open-vault/builtin/credential/userpass/path_user_policies.go
Jeff Mitchell 5435645bb6
Fix upgrade logic with tokenutil (#7026)
If only a non-_token field is provided we don't want to clear out the
Token version of the params, we want to set both. Otherwise we can't
rely on using the Token version of the parameter when creating the Auth
struct.
2019-06-30 14:24:41 -04:00

79 lines
2.1 KiB
Go

package userpass
import (
"context"
"fmt"
"github.com/hashicorp/vault/sdk/framework"
"github.com/hashicorp/vault/sdk/helper/policyutil"
"github.com/hashicorp/vault/sdk/helper/tokenutil"
"github.com/hashicorp/vault/sdk/logical"
)
func pathUserPolicies(b *backend) *framework.Path {
return &framework.Path{
Pattern: "users/" + framework.GenericNameRegex("username") + "/policies$",
Fields: map[string]*framework.FieldSchema{
"username": &framework.FieldSchema{
Type: framework.TypeString,
Description: "Username for this user.",
},
"policies": &framework.FieldSchema{
Type: framework.TypeCommaStringSlice,
Description: tokenutil.DeprecationText("token_policies"),
Deprecated: true,
},
"token_policies": &framework.FieldSchema{
Type: framework.TypeCommaStringSlice,
Description: "Comma-separated list of policies",
},
},
Callbacks: map[logical.Operation]framework.OperationFunc{
logical.UpdateOperation: b.pathUserPoliciesUpdate,
},
HelpSynopsis: pathUserPoliciesHelpSyn,
HelpDescription: pathUserPoliciesHelpDesc,
}
}
func (b *backend) pathUserPoliciesUpdate(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
username := d.Get("username").(string)
userEntry, err := b.user(ctx, req.Storage, username)
if err != nil {
return nil, err
}
if userEntry == nil {
return nil, fmt.Errorf("username does not exist")
}
policiesRaw, ok := d.GetOk("token_policies")
if !ok {
policiesRaw, ok = d.GetOk("policies")
if ok {
userEntry.Policies = policyutil.ParsePolicies(policiesRaw)
userEntry.TokenPolicies = userEntry.Policies
}
} else {
userEntry.TokenPolicies = policyutil.ParsePolicies(policiesRaw)
_, ok = d.GetOk("policies")
if ok {
userEntry.Policies = userEntry.TokenPolicies
} else {
userEntry.Policies = nil
}
}
return nil, b.setUser(ctx, req.Storage, username, userEntry)
}
const pathUserPoliciesHelpSyn = `
Update the policies associated with the username.
`
const pathUserPoliciesHelpDesc = `
This endpoint allows updating the policies associated with the username.
`