diff --git a/ui/app/components/secret-engine/configure-ssh.hbs b/ui/app/components/secret-engine/configure-ssh.hbs index 106496d950..6e0b71291b 100644 --- a/ui/app/components/secret-engine/configure-ssh.hbs +++ b/ui/app/components/secret-engine/configure-ssh.hbs @@ -3,84 +3,73 @@ SPDX-License-Identifier: BUSL-1.1 ~}} -
-
- - - {{#unless @model.isNew}} -

- NOTE: You must delete your existing certificate and key before saving new values. -

- {{/unless}} -
+ + + {{#if @model.isNew}} -
- {{#each @model.formFields as |attr|}} - - {{/each}} -
-
-
- - -
- {{#if this.invalidFormAlert}} - - {{/if}} -
+ {{#each @model.formFields as |attr|}} + + {{/each}} +
+ + + + + {{#if this.invalidFormAlert}} + + {{/if}} {{else}} {{! Model is not new and keys have already been created. Require user deletes the keys before creating new ones }} -
-
- -
- -
+

+ NOTE: You must delete your existing certificate and key before saving new values. +

+ +
+ +
+
-
- - - - -
+ + + + {{/if}} \ No newline at end of file diff --git a/ui/app/models/role-ssh.js b/ui/app/models/role-ssh.js index cc370ceb4d..1c9ef8accb 100644 --- a/ui/app/models/role-ssh.js +++ b/ui/app/models/role-ssh.js @@ -40,6 +40,7 @@ const CA_FIELDS = [ 'defaultExtensions', 'allowBareDomains', 'allowSubdomains', + 'allowEmptyPrincipals', 'allowUserKeyIds', 'keyIdFormat', 'notBeforeDuration', @@ -118,6 +119,10 @@ export default Model.extend({ helpText: 'Specifies if host certificates that are requested are allowed to be subdomains of those listed in Allowed Domains', }), + allowEmptyPrincipals: attr('boolean', { + helpText: + 'Allow signing certificates with no valid principals (e.g. any valid principal). For backwards compatibility only. The default of false is highly recommended.', + }), allowUserKeyIds: attr('boolean', { helpText: 'Specifies if users can override the key ID for a signed certificate with the "key_id" field', }), diff --git a/ui/app/models/ssh-sign.js b/ui/app/models/ssh-sign.js index 260eabf2ce..704e8284cc 100644 --- a/ui/app/models/ssh-sign.js +++ b/ui/app/models/ssh-sign.js @@ -30,7 +30,10 @@ export default Model.extend({ label: 'TTL', editType: 'ttl', }), - validPrincipals: attr('string'), + validPrincipals: attr('string', { + helpText: + 'Specifies valid principals, either usernames or hostnames, that the certificate should be signed for. Required unless the role has specified allow_empty_principals.', + }), certType: attr('string', { defaultValue: 'user', label: 'Certificate Type', diff --git a/ui/app/templates/vault/cluster/secrets/backend/sign.hbs b/ui/app/templates/vault/cluster/secrets/backend/sign.hbs index 5a332483d7..55bd222cb8 100644 --- a/ui/app/templates/vault/cluster/secrets/backend/sign.hbs +++ b/ui/app/templates/vault/cluster/secrets/backend/sign.hbs @@ -76,48 +76,41 @@ {{#if this.model.attrs}} - {{#each (take 1 this.model.attrs) as |attr|}} - - {{/each}} + {{#let (find-by "name" "publicKey" this.model.attrs) as |attr|}} + + {{/let}} + {{! valid_principals is required unless allow_empty_principals is true (not recommended) }} + {{#let (find-by "name" "validPrincipals" this.model.attrs) as |attr|}} + + {{/let}} {{#if this.showOptions}}
- {{#each (drop 1 this.model.attrs) as |attr|}} - + {{#each this.model.attrs as |attr|}} + {{! These attrs render above, outside of the "More options" toggle }} + {{#if (not (includes attr.name (array "publicKey" "validPrincipals")))}} + + {{/if}} {{/each}}
{{/if}} {{/if}}
-
- - - - -
+ + + + {{/if}} \ No newline at end of file diff --git a/ui/tests/acceptance/secrets/backend/ssh/roles-test.js b/ui/tests/acceptance/secrets/backend/ssh/roles-test.js index 55c996ffb3..7b49364079 100644 --- a/ui/tests/acceptance/secrets/backend/ssh/roles-test.js +++ b/ui/tests/acceptance/secrets/backend/ssh/roles-test.js @@ -47,6 +47,9 @@ module('Acceptance | ssh | roles', function (hooks) { credsRoute: 'vault.cluster.secrets.backend.sign', async fillInCreate() { await click(GENERAL.inputByAttr('allowUserCertificates')); + await click(GENERAL.toggleGroup('Options')); + // it's recommended to keep allow_empty_principals false, check for testing so we don't have to input an extra field when signing a key + await click(GENERAL.inputByAttr('allowEmptyPrincipals')); }, async fillInGenerate() { await fillIn(GENERAL.inputByAttr('publicKey'), PUB_KEY); diff --git a/ui/tests/helpers/openapi/expected-secret-attrs.js b/ui/tests/helpers/openapi/expected-secret-attrs.js index cd0d3cac83..cf05267582 100644 --- a/ui/tests/helpers/openapi/expected-secret-attrs.js +++ b/ui/tests/helpers/openapi/expected-secret-attrs.js @@ -34,6 +34,13 @@ const ssh = { fieldGroup: 'default', type: 'boolean', }, + allowEmptyPrincipals: { + editType: 'boolean', + fieldGroup: 'default', + helpText: + 'Whether to allow issuing certificates with no valid principals (meaning any valid principal). Exists for backwards compatibility only, the default of false is highly recommended.', + type: 'boolean', + }, allowHostCertificates: { editType: 'boolean', helpText: