* adds mirage factories for mfa methods and login enforcement
* adds mirage handler for mfa config endpoints
* adds mirage identity manager for uuids
* updates mfa test to use renamed mfaLogin mirage handler
* updates mfa login workflow for push methods (#15214)
* MFA Login Enforcement Model (#15244)
* adds mfa login enforcement model, adapter and serializer
* updates mfa methods to hasMany realtionship and transforms property names
* updates login enforcement adapter to use urlForQuery over buildURL
* Model for mfa method (#15218)
* Model for mfa method
* Added adapter and serializer for mfa method
- Updated mfa method model
- Basic route to handle list view
- Added MFA to access nav
* Show landing page if methods are not configured
* Updated adapter,serializer
- Backend is adding new endpoint to list all the mfa methods
* Updated landing page
- Added MFA diagram
- Created helper to resolve full path for assets like images
* Remove ember assign
* Fixed failing test
* MFA method and enforcement list view (#15353)
* MFA method and enforcement list view
- Added new route for list views
- List mfa methods along with id, type and icon
- Added client side pagination to list views
* Throw error if method id is not present
* MFA Login Enforcement Form (#15410)
* adds mfa login enforcement form and header components and radio card component
* skips login enforcement form tests for now
* adds jsdoc annotations for mfa-login-enforcement-header component
* adds error handling when fetching identity targets in login enforcement form component
* updates radio-card label elements
* MFA Login Enforcement Create and Edit routes (#15422)
* adds mfa login enforcement form and header components and radio card component
* skips login enforcement form tests for now
* updates to login enforcement form to fix issues hydrating methods and targets from model when editing
* updates to mfa-config mirage handler and login enforcement handler
* fixes issue with login enforcement serializer normalizeItems method throwing error on save
* updates to mfa route structure
* adds login enforcement create and edit routes
* MFA Login Enforcement Read Views (#15462)
* adds login enforcement read views
* skip mfa-method-list-item test for now
* MFA method form (#15432)
* MFA method form
- Updated model for form attributes
- Form for editing, creating mfa methods
* Added comments
* Update model for mfa method
* Refactor buildURL in mfa method adapter
* Update adapter to handle mfa create
* Fixed adapter to handle create mfa response
* Sidebranch: MFA end user setup (#15273)
* initial setup of components and route
* fix navbar
* replace parent component with controller
* use auth service to return entity id
* adapter and some error handling:
* clean up adapter and handle warning
* wip
* use library for qrCode generation
* clear warning and QR code display fix
* flow for restart setup
* add documentation
* clean up
* fix warning issue
* handle root user
* remove comment
* update copy
* fix margin
* address comment
* MFA Guided Setup Route (#15479)
* adds mfa method create route with type selection workflow
* updates mfa method create route links to use DocLink component
* MFA Guided Setup Config View (#15486)
* adds mfa guided setup config view
* resets type query param on mfa method create route exit
* hide next button if type is not selected in mfa method create route
* updates to sure correct state when changing mfa method type in guided setup
* Enforcement view at MFA method level (#15485)
- List enforcements for each mfa method
- Delete MFA method if no enforcements are present
- Moved method, enforcement list item component to mfa folder
* MFA Login Enforcement Validations (#15498)
* adds model and form validations for mfa login enforcements
* updates mfa login enforcement validation messages
* updates validation message for mfa login enforcement targets
* adds transition action to configure mfa button on landing page
* unset enforcement on preference change in mfa guided setup workflow
* Added validations for mfa method model (#15506)
* UI/mfa breadcrumbs and small fixes (#15499)
* add active class when on index
* breadcrumbs
* remove box-shadow to match designs
* fix refresh load mfa-method
* breadcrumb create
* add an empty state the enforcements list view
* change to beforeModel
* UI/mfa small bugs (#15522)
* remove pagintion and fix on methods list view
* fix enforcements
* Fix label for value on radio-card (#15542)
* MFA Login Enforcement Component Tests (#15539)
* adds tests for mfa-login-enforcement-header component
* adds tests for mfa-login-enforcement-form component
* Remove default values from mfa method model (#15540)
- use passcode had a default value, as a result it was being sent
with all the mfa method types during save and edit flows..
* UI/mfa small cleanup (#15549)
* data-test-mleh -> data-test-mfa
* Only one label per radio card
* Remove unnecessary async
* Simplify boolean logic
* Make mutation clear
* Revert "data-test-mleh -> data-test-mfa"
This reverts commit 31430df7bb42580a976d082667cb6ed1f09c3944.
* updates mfa login enforcement form to only display auth method types for current mounts as targets (#15547)
* remove token type (#15548)
* remove token type
* conditional param
* removes type from mfa method payload and fixes bug transitioning to method route on save success
* removes punctuation from mfa form error message string match
* updates qr-code component invocation to angle bracket
* Re-trigger CI jobs with empty commit
Co-authored-by: Arnav Palnitkar <arnav@hashicorp.com>
Co-authored-by: Angel Garbarino <Monkeychip@users.noreply.github.com>
Co-authored-by: Chelsea Shaw <82459713+hashishaw@users.noreply.github.com>
Co-authored-by: Michele Degges <mdeggies@gmail.com>
* Fix handling of username_as_alias during LDAP authentication
There is a bug that was introduced in the LDAP authentication method by https://github.com/hashicorp/vault/pull/11000.
It was thought to be backward compatible but has broken a number of users. Later
a new parameter `username_as_alias` was introduced in https://github.com/hashicorp/vault/pull/14324
to make it possible for operators to restore the previous behavior.
The way it is currently working is not completely backward compatible thought
because when username_as_alias is set, a call to GetUserAliasAttributeValue() will
first be made, then this value is completely discarded in pathLogin() and replaced
by the username as expected.
This is an issue because it makes useless calls to the LDAP server and will break
backward compatibility if one of the constraints in GetUserAliasAttributeValue()
is not respected, even though the resulting value will be discarded anyway.
In order to maintain backward compatibility here we have to only call
GetUserAliasAttributeValue() if necessary.
Since this change of behavior was introduced in 1.9, this fix will need to be
backported to the 1.9, 1.10 and 1.11 branches.
* Add changelog
* Add tests
* Format code
* Update builtin/credential/ldap/backend.go
Co-authored-by: Calvin Leung Huang <1883212+calvn@users.noreply.github.com>
* Format and fix declaration
* Reword changelog
Co-authored-by: Calvin Leung Huang <1883212+calvn@users.noreply.github.com>
* Handle client count timezone
- Backend convert the timezone to UTC, to mitigate it's impact sending
start and end date other than 1. Chose 10 and 20 randomly.
* Added changelog
* Add tests for role patching
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Prevent bad issuer names on update
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add documentation on PATCH operations
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add a warning when Issuing Certificate set on a role does not resolve.
* Ivanka's requests - add a warning on deleting issuer or changing it's name.
* Fix nil checks; reduce number of roles to iterate through; only verify roles after migration.
* Fix semgrep failure, ignore roles deleted behind our back.
* Patch functionality for roles
* Make Patch Roles work again, add back patch issuers.
* Add changelog.
* Fix nil-reversion on empty response.
* Panics are bad. don't do that.
* Remove reference to stored license
- Stored license was deprecated in 1.8 and from 1.11 all licenses will be
auto loaded.
* Added changelog
* Remove test for stored license
* Add defensive check in serializer
* No default provider on create, add subText to service_account_file field
* Show empty state if no provider selected -- sorry for all the conditionals
* Button and distribution title styling on key edit
* Fix key distribute empty state permissions
* Don't try to fetch distribution if provider is permissionError
* Use search-select component for provider on distribute component
* Show distribution form errors on page rather than popup
* Add id, label, subtext to input-search for search-select fallback
* Remove created field from provider, default to querying for keys unless capabilities is false
* Fix link to provider from key-edit
* Search select label styling and add subText to fallback
* Refetch model after key rotate
* Create distribution method is task so we can load and disable button
* Move keymgmt to cloud group on mount options
* Key actions are tasks, fix tab active class
* Add isRunning attr to confirm-action which disables confirm button and replaces text with loader
* Fix provider active tab class
* Handle control groups on distribution
* Correctly handle error message on key-edit
* Show loading state on distribute, reload key after distribute
* Clear old validation errors if valid
* Fix tests
* Fix delete url
* Add changelog
* Address PR comments
* kick circle-ci
* Format go file breaking fmt
* Rename old changelog
* Remove resolved TODO
* Return signed ca as part of ca_chain field within sign-intermediate
- When signing a CA certificate we should include it along with the signing CA's CA chain in the response.
* PKI - Add not_before_duration API parameter to:
- Root CA generation
- Intermediate CA generation
- Intermediate CA signing
* Move not_before_duration to addCACommonFields
This gets applied on both root generation and intermediate signing,
which is the correct place to apply this.
Co-authored-by: guysv <sviryguy@gmail.com>
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add changelog entry
Resolves: #10631
Co-authored-by: guysv <sviryguy@gmail.com>
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add test case for root/generate, sign-intermediate
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Update path role description
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add new not_before_duration to relevant docs
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
Co-authored-by: guysv <sviryguy@gmail.com>
* Add leaf not after best practice
Also suggest concrete recommendations for lifetimes of various issuers.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add advice to use a proper CA hierarchy
Also mention name constraints and HSM backing.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add section on safer usage of Roles
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add initial RBAC example for PKI
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add warning on missing AIA info fields
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add changelog:
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
This clarifies a limitation of the FIPS based container images,
to note that due to OpenShift requirements, we need to suggest
ways of disabling mlock or allowing Vault to set mlock.
* remove manipulations of data ranges;
* fix bar aligntment
* consume empty months existing on response
* revert grey bar transformation
* up one more line..
* remove attr
* Add a warning when Issuing Certificate set on a role does not resolve.
* Ivanka's requests - add a warning on deleting issuer or changing it's name.
* reduce number of roles to iterate through; only verify roles after migration. ignore roles deleted behind our back.
Make sure that autopilot is disabled when we step down from active node state. Forward autopilot state requests to the active node. Avoid self-dialing due to stale advertisement.
* CLI: Add ability to display ListResponseWithInfos
The Vault Server API includes a ListResponseWithInfo call, allowing LIST
responses to contain additional information about their keys. This is in
a key=value mapping format (both for each key, to get the additional
metadata, as well as within each metadata).
Expand the `vault list` CLI command with a `-detailed` flag (and env var
VAULT_DETAILED_LISTS) to print this additional metadata. This looks
roughly like the following:
$ vault list -detailed pki/issuers
Keys issuer_name
---- -----------
0cba84d7-bbbe-836a-4ff6-a11b31dc0fb7 n/a
35dfb02d-0cdb-3d35-ee64-d0cd6568c6b0 n/a
382fad1e-e99c-9c54-e147-bb1faa8033d3 n/a
8bb4a793-2ad9-460c-9fa8-574c84a981f7 n/a
8bd231d7-20e2-f21f-ae1a-7aa3319715e7 n/a
9425d51f-cb81-426d-d6ad-5147d092094e n/a
ae679732-b497-ab0d-3220-806a2b9d81ed n/a
c5a44a1f-2ae4-2140-3acf-74b2609448cc utf8
d41d2419-efce-0e36-c96b-e91179a24dc1 something
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Allow detailed printing of LIST responses in JSON
When using the JSON formatter, only the absolute list of keys were
returned. Reuse the `-detailed` flag value for the `-format=json` list
response printer, allowing us to show the complete API response returned
by Vault.
This returns something like the following:
{
"request_id": "e9a25dcd-b67a-97d7-0f08-3670918ef3ff",
"lease_id": "",
"lease_duration": 0,
"renewable": false,
"data": {
"key_info": {
"0cba84d7-bbbe-836a-4ff6-a11b31dc0fb7": {
"issuer_name": ""
},
"35dfb02d-0cdb-3d35-ee64-d0cd6568c6b0": {
"issuer_name": ""
},
"382fad1e-e99c-9c54-e147-bb1faa8033d3": {
"issuer_name": ""
},
"8bb4a793-2ad9-460c-9fa8-574c84a981f7": {
"issuer_name": ""
},
"8bd231d7-20e2-f21f-ae1a-7aa3319715e7": {
"issuer_name": ""
},
"9425d51f-cb81-426d-d6ad-5147d092094e": {
"issuer_name": ""
},
"ae679732-b497-ab0d-3220-806a2b9d81ed": {
"issuer_name": ""
},
"c5a44a1f-2ae4-2140-3acf-74b2609448cc": {
"issuer_name": "utf8"
},
"d41d2419-efce-0e36-c96b-e91179a24dc1": {
"issuer_name": "something"
}
},
"keys": [
"0cba84d7-bbbe-836a-4ff6-a11b31dc0fb7",
"35dfb02d-0cdb-3d35-ee64-d0cd6568c6b0",
"382fad1e-e99c-9c54-e147-bb1faa8033d3",
"8bb4a793-2ad9-460c-9fa8-574c84a981f7",
"8bd231d7-20e2-f21f-ae1a-7aa3319715e7",
"9425d51f-cb81-426d-d6ad-5147d092094e",
"ae679732-b497-ab0d-3220-806a2b9d81ed",
"c5a44a1f-2ae4-2140-3acf-74b2609448cc",
"d41d2419-efce-0e36-c96b-e91179a24dc1"
]
},
"warnings": null
}
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add changelog
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Use field on UI rather than secret.Data
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Only include headers from visitable key_infos
Certain API endpoints return data from non-visitable key_infos, by
virtue of using a hand-rolled response. Limit our headers to those
from visitable key_infos. This means we won't return entire columns with
n/a entries, if no key matches the key_info key that includes that
header.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Use setupEnv sourced detailed info
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Fix changelog environment variable
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Fix broken tests using setupEnv
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Protect against key and issuer name re-use
- While importing keys and issuers verify that the provided name if any has not been used by another key that we did not match against.
- Validate an assumption within the key import api, that we were provided a single key
- Add additional tests on the new key generation and key import handlers.
* Protect key import api end-users from using "default" as a name
- Do not allow end-users to provide the value of default as a name for key imports
as that would lead to weird and wonderful behaviors to the end-user.
* Add missing api-docs for PKI key import
* Warn on empty Subject field for issuers
When generating a root or signing an intermediate certificate, it is
possible to have Vault generate a certificate with an empty Subject.
These don't validate in most TLS implementations well, so add a warning.
Note that non-Common Name fields could be present to make a non-empty
subject, so simply requiring a CommonName isn't strictly the best.
For example:
$ vault write pki/root/generate/exported common_name=""
WARNING! The following warnings were returned from Vault:
* This issuer certificate was generated without a Subject; this makes
it likely that issuing leaf certs with this certificate will cause TLS
validation libraries to reject this certificate.
....
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add changelog
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Remove signature_bits on intermediate generate
This extraneous field wasn't respected during intermediate generation
and it isn't clear that it should be. Strictly, this field, if it were
to exist, would control the CSR's internal signature algorithm (certutil
defaults to the sane SHA-256 here). However, there's little value in
changing this as the signing authority can and probably will override
the final certificate's signature bits value, completely ignoring
whatever was in the provided CSR.
Removing this field will now cause warnings for those providing the
parameter (which already wasn't respected), which is the desired
behavior. No breakage should occur as a result of this change.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add changelog
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* TTL Picker convers to largest unit when value is number
* Initial value for transit auto-rotation period is 30d
* Add auto-rotation check to transit test
* Add changelog
* Add clarifying comment
