295 lines
8.6 KiB
Go
295 lines
8.6 KiB
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: MPL-2.0
|
|
|
|
package consul
|
|
|
|
import (
|
|
"context"
|
|
"encoding/base64"
|
|
"fmt"
|
|
"time"
|
|
|
|
"github.com/hashicorp/vault/sdk/framework"
|
|
"github.com/hashicorp/vault/sdk/logical"
|
|
)
|
|
|
|
func pathListRoles(b *backend) *framework.Path {
|
|
return &framework.Path{
|
|
Pattern: "roles/?$",
|
|
|
|
DisplayAttrs: &framework.DisplayAttributes{
|
|
OperationPrefix: operationPrefixConsul,
|
|
OperationSuffix: "roles",
|
|
},
|
|
|
|
Callbacks: map[logical.Operation]framework.OperationFunc{
|
|
logical.ListOperation: b.pathRoleList,
|
|
},
|
|
}
|
|
}
|
|
|
|
func pathRoles(b *backend) *framework.Path {
|
|
return &framework.Path{
|
|
Pattern: "roles/" + framework.GenericNameRegex("name"),
|
|
|
|
DisplayAttrs: &framework.DisplayAttributes{
|
|
OperationPrefix: operationPrefixConsul,
|
|
OperationSuffix: "role",
|
|
},
|
|
|
|
Fields: map[string]*framework.FieldSchema{
|
|
"name": {
|
|
Type: framework.TypeString,
|
|
Description: "Name of the role.",
|
|
},
|
|
|
|
// The "policy" and "token_type" parameters were deprecated in Consul back in version 1.4.
|
|
// They have been removed from Consul as of version 1.11. Consider removing them here in the future.
|
|
"policy": {
|
|
Type: framework.TypeString,
|
|
Description: `Policy document, base64 encoded. Required
|
|
for 'client' tokens. Required for Consul pre-1.4.`,
|
|
Deprecated: true,
|
|
},
|
|
|
|
"token_type": {
|
|
Type: framework.TypeString,
|
|
Default: "client",
|
|
Description: `Which type of token to create: 'client' or 'management'. If
|
|
a 'management' token, the "policy", "policies", and "consul_roles" parameters are not
|
|
required. Defaults to 'client'.`,
|
|
Deprecated: true,
|
|
},
|
|
|
|
"policies": {
|
|
Type: framework.TypeCommaStringSlice,
|
|
Description: `Use "consul_policies" instead.`,
|
|
Deprecated: true,
|
|
},
|
|
|
|
"consul_policies": {
|
|
Type: framework.TypeCommaStringSlice,
|
|
Description: `List of policies to attach to the token. Either "consul_policies"
|
|
or "consul_roles" are required for Consul 1.5 and above, or just "consul_policies" if
|
|
using Consul 1.4.`,
|
|
},
|
|
|
|
"consul_roles": {
|
|
Type: framework.TypeCommaStringSlice,
|
|
Description: `List of Consul roles to attach to the token. Either "policies"
|
|
or "consul_roles" are required for Consul 1.5 and above.`,
|
|
},
|
|
|
|
"local": {
|
|
Type: framework.TypeBool,
|
|
Description: `Indicates that the token should not be replicated globally
|
|
and instead be local to the current datacenter. Available in Consul 1.4 and above.`,
|
|
},
|
|
|
|
"ttl": {
|
|
Type: framework.TypeDurationSecond,
|
|
Description: "TTL for the Consul token created from the role.",
|
|
},
|
|
|
|
"max_ttl": {
|
|
Type: framework.TypeDurationSecond,
|
|
Description: "Max TTL for the Consul token created from the role.",
|
|
},
|
|
|
|
"lease": {
|
|
Type: framework.TypeDurationSecond,
|
|
Description: `Use "ttl" instead.`,
|
|
Deprecated: true,
|
|
},
|
|
|
|
"consul_namespace": {
|
|
Type: framework.TypeString,
|
|
Description: `Indicates which namespace that the token will be
|
|
created within. Defaults to 'default'. Available in Consul 1.7 and above.`,
|
|
},
|
|
|
|
"partition": {
|
|
Type: framework.TypeString,
|
|
Description: `Indicates which admin partition that the token
|
|
will be created within. Defaults to 'default'. Available in Consul 1.11 and above.`,
|
|
},
|
|
|
|
"service_identities": {
|
|
Type: framework.TypeStringSlice,
|
|
Description: `List of Service Identities to attach to the
|
|
token, separated by semicolons. Available in Consul 1.5 or above.`,
|
|
},
|
|
|
|
"node_identities": {
|
|
Type: framework.TypeStringSlice,
|
|
Description: `List of Node Identities to attach to the
|
|
token. Available in Consul 1.8.1 or above.`,
|
|
},
|
|
},
|
|
|
|
Callbacks: map[logical.Operation]framework.OperationFunc{
|
|
logical.ReadOperation: b.pathRolesRead,
|
|
logical.UpdateOperation: b.pathRolesWrite,
|
|
logical.DeleteOperation: b.pathRolesDelete,
|
|
},
|
|
}
|
|
}
|
|
|
|
func (b *backend) pathRoleList(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
|
|
entries, err := req.Storage.List(ctx, "policy/")
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return logical.ListResponse(entries), nil
|
|
}
|
|
|
|
func (b *backend) pathRolesRead(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
|
|
name := d.Get("name").(string)
|
|
|
|
entry, err := req.Storage.Get(ctx, "policy/"+name)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if entry == nil {
|
|
return nil, nil
|
|
}
|
|
|
|
var roleConfigData roleConfig
|
|
if err := entry.DecodeJSON(&roleConfigData); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
if roleConfigData.TokenType == "" {
|
|
roleConfigData.TokenType = "client"
|
|
}
|
|
|
|
// Generate the response
|
|
resp := &logical.Response{
|
|
Data: map[string]interface{}{
|
|
"lease": int64(roleConfigData.TTL.Seconds()),
|
|
"ttl": int64(roleConfigData.TTL.Seconds()),
|
|
"max_ttl": int64(roleConfigData.MaxTTL.Seconds()),
|
|
"token_type": roleConfigData.TokenType,
|
|
"local": roleConfigData.Local,
|
|
"consul_namespace": roleConfigData.ConsulNamespace,
|
|
"partition": roleConfigData.Partition,
|
|
},
|
|
}
|
|
if roleConfigData.Policy != "" {
|
|
resp.Data["policy"] = base64.StdEncoding.EncodeToString([]byte(roleConfigData.Policy))
|
|
}
|
|
if len(roleConfigData.Policies) > 0 {
|
|
resp.Data["consul_policies"] = roleConfigData.Policies
|
|
}
|
|
if len(roleConfigData.ConsulRoles) > 0 {
|
|
resp.Data["consul_roles"] = roleConfigData.ConsulRoles
|
|
}
|
|
if len(roleConfigData.ServiceIdentities) > 0 {
|
|
resp.Data["service_identities"] = roleConfigData.ServiceIdentities
|
|
}
|
|
if len(roleConfigData.NodeIdentities) > 0 {
|
|
resp.Data["node_identities"] = roleConfigData.NodeIdentities
|
|
}
|
|
|
|
return resp, nil
|
|
}
|
|
|
|
func (b *backend) pathRolesWrite(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
|
|
tokenType := d.Get("token_type").(string)
|
|
policy := d.Get("policy").(string)
|
|
consulPolicies := d.Get("consul_policies").([]string)
|
|
policies := d.Get("policies").([]string)
|
|
roles := d.Get("consul_roles").([]string)
|
|
serviceIdentities := d.Get("service_identities").([]string)
|
|
nodeIdentities := d.Get("node_identities").([]string)
|
|
|
|
switch tokenType {
|
|
case "client":
|
|
if policy == "" && len(policies) == 0 && len(consulPolicies) == 0 &&
|
|
len(roles) == 0 && len(serviceIdentities) == 0 && len(nodeIdentities) == 0 {
|
|
return logical.ErrorResponse(
|
|
"Use either a policy document, a list of policies or roles, or a set of service or node identities, depending on your Consul version"), nil
|
|
}
|
|
case "management":
|
|
default:
|
|
return logical.ErrorResponse("token_type must be \"client\" or \"management\""), nil
|
|
}
|
|
|
|
if len(consulPolicies) == 0 {
|
|
consulPolicies = policies
|
|
}
|
|
|
|
policyRaw, err := base64.StdEncoding.DecodeString(policy)
|
|
if err != nil {
|
|
return logical.ErrorResponse(fmt.Sprintf(
|
|
"Error decoding policy base64: %s", err)), nil
|
|
}
|
|
|
|
var ttl time.Duration
|
|
ttlRaw, ok := d.GetOk("ttl")
|
|
if ok {
|
|
ttl = time.Second * time.Duration(ttlRaw.(int))
|
|
} else {
|
|
leaseParamRaw, ok := d.GetOk("lease")
|
|
if ok {
|
|
ttl = time.Second * time.Duration(leaseParamRaw.(int))
|
|
}
|
|
}
|
|
|
|
var maxTTL time.Duration
|
|
maxTTLRaw, ok := d.GetOk("max_ttl")
|
|
if ok {
|
|
maxTTL = time.Second * time.Duration(maxTTLRaw.(int))
|
|
}
|
|
|
|
name := d.Get("name").(string)
|
|
local := d.Get("local").(bool)
|
|
namespace := d.Get("consul_namespace").(string)
|
|
partition := d.Get("partition").(string)
|
|
entry, err := logical.StorageEntryJSON("policy/"+name, roleConfig{
|
|
Policy: string(policyRaw),
|
|
Policies: consulPolicies,
|
|
ConsulRoles: roles,
|
|
ServiceIdentities: serviceIdentities,
|
|
NodeIdentities: nodeIdentities,
|
|
TokenType: tokenType,
|
|
TTL: ttl,
|
|
MaxTTL: maxTTL,
|
|
Local: local,
|
|
ConsulNamespace: namespace,
|
|
Partition: partition,
|
|
})
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
if err := req.Storage.Put(ctx, entry); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return nil, nil
|
|
}
|
|
|
|
func (b *backend) pathRolesDelete(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
|
|
name := d.Get("name").(string)
|
|
if err := req.Storage.Delete(ctx, "policy/"+name); err != nil {
|
|
return nil, err
|
|
}
|
|
return nil, nil
|
|
}
|
|
|
|
type roleConfig struct {
|
|
Policy string `json:"policy"`
|
|
Policies []string `json:"policies"`
|
|
ConsulRoles []string `json:"consul_roles"`
|
|
ServiceIdentities []string `json:"service_identities"`
|
|
NodeIdentities []string `json:"node_identities"`
|
|
TTL time.Duration `json:"lease"`
|
|
MaxTTL time.Duration `json:"max_ttl"`
|
|
TokenType string `json:"token_type"`
|
|
Local bool `json:"local"`
|
|
ConsulNamespace string `json:"consul_namespace"`
|
|
Partition string `json:"partition"`
|
|
}
|