vishalnayak
ef97199360
Added JSON Decode and Encode helpers.
...
Changed all the occurances of Unmarshal to use the helpers.
Fixed http/ package tests.
2016-07-06 12:25:40 -04:00
vishalnayak
efaffa8f55
Added 'sys/auth/<path>/tune' endpoints.
...
Displaying 'Default TTL' and 'Max TTL' in the output of 'vault auth -methods'
2016-06-15 13:58:24 -04:00
Jeff Mitchell
47dc1ccd25
Add token accessor to wrap information if one exists
2016-06-13 23:58:17 +00:00
Jeff Mitchell
15a40fdde5
Add explicit max TTL capability to token creation API
2016-06-08 14:49:48 -04:00
Jeff Mitchell
517571c04a
Add renewable flag and API setting for token creation
2016-06-08 11:14:30 -04:00
Jeff Mitchell
8dffc64388
Use time.Time which does RFC3339 across the wire to handle time zones. Arguably we should change the API to always do this...
2016-06-07 16:01:09 -04:00
Jeff Mitchell
91053b7471
Add creation time to returned wrapped token info
...
This makes it easier to understand the expected lifetime without a
lookup call that uses the single use left on the token.
This also adds a couple of safety checks and for JSON uses int, rather
than int64, for the TTL for the wrapped token.
2016-06-07 15:00:35 -04:00
Jeff Mitchell
6a2ad76035
Make Unwrap a first-party API command and refactor UnwrapCommand to use it
2016-05-27 21:04:30 +00:00
Jeff Mitchell
810e914730
Add unwrap test function and some robustness around paths for the wrap lookup function
2016-05-19 11:49:46 -04:00
Jeff Mitchell
b626bfa725
Address most review feedback. Change responses to multierror to better return more useful values when there are multiple errors
2016-05-16 16:11:33 -04:00
Jeff Mitchell
fd67b15bb0
Add more tests
2016-05-07 21:08:13 -04:00
Jeff Mitchell
a110f6cae6
Merge branch 'master-oss' into cubbyhole-the-world
2016-05-04 14:42:14 -04:00
Jeff Mitchell
d3f1176e03
Switch our tri-copy ca loading code to go-rootcerts
2016-05-03 12:23:25 -04:00
Jeff Mitchell
ff4dc0b853
Add wrap support to API/CLI
2016-05-02 02:03:23 -04:00
Jeff Mitchell
b44d2c01c0
Use UseNumber() on json.Decoder to have numbers be json.Number objects
...
instead of float64. This fixes some display bugs.
2016-04-20 18:38:20 +00:00
Adam Shannon
e0df8e9e88
all: Cleanup from running go vet
2016-04-13 14:38:29 -05:00
Jeff Mitchell
254023f55c
Remove RevokePrefix from the API too as we simply do not support it any
...
longer.
2016-04-05 11:00:12 -04:00
Jeff Mitchell
ab93e3aa63
SealInterface
2016-04-04 10:44:22 -04:00
vishalnayak
f97b2e5648
Enable callbacks for handling logical.Request changes before processing requests
2016-03-17 22:29:53 -04:00
vishalnayak
aa0cef3564
Fixed capabilities API to receive logical response
2016-03-17 21:03:32 -04:00
vishalnayak
b812ea1203
Refactoring the capabilities function
2016-03-17 21:03:32 -04:00
vishalnayak
bac4fe0799
Rename id to path and path to file_path, print audit backend paths
2016-03-14 17:15:07 -04:00
Vishal Nayak
640b3b25c5
Merge pull request #1201 from hashicorp/accessor-cli-flags
...
Accessor CLI flags
2016-03-11 09:55:45 -05:00
vishalnayak
f8749bcbdd
Restore RevokeSelf API
2016-03-11 06:30:45 -05:00
vishalnayak
1612dfaa1f
Added accessor flag to token-revoke CLI
2016-03-10 21:21:20 -05:00
vishalnayak
82a9fa86ad
Add accessor flag to token-lookup command and add lookup-accessor client API
2016-03-10 21:21:20 -05:00
Seth Vargo
d88b83d212
Validate HCL for SSHHelper too
2016-03-10 16:47:46 -05:00
Jeff Mitchell
8b6df2a1a4
Merge branch 'master' into token-roles
2016-03-09 17:23:34 -05:00
Jeff Mitchell
2a698c7786
Merge pull request #1168 from hashicorp/revoke-force
...
Add forced revocation.
2016-03-09 16:59:52 -05:00
vishalnayak
2a35de81dc
AccessorID --> Accessor, accessor_id --> accessor
2016-03-09 06:23:31 -05:00
vishalnayak
38a5d75caa
Introduced AccessorID in TokenEntry and returning it along with token
2016-03-08 14:06:10 -05:00
Jeff Mitchell
c4124bc40a
Merge branch 'master' into token-roles
2016-03-07 10:03:54 -05:00
vishalnayak
7f832f22aa
refactoring changes due to acl.Capabilities
2016-03-04 18:55:48 -05:00
vishalnayak
a7cfc9cc7a
Removing the 'Message' field
2016-03-04 10:36:03 -05:00
vishalnayak
f00261785a
Handled root token use case
2016-03-04 10:36:03 -05:00
vishalnayak
ed3e2c6c05
Added sys/capabililties endpoint
2016-03-04 10:36:02 -05:00
Jeff Mitchell
5f0beb7330
Create a unified function to sanitize mount paths.
...
This allows mount paths to start with '/' in addition to ensuring they
end in '/' before leaving the system backend.
2016-03-03 13:13:47 -05:00
Jeff Mitchell
a520728263
Merge pull request #1146 from hashicorp/step-down
...
Provide 'sys/step-down' and 'vault step-down'
2016-03-03 12:30:08 -05:00
Jeff Mitchell
f3f30022d0
Add forced revocation.
...
In some situations, it can be impossible to revoke leases (for instance,
if someone has gone and manually removed users created by Vault). This
can not only cause Vault to cycle trying to revoke them, but it also
prevents mounts from being unmounted, leaving them in a tainted state
where the only operations allowed are to revoke (or rollback), which
will never successfully complete.
This adds a new endpoint that works similarly to `revoke-prefix` but
ignores errors coming from a backend upon revocation (it does not ignore
errors coming from within the expiration manager, such as errors
accessing the data store). This can be used to force Vault to abandon
leases.
Like `revoke-prefix`, this is a very sensitive operation and requires
`sudo`. It is implemented as a separate endpoint, rather than an
argument to `revoke-prefix`, to ensure that control can be delegated
appropriately, as even most administrators should not normally have
this privilege.
Fixes #1135
2016-03-03 10:13:59 -05:00
Jeff Mitchell
5883848f60
Add other token role unit tests and some minor other changes.
2016-03-01 12:41:41 -05:00
Jeff Mitchell
c1677c0b55
Initial work on token roles
2016-03-01 12:41:40 -05:00
vishalnayak
9fbfd1aff2
moved the test cert keys to appropriate test-fixtures folder
2016-02-29 15:49:08 -05:00
Jeff Mitchell
2a347d2eb4
Merge branch 'master' into step-down
2016-02-29 11:02:09 -05:00
vishalnayak
48f3f4b5d0
replaced old certs, with new certs generated from PKI backend, containing IP SANs
2016-02-28 22:15:54 -05:00
Jeff Mitchell
6b0c692385
Provide 'sys/step-down' and 'vault step-down'
...
This endpoint causes the node it's hit to step down from active duty.
It's a noop if the node isn't active or not running in HA mode. The node
will wait one second before attempting to reacquire the lock, to give
other nodes a chance to grab it.
Fixes #1093
2016-02-26 19:43:55 -05:00
vishalnayak
9394e5f212
fix api tests
2016-02-26 17:01:40 -05:00
Robert M. Thomson
b906f22fe9
Add VAULT_TLS_SERVER_NAME environment variable
...
If specified, verify a specific server name during TLS negotiation
rather than the server name in the URL.
2016-02-25 17:28:49 +01:00
vishalnayak
26cdd93088
Use tls_skip_verify in vault-ssh-helper
2016-02-23 17:32:49 -05:00
vishalnayak
1e4ee603a7
ssh-helper api changes
2016-02-23 00:16:00 -05:00
Jeff Mitchell
58a2c4d9a0
Return status for rekey/root generation at init time. This mitigates a
...
(very unlikely) potential timing attack between init-ing and fetching
status.
Fixes #1054
2016-02-12 14:24:36 -05:00
