Commit graph

14183 commits

Author SHA1 Message Date
Pratyoy Mukhopadhyay d37da52974
Add docs update for counter forwarding to oss (#12998)
* Add docs update for counter forwarding to oss

* Update website/content/api-docs/system/internal-counters.mdx

Co-authored-by: swayne275 <swayne275@gmail.com>

* Revert "Update website/content/api-docs/system/internal-counters.mdx"

This reverts commit 4c433726427c74e1ceef2378413cfe1eced92e9d.

* Revert "Revert "Update website/content/api-docs/system/internal-counters.mdx""

This reverts commit 0d89d734ad56a0943ad138fabbc7ce03f488176c.

Co-authored-by: swayne275 <swayne275@gmail.com>
2021-11-01 21:48:08 -07:00
Alexander Scheel ecfc679283
TLS Documentation Changes (#12940)
* Add note to TLS cipher suite configuration

Ordering is no longer respected and the tls_max_version flag must be
used for this list to be relevant (as TLSv1.3 will ignore the cipher
suite list entirely).

See blog post linked in the docs for more information.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Note that server cipher suite flag is ignored

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add upgrade note about TLS cipher suites

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
2021-11-01 18:14:41 -04:00
Calvin Leung Huang 4a59b4c683
deps: update plugin versions for 1.9 release (#12975)
* deps: update plugin versions for 1.9 release

* deps: update vault-plugin-secrets-azure to v0.11.1

* go get newest version of github.com/pkg/browser

* deps: update vault-plugin-secrets-alicloud v0.10.2

* deps: update vault-plugin-auth-jwt to v0.11.2

* deps: update vault-plugin-auth-gcp to v0.11.2

* Clean up some inflated indirect dep versions

* deps: update vault-plugin-auth-azure to v0.9.2

* deps: re-fetch x/oauth2 to adjust version

* deps: github.com/pkg/browser to v0.0.0-20210911075715-681adbf594b8

Co-authored-by: Ben Ash <bash@hashicorp.com>
Co-authored-by: Jim Kalafut <jkalafut@hashicorp.com>
2021-11-01 14:18:21 -07:00
Pratyoy Mukhopadhyay 0ea9285d77
[VAULT-4034] Only cache non-nil values (#12993)
* Only cache non-nil values

* Add changelog
2021-11-01 13:47:45 -07:00
John-Michael Faircloth 00a1bf37eb
docs: fix mongodb atlas username template doc (#12992) 2021-11-01 15:17:55 -05:00
Scott Miller 33edf1f556
Flip the semantics of the matching key algorithms in sign-self-issued. (#12988)
* Document allow_different_signature_algorithm param

* Flip the semantics of different key types for sign self issued

* More language tweaks

* Fix the field definition description

* Rework differenttype test for the new flag

* typo
2021-11-01 14:42:25 -05:00
Brian Kassouf 0e1b2c1b7b
Fix some more error shadowing issues (#12990) 2021-11-01 11:43:00 -07:00
John-Michael Faircloth 792400a24c
ensure errors are checked (#12989) 2021-11-01 13:34:51 -05:00
Victor Rodriguez c83289f238
Document default value of encode_format field for Transform templates. (#12983) 2021-11-01 13:47:37 -04:00
Meggie 7ca83828c4
Note on pending etcd v2 API deprecation (#12935)
* Note on pending etcd v2 API deprecation

* Updating etcd guidance to include migration
2021-11-01 11:46:28 -04:00
Yoko Hyakuna a681b363ca
Fix reported error (#12973) 2021-10-29 17:05:24 -07:00
Arnav Palnitkar 5444bb5e91
Break line if words are long in flash messages (#12977) 2021-10-29 16:17:03 -07:00
Chelsea Shaw f22572efbf
UI/OIDC namespace support (#12955) 2021-10-29 16:54:15 -05:00
Arnav Palnitkar 4d7e946aa6
On bar chart selection replace search component with HTML (#12964)
* Sync selected namespace between bar chart and search component

- When user selects the namespace from chart, update the selected
  value in search select component
- Clear out the namespace selection when new date is queried

* On bar chart selection, replace search select with custom html
2021-10-29 14:07:00 -07:00
claire bontempo ab1fd3255b
UI/Remove token_type field from token auth method (#12904)
* chane form field to angle bracket syntax

* computes tuneAttrs depending on auth method type

* make all attrs linkable

* delete token_type for token auth methods before save

* adds changelog

* adds copy to unsupported auth methods

* adds doc link to copy

* adds test for linkable auth method list
2021-10-29 13:00:34 -07:00
Guillaume 353e8a312f
Fixed parameter name to match AppRole code (#12963) 2021-10-29 10:10:06 -07:00
claire bontempo 50372d19f8
UI/ Add PostgreSQL DB (#12945)
* alphabetize DB plugin types

* adds changelog

* add postgres to database plugins

* add statement fields

* adds tests for postgres db

* add delete confirm modal to db connection

* fixes text for confirmation modal - transform

* editing tests for delete modal

* fixes tests, oracle must be last DB tested

* adds test for modal and updates old modal tests
2021-10-29 09:58:56 -07:00
Arnav Palnitkar 2d5a1f7ed4
Added date range to client count csv filename (#12960) 2021-10-28 15:05:55 -07:00
Jim Kalafut ee6b81eb43
Add known issue about MSSQL panic (#12961) 2021-10-28 14:46:14 -07:00
swayne275 8d238b8080
just update api (#12956) 2021-10-28 14:03:08 -06:00
Noel Quiles ea9029b88f
website: Add Fathom analytics (#12758)
* Impl Fathom analytics

* Proper Fathom site ID (and prettier edits)

* Use analytics package instead of direct impl

* Upgrade platform analytics package
2021-10-28 12:44:56 -07:00
Theron Voran 4585bdda6b
Update TestServer error string (#12954)
Update the error string expected from parsing unknown units in a
duration.
2021-10-28 11:01:18 -07:00
vinay-gopalan cacc2d00bd
[VAULT-3967] Document CRUD APIs for OIDC provider and scope (#12924) 2021-10-28 10:33:51 -07:00
Angel Garbarino 096d5e14d2
KV alert banner for white space in KV path (#12921)
* alert banner

* changelog

* test coverage

* amend message

* address pr comments

* whoops

* Revert "whoops"

This reverts commit ac832542f031fe2fcce5ec65d6c41c94114cc19d.

* whoops again
2021-10-28 10:50:33 -06:00
Austin Gebauer 83dcbc0cd5
Deny access to UserInfo endpoint if client no longer allowed by provider (#12949) 2021-10-28 09:46:07 -07:00
Austin Gebauer e5b45b5416
Adds check to ensure authorization code can only be exchanged by the issuing provider (#12948) 2021-10-28 09:45:41 -07:00
Jim Kalafut 170421af31
Update parseutil dependency (#12947) 2021-10-28 09:15:42 -07:00
swayne275 849f4f8544
update sdk to 0.3.0 (#12946)
* update sdk to 0.3.0

* vault go mod update
2021-10-28 10:09:58 -06:00
Brian Kassouf 350ecd6bc5
Fix leak of restore worker go routines after an error (#12933) 2021-10-27 09:08:10 -07:00
Tom Proctor 757de2bcee
Run go mod tidy (#12938) 2021-10-27 17:07:55 +01:00
Alexander Scheel 5579394b48
go-kms-wrapping update for Azure Key Vault's Managed HSM offering (#12934)
* Update to hashicorp/go-kms-wrapping@v0.6.8

Co-authored-by: Rachel Culpepper <84159930+rculpepper@users.noreply.github.com>
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add documentation around Managed HSM KeyVault

This introduces the "resource" config parameter and the
AZURE_AD_RESOURCE environment variable from the updated go-kms-wrapping
dependency.

Co-authored-by: Rachel Culpepper <84159930+rculpepper@users.noreply.github.com>
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add changelog entry for g-k-w changes

Includes changes from @stevendpclark.

Co-authored-by: Rachel Culpepper <84159930+rculpepper@users.noreply.github.com>
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

Co-authored-by: Rachel Culpepper <84159930+rculpepper@users.noreply.github.com>
2021-10-27 12:07:18 -04:00
Austin Gebauer b3fab954fe
Use mutex in OIDC configuration handlers (#12932) 2021-10-27 08:23:05 -07:00
Yannick Lorenzati e8f14b451b
CLI: add new -header option to be able to add headers to all cli requests #8754 (#12508) 2021-10-27 11:04:04 -04:00
Ben Ash 6769ab37ea
fix: upgrade vault-plugin-auth-kerberos to v0.5.0 (#12930)
* Update docker helper code to match deps.
* Fix container variable name collides with import.
* Update vault-testing-stepwise to v0.1.2
2021-10-27 10:01:34 -04:00
Tom Proctor 119474e7a2
agent/cache: Store leases in-order in persistent cache so that restore respects dependencies (#12843) 2021-10-27 11:36:48 +01:00
VAL a44505dd06
Native Login method for Go client (#12796)
* Native Login method, userpass and approle interfaces to implement it

* Add AWS auth interface for Login, unexported struct fields for now

* Add Kubernetes client login

* Add changelog

* Add a test for approle client login

* Return errors from LoginOptions, use limited reader for secret ID

* Fix auth comment length

* Return actual type not interface, check for client token in tests

* Require specification of secret ID location using SecretID struct as AppRole arg

* Allow password from env, file, or plaintext

* Add flexibility in how to fetch k8s service token, but still with default

* Avoid passing strings that need to be validated by just having different login options

* Try a couple real tests with approle and userpass login

* Fix method name in comment

* Add context to Login methods, remove comments about certain sources being inherently insecure

* Perform read of secret ID at login time

* Read password from file at login time

* Pass context in integ tests

* Read env var values in at login time, add extra tests

* Update api version

* Revert "Update api version"

This reverts commit 1ef3949497dcf878c47e0e5ffcbc8cac1c3c1679.

* Update api version in all go.mod files
2021-10-26 16:48:48 -07:00
claire bontempo dacbc154af
UI/Client count page bug fixes (#12914)
* fix spacing between bars

* fix month displayed on client count page

* centers tooltip over cursor when page browser fills window

* wraps date.length check in conditional

* adds test to date-format helper

* formats client count numbers

* fixes tooltip miscalculating percent

* fixes config data for monthly mirage endpoint
2021-10-26 16:10:09 -07:00
swayne275 92e6972b86
oss LastDRWAL (#12931) 2021-10-26 15:17:20 -06:00
Chris Capurso 7dcae18641
Update kv custom metadata docs (#12920)
* fix json code block in kv api docs

* add custom_metadata to GET, PUT, PATCH in kv api docs

* add custom_metadata to get, put, and patch in kv CLI docs
2021-10-26 15:41:40 -04:00
Chris Capurso a6b1cbad12
Extend kv metadata to get, put, and patch (#12907)
* go get vault-plugin-secrets-kv@extend-kv-metadata-to-get-and-put

* test for custom_metadata in kv get, put, patch command output

* remove flagFormat-specific check from TestKVMetadataGetCommand

* rewrite custom metadata changelog entry

* go get vault-plugin-secrets-kv@master

* go mod tidy
2021-10-26 15:38:56 -04:00
Guillaume b9b7f5a9a3
Added support for a LDAP user search filter. Documentation, tests and UI included (#11000) 2021-10-26 10:39:12 -07:00
swayne275 559816254b
API Lock CLI OSS port (#12925)
* api lock in oss

* add namespace lock/unlock help
2021-10-26 10:52:29 -06:00
swayne275 0ce5701935
backport error changes from ent PR (#12926) 2021-10-26 10:11:24 -06:00
Hridoy Roy 1d29b93eb5
fix adding clientID to request in audit log (#12919)
* fix adding clientID to request in audit log

* fix boolean statement

* use standard encoding for client ID instead of urlEncoding

* change encoding in tests

* add in client counts to request handling

* remove redundant client ID generation in request handling

* directly add clientID to req after handling token usage
2021-10-26 09:02:13 -07:00
Jim Kalafut c082814dd6
Update CODEOWNERS 2021-10-26 08:19:23 -07:00
Alexander Scheel 6e069e94ca
Fix PKI Weak Cryptographic Key Lenghths Warning (#12886)
* Modernize SSH key lengths

No default change was made in this commit; note that the code already
enforced a default of 2048 bits. ssh-keygen and Go's RSA key generation
allows for key sizes including 3072, 4096, 8192; update the values of
SSH key generation to match PKI's allowed RSA key sizes (from
certutil.ValidateKeyTypeLength(...)). We still allow the legacy SSH key
size of 1024; in the near future we should likely remove it.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Ensure minimum of 2048-bit PKI RSA keys

While the stated path is a false-positive, verifying all paths is
non-trivial. We largely validate API call lengths using
certutil.ValidateKeyTypeLength(...), but ensuring no other path calls
certutil.generatePrivateKey(...) --- directly or indirectly --- is
non-trivial. Thus enforcing a minimum in this method sounds like a sane
compromise.

Resolves: https://github.com/hashicorp/vault/security/code-scanning/55

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
2021-10-26 09:30:09 -04:00
Chris Capurso 509eabbff6
add custom-metadata flag docs for 'vault kv metadata put' cmd (#12729) 2021-10-25 14:08:48 -04:00
Tom Proctor 9ad06611a4
agent: Docs for auto-auth and limited-use tokens (#12918)
There are a number of auth methods that support creating tokens with a limited number of uses. However, Vault Agent doesn't track the uses remaining for its auto-auth token, so it may result in flaky permission denied responses if that limit is hit and Vault Agent remains unaware.
2021-10-25 18:25:24 +01:00
Austin Gebauer a25cfe822e
Adds missing unlock of RWMutex in OIDC delete key (#12916) 2021-10-25 09:59:26 -07:00
swayne275 95e5cdd000
VAULT 2844: remove legacy lease revocation strategy (#12888)
* remove legacy lease revocation strategy

* add deprecation change log note

* remove VAULT_16_REVOKE_PERMITPOOL

* update changelog
2021-10-22 17:37:01 -06:00