vishalnayak
ec1d635769
Add some validation checks
2016-09-28 15:36:02 -04:00
vishalnayak
2964c925d3
Fix the misplaced response warning
2016-09-28 14:20:03 -04:00
vishalnayak
a716e20261
Added testcase to check secret_id_num_uses
2016-09-28 13:58:53 -04:00
vishalnayak
020237779e
Pull out reading and storing of secret ID into separate functions and handle upgrade properly
2016-09-28 12:42:26 -04:00
Laura Bennett
4cfe098ce4
Merge pull request #1931 from hashicorp/cass-consistency
...
Adding consistency into cassandra
2016-09-27 21:12:02 -04:00
Chris Hoffman
10c8024fa3
Adding support for chained intermediate CAs in pki backend ( #1694 )
2016-09-27 17:50:17 -07:00
Laura Bennett
8b41676dbc
minor updates
2016-09-27 20:35:11 -04:00
Laura Bennett
011d65f59c
added parsing at role creation
2016-09-27 16:01:51 -04:00
Laura Bennett
dc4fdf37d7
initial commit for consistency added into cassandra
2016-09-27 13:25:18 -04:00
Mikhail Zholobov
89d2d67a5b
Fix "SecretIDNumUses" in AppRole auth backend
...
There was a typo.
2016-09-27 17:26:52 +03:00
Vishal Nayak
92cb781be9
Merge pull request #1910 from hashicorp/secret-id-cidr-list
...
CIDR restrictions on Secret ID
2016-09-26 10:22:48 -04:00
Vishal Nayak
a31ab07615
Merge pull request #1920 from legal90/fix-approle-delete
...
Fix panic on deleting the AppRole which doesn't exist
2016-09-26 10:05:33 -04:00
Mikhail Zholobov
9667cd9377
Fix panic on deleting the AppRole which doesn't exist
...
#pathRoleDelete should return silently if the specified AppRole doesn't exist
Fixes GH-1919
2016-09-26 16:55:08 +03:00
vishalnayak
c94415d824
Address review feedback from @jefferai
2016-09-26 09:53:24 -04:00
vishalnayak
a83acd402e
Update docs to contain bound_iam_role_arn
2016-09-26 09:37:38 -04:00
vishalnayak
2bd8903cf4
Implemented bound_iam_role_arn constraint
2016-09-23 21:35:36 -04:00
Jim Weber
eebd592f78
Getting role name from the creds path used in revocation
2016-09-23 16:57:08 -04:00
Jim Weber
f56f0b174c
secretCredsRevoke command no longer uses hardcoded query
...
The removal of a user from the db is now handled similar to the
creation. The SQL is read out of a key from the role and then executed
with values substituted for username.
2016-09-23 16:05:49 -04:00
Jim Weber
235d67e451
Added support for a revokeSQL key value pair to the role
2016-09-23 16:00:23 -04:00
Jeff Mitchell
bba2ea63f1
Don't use time.Time in responses. ( #1912 )
...
This fixes #1911 but not directly; it doesn't address the cause of the
panic. However, it turns out that this is the correct fix anyways,
because it ensures that the value being logged is RFC3339 format, which
is what the time turns into in JSON but not the normal time string
value, so what we audit log (and HMAC) matches what we are returning.
2016-09-23 12:32:07 -04:00
vishalnayak
0b233b3fa1
Fix incorrect naming of bound_iam_instance_profile_arn
2016-09-23 11:22:23 -04:00
vishalnayak
fb2f7f27ba
Fix ssh tests
2016-09-22 11:37:55 -04:00
vishalnayak
8ce3fa75ba
Store the CIDR list in the secret ID storage entry.
...
Use the stored information to validate the source address and credential issue time.
Correct the logic used to verify BoundCIDRList on the role.
Reverify the subset requirements between secret ID and role during credential issue time.
2016-09-21 20:19:26 -04:00
vishalnayak
7f89bb5f68
Pass only valid inputs to validation methods
2016-09-21 15:44:54 -04:00
vishalnayak
c93bded97b
Added cidrutil helper
2016-09-21 13:58:32 -04:00
Jeff Mitchell
902067d620
Ensure upgrades have a valid HMAC key
2016-09-21 11:10:57 -04:00
Jeff Mitchell
8482118ac6
Transit and audit enhancements
2016-09-21 10:49:26 -04:00
Chris Hoffman
cd567eb480
Renaming ttl_max -> max_ttl in mssql backend ( #1905 )
2016-09-20 12:39:02 -04:00
Vishal Nayak
ee22bb4f29
Merge pull request #1897 from hashicorp/secret-id-accessor-locks
...
Safely manipulate secret id accessors
2016-09-19 11:37:38 -04:00
vishalnayak
c44f1c9817
s/GetOctalFormatted/GetHexFormatted
2016-09-16 17:47:15 -04:00
Jeff Mitchell
6f6d1f7237
Rename GetOctalFormatted and add serial number to ParsedCertBundle. Basically a noop.
2016-09-16 11:05:43 -04:00
vishalnayak
32a8ab3cc7
Safely manipulate secret id accessors
2016-09-15 18:13:50 -04:00
Vishal Nayak
f3306fdb31
Merge pull request #1886 from hashicorp/approle-upgrade-notes
...
upgrade notes entry for approle constraint and warning on role read
2016-09-15 12:14:01 -04:00
vishalnayak
7d4edbde69
check for nil role
2016-09-15 12:10:40 -04:00
vishalnayak
9fb11c4403
Address review feedback
2016-09-15 11:41:52 -04:00
vishalnayak
55c6c0da73
s/disableReauthenticationNonce/reauthentication-disabled-nonce
2016-09-15 11:29:02 -04:00
vishalnayak
e9c8555d12
Updated docs with nonce usage
2016-09-14 19:31:09 -04:00
vishalnayak
097e6031c6
Added comment
2016-09-14 18:27:35 -04:00
vishalnayak
daf7c63225
Disable reauthentication if nonce is explicitly set to empty
2016-09-14 17:58:00 -04:00
vishalnayak
ddb0639a13
address review feedback
2016-09-14 14:28:02 -04:00
vishalnayak
fb04d06b9b
Remove the client nonce being empty check
2016-09-14 14:28:02 -04:00
vishalnayak
2de4c8bef2
Generate the nonce by default
2016-09-14 14:28:02 -04:00
vishalnayak
5e7e30e33c
address review feedback
2016-09-14 12:08:35 -04:00
vishalnayak
75615d9d56
Use constant time comparisons for client nonce
2016-09-13 20:12:43 -04:00
vishalnayak
dbb3f49438
Address review feedback
2016-09-13 18:30:04 -04:00
Jeff Mitchell
ea4fcb2927
Only use running state for checking if instance is alive. ( #1885 )
...
Fixes #1884
2016-09-13 18:08:05 -04:00
vishalnayak
de334d1688
upgrade notes entry for approle constraint and warning on role read
2016-09-13 17:44:07 -04:00
vishalnayak
166d67c0a8
Ensure at least one constraint on the role
2016-09-13 16:03:15 -04:00
Jeff Mitchell
cf05edaf18
Allow encrypting empty ciphertext values. ( #1881 )
...
Replaces #1874
2016-09-13 12:00:04 -04:00
vishalnayak
f563f38748
Use uuid.GenerateRandomBytes
2016-09-09 14:17:09 -04:00
