revokeObjectURL and rename variable
* fix errors and empty state views when no activity data at all
* fix end time error
* fix comment
* return truncating to serializer
* PR review cleanup
* return new object
* setup
* handle current billing period
* handle billing period selection
* clean up
* clean up
* turn serializer to class
* change to classes
* placeholding, handles timezone issues for this.startTime
* put in depen
* fixing timezone issues for endTime
* clean up
* move formating on Get to the adapter. Still need to return formating from Get on serializer
* fix current billing period
* move all inside queryRecord to hit serilaizer
* move to serializer
* clean up
* calendar clean up
* clean up
* fix styling
* small fixes
* small fixes
Co-authored-by: Claire Bontempo <cbontempo@hashicorp.com>
* Support Y10K value in notAfter field when signing non-CA certificates
* Add changelog entry for 13736
* Add test for using not_after parameter for non-CA certificates that are being signed
* Fix CA value for test for not_after value when signing non-CA certs
* Address formatting
* Add changelog file
* Revert changelog entry commit f28b54e7b5ad21144c8a2da942d766e64a332caf
