Jim Weber
47465e782c
saving role name to the Secret Internal data. Default revoke query added
...
The rolename is now saved to the secret internal data for fetching
later during the user revocation process. No longer deriving the role
name from request path
Added support for default revoke SQL statements that will provide the
same functionality as before. If not revoke SQL statements are provided
the default statements are used.
Cleaned up personal ignores from the .gitignore file
2016-10-02 18:53:16 -04:00
Jeff Mitchell
c748ff322f
Change default TTL from 30 to 32 to accommodate monthly operations ( #1942 )
2016-09-28 18:32:49 -04:00
Laura Bennett
4cfe098ce4
Merge pull request #1931 from hashicorp/cass-consistency
...
Adding consistency into cassandra
2016-09-27 21:12:02 -04:00
Chris Hoffman
10c8024fa3
Adding support for chained intermediate CAs in pki backend ( #1694 )
2016-09-27 17:50:17 -07:00
Laura Bennett
8b41676dbc
minor updates
2016-09-27 20:35:11 -04:00
Laura Bennett
011d65f59c
added parsing at role creation
2016-09-27 16:01:51 -04:00
Laura Bennett
dc4fdf37d7
initial commit for consistency added into cassandra
2016-09-27 13:25:18 -04:00
Vishal Nayak
92cb781be9
Merge pull request #1910 from hashicorp/secret-id-cidr-list
...
CIDR restrictions on Secret ID
2016-09-26 10:22:48 -04:00
Jim Weber
eebd592f78
Getting role name from the creds path used in revocation
2016-09-23 16:57:08 -04:00
Jim Weber
f56f0b174c
secretCredsRevoke command no longer uses hardcoded query
...
The removal of a user from the db is now handled similar to the
creation. The SQL is read out of a key from the role and then executed
with values substituted for username.
2016-09-23 16:05:49 -04:00
Jim Weber
235d67e451
Added support for a revokeSQL key value pair to the role
2016-09-23 16:00:23 -04:00
Jeff Mitchell
bba2ea63f1
Don't use time.Time in responses. ( #1912 )
...
This fixes #1911 but not directly; it doesn't address the cause of the
panic. However, it turns out that this is the correct fix anyways,
because it ensures that the value being logged is RFC3339 format, which
is what the time turns into in JSON but not the normal time string
value, so what we audit log (and HMAC) matches what we are returning.
2016-09-23 12:32:07 -04:00
vishalnayak
fb2f7f27ba
Fix ssh tests
2016-09-22 11:37:55 -04:00
vishalnayak
c93bded97b
Added cidrutil helper
2016-09-21 13:58:32 -04:00
Jeff Mitchell
902067d620
Ensure upgrades have a valid HMAC key
2016-09-21 11:10:57 -04:00
Jeff Mitchell
8482118ac6
Transit and audit enhancements
2016-09-21 10:49:26 -04:00
Chris Hoffman
cd567eb480
Renaming ttl_max -> max_ttl in mssql backend ( #1905 )
2016-09-20 12:39:02 -04:00
Jeff Mitchell
6f6d1f7237
Rename GetOctalFormatted and add serial number to ParsedCertBundle. Basically a noop.
2016-09-16 11:05:43 -04:00
Jeff Mitchell
cf05edaf18
Allow encrypting empty ciphertext values. ( #1881 )
...
Replaces #1874
2016-09-13 12:00:04 -04:00
vishalnayak
f563f38748
Use uuid.GenerateRandomBytes
2016-09-09 14:17:09 -04:00
vishalnayak
70246395d6
Not exposing structs from the backend's package
2016-09-01 11:57:28 -04:00
Jeff Mitchell
201cd2e1f7
Use unexported kdf const names
2016-08-31 07:19:58 -04:00
Jeff Mitchell
9a97f436ef
Use hkdf for transit key derivation for new keys ( #1812 )
...
Use hkdf for transit key derivation for new keys
2016-08-30 16:29:09 -04:00
vishalnayak
8cc5cdb746
STS path field description update
2016-08-30 10:53:21 -04:00
vishalnayak
39b75c6ae9
Added UpdateOperation to logical AWS STS path
2016-08-30 10:30:13 -04:00
Vishal Nayak
fb775993f3
Merge pull request #1804 from hashicorp/issue-1800
...
Mark STS secrets as non-renwable
2016-08-29 11:46:19 -04:00
navinanandaraj
7fbdf927c1
Fixes #1801 Reuse Cassandra session object for create creds ( #1802 )
2016-08-28 17:32:41 -04:00
Jeff Mitchell
9cd4243362
Mark STS secrets as non-renwable
...
Ping #1800
2016-08-28 14:27:56 -04:00
Jeff Mitchell
a542df0173
Derive nonce fully in convergent mode ( #1796 )
...
Ping #1794
2016-08-26 17:01:56 -04:00
Jeff Mitchell
c9aa308804
Use key derivation for convergent nonce. ( #1794 )
...
Use key derivation for convergent nonce.
Fixes #1792
2016-08-26 14:11:03 -04:00
Jeff Mitchell
c2f3c465d3
Decode secret internal data into struct and fix type assertion. ( #1781 )
2016-08-24 15:04:04 -04:00
Jeff Mitchell
68345eb770
Convert to logxi
2016-08-21 18:13:37 -04:00
Jeff Mitchell
357ecb4dfe
gofmt
2016-08-19 16:48:32 -04:00
Jeff Mitchell
6eca449261
Parameter change
...
Both revocation times are UTC so clarify via parameter name that it's just a formatting difference. Also leave as a time.Time here, as it automatically marshals into RFC3339.
2016-08-14 21:43:57 -04:00
Jeff Mitchell
5a12143f16
Cleanup
2016-08-13 11:52:09 -04:00
Jeff Mitchell
f0e0f960ca
Ensure utc value is not zero before adding
2016-08-13 11:50:57 -04:00
Jeff Mitchell
8fd8ae7330
Ensure values to be encoded in a CRL are in UTC. This aligns with the
...
RFC. You might expect Go to ensure this in the CRL generation call,
but...it doesn't.
Fixes #1727
2016-08-13 08:40:09 -04:00
Jeff Mitchell
031437a98f
Fix build
2016-08-08 17:00:59 -04:00
Jeff Mitchell
24bf6fc68e
Address review feedback
2016-08-08 16:30:48 -04:00
Jeff Mitchell
84cd3c20b3
Remove context-as-nonce, add docs, and properly support datakey
2016-08-07 15:53:40 -04:00
Jeff Mitchell
b5858e2237
Add unit tests for convergence in non-context mode
2016-08-07 15:16:36 -04:00
Jeff Mitchell
c7bf73f924
Refactor convergent encryption to make specifying a nonce in addition to context possible
2016-08-05 17:52:44 -04:00
Vincent Batoufflet
38a30a92e3
Fix PKI logical backend email alt_names
2016-08-04 12:10:34 +02:00
Jeff Mitchell
9732c10d03
Add postgres test for block statements
2016-08-03 15:34:50 -04:00
Jeff Mitchell
7d1f0facb8
Add arbitrary string slice parsing.
...
Like the KV function, this supports either separated strings or JSON
strings, base64-encoded or not.
Fixes #1619 in theory.
2016-08-03 14:24:16 -04:00
vishalnayak
ddb6ae18a0
Fix invalid input getting marked as internal error
2016-07-28 16:23:11 -04:00
Jeff Mitchell
4fd83816bf
Add convergence tests to transit backend
2016-07-28 11:30:52 -04:00
Laura Bennett
c6cc73b3bd
Merge pull request #1635 from hashicorp/mysql-idle-conns
...
Added maximum idle connections to mysql to close hashicorp/vault#1616
2016-07-20 15:31:37 -04:00
Jeff Mitchell
6708b5d75f
Set defaults to handle upgrade cases.
...
Ping #1604
2016-07-20 14:07:19 -04:00
Jeff Mitchell
a8a2886538
Merge pull request #1604 from memory/mysql-displayname-2
...
concat role name and token displayname to form mysql username
2016-07-20 14:02:17 -04:00
