696d0c7b1d
Plumb per-mount config options through API
2015-09-10 15:09:53 -04:00
893d2d9b00
Minor cleanup of MountConfig
2015-09-10 15:09:53 -04:00
17c60d3e78
Add logic to core to fetch a SystemView for a given mount entry and use those values for default/max TTL. The SystemView will reflect system defaults if not set for that mount.
2015-09-10 15:09:53 -04:00
98d0d23d70
Ensure token store is available when looking up token
2015-09-01 08:21:47 -04:00
b74fa8c888
Make DefaultSystemView StaticSystemView with statically-configured information. Export this from Framework to make it easy to override for testing.
2015-08-27 11:25:07 -07:00
7c2bbe4c7f
Use a SystemView interface and turn SystemConfig into DefaultSystemView
2015-08-27 10:36:44 -07:00
e58553e7d5
Plumb the system configuration information up into framework
2015-08-27 09:41:03 -07:00
992e357d07
Add some plumbing to allow specified system configuration information to
...
be retrieved by logical backends. First implemented is default/max TTL.
2015-08-27 08:51:35 -07:00
3f45f3f41b
Rename config lease_duration parameters to lease_ttl in line with current standardization efforts
2015-08-27 07:50:24 -07:00
cc232e6f79
Address comments from review.
2015-08-25 15:33:58 -07:00
c887df93cc
Add support for pgp-keys argument to rekey, as well as tests, plus
...
refactor common bits out of init.
2015-08-25 14:52:13 -07:00
f57e7892e7
Don't store the given public keys in the seal config
2015-08-25 14:52:13 -07:00
2f3e245b0b
Add support for "pgp-tokens" parameters to init.
...
There are thorough unit tests that read the returned
encrypted tokens, seal the vault, and unseal it
again to ensure all works as expected.
2015-08-25 14:52:13 -07:00
ea9fbb90bc
Rejig Lease terminology internally; also, put a few JSON names back to their original values
2015-08-20 22:27:01 -07:00
93ef9a54bd
Internally refactor Lease/LeaseGracePeriod into TTL/GracePeriod
2015-08-20 18:00:51 -07:00
0fa783f850
Update help text for TTL values in generic backend
2015-08-20 17:59:30 -07:00
b57ce8e5c2
Change "lease" parameter in the generic backend to be "ttl" to reduce confusion. "lease" is now deprecated but will remain valid until 0.4.
...
Fixes #528 .
2015-08-20 16:41:25 -07:00
15f57082e0
Begin factoring out sys paths into logical routes. Also, standardize on 307 as redirect code.
2015-08-20 13:20:35 -07:00
46d06144a8
Merge pull request #552 from hashicorp/fix-uselimit-decrement
...
Fix #461 properly by defering potential revocation of a token until a…
2015-08-20 10:39:24 -07:00
db79dd8c22
Don't defer revocation when sealing, and clear out response/auth if there is a token use error
2015-08-20 10:37:42 -07:00
0e8e3660ff
Fix #461 properly by defering potential revocation of a token until after the request is fully handled.
2015-08-20 10:14:13 -07:00
1f5062a6e1
Merge branch 'master' of https://github.com/hashicorp/vault into vishalvault
2015-08-19 12:16:37 -07:00
fe8c1c514d
Add -no-verify option to CLI auth command, to avoid decrementing the token use count during auth.
2015-08-18 19:22:17 -07:00
9324db7979
Vault SSH: verify echo test
2015-08-18 16:48:50 -07:00
688df0be6d
See if this clears build error
2015-08-13 13:17:09 -04:00
93dfa67039
Merging changes from master
2015-08-12 09:28:16 -07:00
323b49f03d
Fix #392 by giving a more specific error
2015-08-11 20:18:52 -04:00
4da080e769
This adds a new error class which can be used by logical backends to
...
specify more concrete error cases to make their way back up the stack.
Over time there is probably a cleaner way of doing this, but that's
looking like a more massive rewrite and this solves some issues in
the meantime.
Use a CodedError to return a more concrete HTTP return code for
operations you want to do so. Returning a regular error leaves
the existing behavior in place.
2015-08-10 13:27:25 -04:00
e5080a7f32
Merging with master
2015-08-06 18:44:40 -04:00
151ec72d00
Add configuration options for default lease duration and max lease duration.
2015-07-30 09:42:49 -04:00
27e66e175f
Merge branch 'master' of https://github.com/hashicorp/vault into vishalvault
2015-07-17 17:22:17 -04:00
ef770e371a
vault: guard against potentially missing keyring
2015-07-13 18:18:22 +10:00
ed258f80c6
Vault SSH: Refactoring and fixes
2015-07-10 18:44:31 -06:00
89a0e37a89
Vault SSH: Backend and CLI testing
2015-07-10 16:18:02 -06:00
2901890df2
Merge branch 'master' of https://github.com/hashicorp/vault into vishalvault
2015-07-10 09:56:21 -06:00
3c7dd8611c
Vault SSH: Test case skeleton
2015-07-10 09:56:14 -06:00
7ecd8f05d1
nomad: fixing issue with keyring upgrade
2015-07-07 16:02:49 -06:00
03be7a5999
vault: upgrade old policies with implicit glob
2015-07-05 19:14:15 -06:00
3d2fa8818e
vault: adding another ACL test
2015-07-05 17:34:34 -06:00
dc8cc308af
vault: fixing test with glob change
2015-07-05 17:31:41 -06:00
05b3fa836e
vault: Handle exact vs glob match, deny has highest precedence
2015-07-05 17:31:30 -06:00
eda88c18ff
vault: Adding precedence logic for conflicting policy
2015-07-05 17:30:19 -06:00
27d01270c8
vault: look for glob character in policy
2015-07-05 14:58:38 -07:00
541014e315
logical: remove SetLogger method
2015-06-30 17:39:39 -07:00
41b72a4d39
vault: provide view to backend initializer for setup
2015-06-30 17:30:43 -07:00
579c1433a2
vault: use helper/salt library to share code
2015-06-30 14:08:21 -07:00
8bc99f8c23
helper/uuid: single generateUUID definition
2015-06-30 12:38:32 -07:00
3bc388f30d
Merge pull request #366 from nbrownus/http_responses
...
Better http responses
2015-06-29 15:31:45 -07:00
496ebe561c
vault: cleanups for the audit log changes
2015-06-29 15:27:28 -07:00
add8e1a3fd
Fixing merge conflict
2015-06-29 15:19:04 -07:00
deeb611ab2
vault: handle a panic while generating audit output
2015-06-29 15:11:35 -07:00
a0be7af858
Fixing key-status if audit logging is on
2015-06-24 10:57:05 -07:00
94e89537a1
Fixing tests
2015-06-19 14:04:32 -07:00
31ab086063
Doing a little better with http response codes
2015-06-19 14:00:48 -07:00
91611a32c9
Fixing tests
2015-06-18 20:14:20 -07:00
b667ef4c71
Collapsing audit response logging to a single point
2015-06-18 19:48:26 -07:00
4ec685dc1a
Logging authentication errors and bad token usage
2015-06-18 18:30:18 -07:00
c55f103c58
Adding error and remote_address to audit log lines
2015-06-18 17:17:18 -07:00
e2b0f5dae8
vault: improve lease error message. Fixes #338
2015-06-18 15:37:08 -07:00
dbf6cf6e6d
vault: support core shutdown
2015-06-17 18:23:59 -07:00
ffeb6ea76c
vault: allow increment to be duration string. Fixes #340
2015-06-17 15:58:20 -07:00
5c75a6c5c7
vault: ensure token renew does not double register
2015-06-17 15:22:50 -07:00
ae421f75b7
vault: fixing issues with token renewal
2015-06-17 14:28:13 -07:00
a0cf8f1793
vault: attempt to resolve #303
2015-06-02 22:55:18 +02:00
0f933df76e
vault: fixing a typo
2015-06-02 16:04:05 +02:00
daffef08db
vault: reload master key before keyring
2015-05-29 14:30:03 -07:00
f6729b29f8
vault: adding ability to reload master key
2015-05-29 14:29:55 -07:00
716f8d9979
core: adding tests for HA rekey and rotate
2015-05-29 12:16:34 -07:00
4f5fde039f
vault: all rekey commands should fail as standby
2015-05-29 11:52:37 -07:00
5aaad32af8
vault: ensure upgrades are cleaned up
2015-05-28 16:52:06 -07:00
db0afc9ebe
vault: move upgrade logic out of core
2015-05-28 16:43:44 -07:00
4eb5c63a5d
vault: create upgrade path in HA mode
2015-05-28 16:43:15 -07:00
67ed0a3c16
vault: moving upgrade path into barrier
2015-05-28 16:42:32 -07:00
82ef0b1ac7
vault: handle read of key upgrades
2015-05-28 16:11:31 -07:00
796ae59a89
vault: support keyring reload
2015-05-28 16:09:15 -07:00
2e86fa62d5
vault: adding barrier AddKey
2015-05-28 15:52:26 -07:00
c095861a02
keyring: Add key serialization
2015-05-28 15:49:52 -07:00
c60970e743
vault: prevent rekey on standby
2015-05-28 15:26:35 -07:00
01e890653c
vault: more logging
2015-05-28 14:15:06 -07:00
0877160754
vault: minor rekey cleanups
2015-05-28 12:07:52 -07:00
c5352d14a4
vault: testing rekey
2015-05-28 12:02:30 -07:00
361c722c5c
vault: first pass at rekey
2015-05-28 11:40:01 -07:00
5aed043ea5
vault: ensure master key is copied to avoid memzero issues
2015-05-28 11:38:59 -07:00
4e3f0cddcf
vault: Adding VerifyMaster to Barrier
2015-05-28 11:28:33 -07:00
9f399eb9ff
vault: prevent raw access to protected paths
2015-05-28 10:24:41 -07:00
1a4256c20c
vault: more logging around rotate
2015-05-27 17:56:55 -07:00
d0b93a6164
vault: adding sys/key-status and sys/rotate
2015-05-27 17:53:42 -07:00
26cff2f42f
vault: expose information about keys
2015-05-27 17:25:36 -07:00
3e717907cd
vault: testing barrier rekey
2015-05-27 17:17:03 -07:00
b93feb8a6b
vault: first pass at rekey
2015-05-27 17:13:40 -07:00
9e39fec4a5
vault: testing key rotation
2015-05-27 17:10:08 -07:00
ead96e8c99
vault: first pass at key rotation
2015-05-27 17:05:02 -07:00
3d800fe7be
vault: keyring api changes
2015-05-27 17:04:46 -07:00
490bece0a0
vault: make keyring immutable
2015-05-27 16:58:55 -07:00
28560a612f
vault: test for backwards compatability
2015-05-27 16:42:42 -07:00
e8e9103300
vault: share keyring persistence code
2015-05-27 16:29:59 -07:00
0e9136d14c
vault: first pass at keyring integration
2015-05-27 16:01:25 -07:00
50dc6a471e
vault: adding path for keyring
2015-05-27 15:23:43 -07:00
8c2a767f4f
vault: Adding version to key entry
2015-05-27 15:23:31 -07:00
1903518202
vault: Ensure we always set a key InstallTime
2015-05-27 14:37:40 -07:00
Jeff Mitchell