2020-07-08 08:20:15 +02:00
|
|
|
package vault
|
|
|
|
|
|
|
|
import (
|
2020-11-17 14:49:31 +02:00
|
|
|
"encoding/json"
|
2020-07-08 08:20:15 +02:00
|
|
|
"fmt"
|
|
|
|
"path"
|
|
|
|
"strconv"
|
|
|
|
"strings"
|
2020-11-17 14:49:31 +02:00
|
|
|
"time"
|
2020-07-08 08:20:15 +02:00
|
|
|
|
2020-10-13 14:14:47 +02:00
|
|
|
"github.com/SAP/jenkins-library/pkg/log"
|
2020-07-08 08:20:15 +02:00
|
|
|
"github.com/hashicorp/vault/api"
|
|
|
|
)
|
|
|
|
|
|
|
|
// Client handles communication with Vault
|
|
|
|
type Client struct {
|
|
|
|
lClient logicalClient
|
2020-11-17 14:49:31 +02:00
|
|
|
config *Config
|
|
|
|
}
|
|
|
|
|
|
|
|
// Config contains the vault client configuration
|
|
|
|
type Config struct {
|
|
|
|
*api.Config
|
|
|
|
AppRoleMountPoint string
|
|
|
|
Namespace string
|
2020-07-08 08:20:15 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
// logicalClient interface for mocking
|
|
|
|
type logicalClient interface {
|
|
|
|
Read(string) (*api.Secret, error)
|
2020-11-17 14:49:31 +02:00
|
|
|
Write(string, map[string]interface{}) (*api.Secret, error)
|
2020-07-08 08:20:15 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
// NewClient instantiates a Client and sets the specified token
|
2020-11-17 14:49:31 +02:00
|
|
|
func NewClient(config *Config, token string) (Client, error) {
|
2020-07-08 08:20:15 +02:00
|
|
|
if config == nil {
|
2020-11-17 14:49:31 +02:00
|
|
|
config = &Config{Config: api.DefaultConfig()}
|
2020-07-08 08:20:15 +02:00
|
|
|
}
|
2020-11-17 14:49:31 +02:00
|
|
|
client, err := api.NewClient(config.Config)
|
2020-07-08 08:20:15 +02:00
|
|
|
if err != nil {
|
|
|
|
return Client{}, err
|
|
|
|
}
|
|
|
|
|
2020-11-17 14:49:31 +02:00
|
|
|
if config.Namespace != "" {
|
|
|
|
client.SetNamespace(config.Namespace)
|
2020-07-22 11:15:48 +02:00
|
|
|
}
|
|
|
|
|
2020-07-08 08:20:15 +02:00
|
|
|
client.SetToken(token)
|
2021-02-15 10:48:51 +02:00
|
|
|
log.Entry().Debugf("Login to vault %s in namespace %s successfull", config.Address, config.Namespace)
|
2020-11-17 14:49:31 +02:00
|
|
|
return Client{client.Logical(), config}, nil
|
2020-07-08 08:20:15 +02:00
|
|
|
}
|
|
|
|
|
2020-09-16 14:50:09 +02:00
|
|
|
// NewClientWithAppRole instantiates a new client and obtains a token via the AppRole auth method
|
2020-11-17 14:49:31 +02:00
|
|
|
func NewClientWithAppRole(config *Config, roleID, secretID string) (Client, error) {
|
2020-09-16 14:50:09 +02:00
|
|
|
if config == nil {
|
2020-11-17 14:49:31 +02:00
|
|
|
config = &Config{Config: api.DefaultConfig()}
|
|
|
|
}
|
|
|
|
|
|
|
|
if config.AppRoleMountPoint == "" {
|
|
|
|
config.AppRoleMountPoint = "auth/approle"
|
2020-09-16 14:50:09 +02:00
|
|
|
}
|
|
|
|
|
2020-11-17 14:49:31 +02:00
|
|
|
client, err := api.NewClient(config.Config)
|
2020-09-16 14:50:09 +02:00
|
|
|
if err != nil {
|
|
|
|
return Client{}, err
|
|
|
|
}
|
|
|
|
|
2020-11-17 14:49:31 +02:00
|
|
|
if config.Namespace != "" {
|
|
|
|
client.SetNamespace(config.Namespace)
|
2020-09-16 14:50:09 +02:00
|
|
|
}
|
|
|
|
|
2020-10-13 14:14:47 +02:00
|
|
|
log.Entry().Debug("Using approle login")
|
2020-11-17 14:49:31 +02:00
|
|
|
result, err := client.Logical().Write(path.Join(config.AppRoleMountPoint, "/login"), map[string]interface{}{
|
2020-09-16 14:50:09 +02:00
|
|
|
"role_id": roleID,
|
|
|
|
"secret_id": secretID,
|
|
|
|
})
|
|
|
|
|
|
|
|
if err != nil {
|
|
|
|
return Client{}, err
|
|
|
|
}
|
|
|
|
|
|
|
|
authInfo := result.Auth
|
2020-10-13 14:14:47 +02:00
|
|
|
if authInfo == nil || authInfo.ClientToken == "" {
|
2020-09-16 14:50:09 +02:00
|
|
|
return Client{}, fmt.Errorf("Could not obtain token from approle with role_id %s", roleID)
|
|
|
|
}
|
|
|
|
|
2020-11-17 14:49:31 +02:00
|
|
|
return NewClient(config, authInfo.ClientToken)
|
2020-09-16 14:50:09 +02:00
|
|
|
}
|
|
|
|
|
2020-07-08 08:20:15 +02:00
|
|
|
// GetSecret uses the given path to fetch a secret from vault
|
|
|
|
func (v Client) GetSecret(path string) (*api.Secret, error) {
|
|
|
|
path = sanitizePath(path)
|
|
|
|
c := v.lClient
|
|
|
|
|
|
|
|
secret, err := c.Read(path)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
return secret, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// GetKvSecret reads secret from the KV engine.
|
|
|
|
// It Automatically transforms the logical path to the HTTP API Path for the corresponding KV Engine version
|
|
|
|
func (v Client) GetKvSecret(path string) (map[string]string, error) {
|
|
|
|
path = sanitizePath(path)
|
|
|
|
mountpath, version, err := v.getKvInfo(path)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
if version == 2 {
|
|
|
|
path = addPrefixToKvPath(path, mountpath, "data")
|
|
|
|
} else if version != 1 {
|
|
|
|
return nil, fmt.Errorf("KV Engine in version %d is currently not supported", version)
|
|
|
|
}
|
|
|
|
|
|
|
|
secret, err := v.GetSecret(path)
|
|
|
|
if secret == nil || err != nil {
|
|
|
|
return nil, err
|
|
|
|
|
|
|
|
}
|
|
|
|
var rawData interface{}
|
|
|
|
switch version {
|
|
|
|
case 1:
|
|
|
|
rawData = secret.Data
|
|
|
|
case 2:
|
|
|
|
var ok bool
|
|
|
|
rawData, ok = secret.Data["data"]
|
|
|
|
if !ok {
|
|
|
|
return nil, fmt.Errorf("Missing 'data' field in response: %v", rawData)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
data, ok := rawData.(map[string]interface{})
|
|
|
|
if !ok {
|
|
|
|
return nil, fmt.Errorf("Excpected 'data' field to be a map[string]interface{} but got %T instead", rawData)
|
|
|
|
}
|
|
|
|
|
|
|
|
secretData := make(map[string]string, len(data))
|
|
|
|
for k, v := range data {
|
|
|
|
valueStr, ok := v.(string)
|
2020-11-17 14:49:31 +02:00
|
|
|
if ok {
|
|
|
|
secretData[k] = valueStr
|
2020-07-08 08:20:15 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
return secretData, nil
|
|
|
|
}
|
|
|
|
|
2020-11-17 14:49:31 +02:00
|
|
|
// GenerateNewAppRoleSecret creates a new secret-id
|
|
|
|
func (v *Client) GenerateNewAppRoleSecret(secretID, appRoleName string) (string, error) {
|
|
|
|
appRolePath := v.getAppRolePath(appRoleName)
|
|
|
|
secretIDData, err := v.lookupSecretID(secretID, appRolePath)
|
|
|
|
if err != nil {
|
|
|
|
return "", err
|
|
|
|
}
|
|
|
|
|
|
|
|
reqPath := sanitizePath(path.Join(appRolePath, "/secret-id"))
|
|
|
|
|
|
|
|
// we preserve metadata which was attached to the secret-id
|
|
|
|
json, err := json.Marshal(secretIDData["metadata"])
|
|
|
|
if err != nil {
|
|
|
|
return "", err
|
|
|
|
}
|
|
|
|
secret, err := v.lClient.Write(reqPath, map[string]interface{}{
|
|
|
|
"metadata": string(json),
|
|
|
|
})
|
|
|
|
|
|
|
|
if err != nil {
|
|
|
|
return "", err
|
|
|
|
}
|
|
|
|
|
|
|
|
if secret == nil || secret.Data == nil {
|
|
|
|
return "", fmt.Errorf("Could not generate new approle secret-id for approle path %s", reqPath)
|
|
|
|
}
|
|
|
|
|
|
|
|
secretIDRaw, ok := secret.Data["secret_id"]
|
|
|
|
if !ok {
|
|
|
|
return "", fmt.Errorf("Vault response for path %s did not contain a new secret-id", reqPath)
|
|
|
|
}
|
|
|
|
|
|
|
|
newSecretID, ok := secretIDRaw.(string)
|
|
|
|
if !ok {
|
|
|
|
return "", fmt.Errorf("New secret-id from approle path %s has an unexpected type %T expected 'string'", reqPath, secretIDRaw)
|
|
|
|
}
|
|
|
|
|
|
|
|
return newSecretID, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// GetAppRoleSecretIDTtl returns the remaining time until the given secret-id expires
|
|
|
|
func (v *Client) GetAppRoleSecretIDTtl(secretID, roleName string) (time.Duration, error) {
|
|
|
|
appRolePath := v.getAppRolePath(roleName)
|
|
|
|
data, err := v.lookupSecretID(secretID, appRolePath)
|
|
|
|
if err != nil {
|
|
|
|
return 0, err
|
|
|
|
}
|
|
|
|
|
|
|
|
if data == nil || data["expiration_time"] == nil {
|
|
|
|
return 0, fmt.Errorf("Could not load secret-id information from path %s", appRolePath)
|
|
|
|
}
|
|
|
|
|
|
|
|
expiration, ok := data["expiration_time"].(string)
|
|
|
|
if !ok || expiration == "" {
|
|
|
|
return 0, fmt.Errorf("Could not handle get expiration time for secret-id from path %s", appRolePath)
|
|
|
|
}
|
|
|
|
|
|
|
|
expirationDate, err := time.Parse(time.RFC3339, expiration)
|
|
|
|
|
|
|
|
if err != nil {
|
|
|
|
return 0, err
|
|
|
|
}
|
|
|
|
|
|
|
|
ttl := expirationDate.Sub(time.Now())
|
|
|
|
if ttl < 0 {
|
|
|
|
return 0, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
return ttl, nil
|
|
|
|
}
|
|
|
|
|
2021-03-10 09:36:50 +02:00
|
|
|
// RevokeToken revokes the token which is currently used.
|
|
|
|
// The client can't be used anymore after this function was called.
|
|
|
|
func (v Client) RevokeToken() error {
|
|
|
|
_, err := v.lClient.Write("auth/token/revoke-self", map[string]interface{}{})
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
// MustRevokeToken same as RevokeToken but the programm is terminated with an error if this fails.
|
|
|
|
// Should be used in defer statements only.
|
|
|
|
func (v Client) MustRevokeToken() {
|
|
|
|
if err := v.RevokeToken(); err != nil {
|
|
|
|
log.Entry().WithError(err).Fatal("Could not revoke token")
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-11-17 14:49:31 +02:00
|
|
|
// GetAppRoleName returns the AppRole role name which was used to authenticate.
|
|
|
|
// Returns "" when AppRole authentication wasn't used
|
|
|
|
func (v *Client) GetAppRoleName() (string, error) {
|
|
|
|
const lookupPath = "auth/token/lookup-self"
|
|
|
|
secret, err := v.GetSecret(lookupPath)
|
|
|
|
if err != nil {
|
|
|
|
return "", err
|
|
|
|
}
|
|
|
|
|
|
|
|
if secret.Data == nil {
|
|
|
|
return "", fmt.Errorf("Could not lookup token information: %s", lookupPath)
|
|
|
|
}
|
|
|
|
|
|
|
|
meta, ok := secret.Data["meta"]
|
|
|
|
|
|
|
|
if !ok {
|
|
|
|
return "", fmt.Errorf("Token info did not contain metadata %s", lookupPath)
|
|
|
|
}
|
|
|
|
|
|
|
|
metaMap, ok := meta.(map[string]interface{})
|
|
|
|
|
|
|
|
if !ok {
|
|
|
|
return "", fmt.Errorf("Token info field 'meta' is not a map: %s", lookupPath)
|
|
|
|
}
|
|
|
|
|
|
|
|
roleName := metaMap["role_name"]
|
|
|
|
|
|
|
|
if roleName == nil {
|
|
|
|
return "", nil
|
|
|
|
}
|
|
|
|
|
|
|
|
roleNameStr, ok := roleName.(string)
|
|
|
|
if !ok {
|
|
|
|
// when approle authentication is not used vault admins can use the role_name field with other type
|
|
|
|
// so no error in this case
|
|
|
|
return "", nil
|
|
|
|
}
|
|
|
|
|
|
|
|
return roleNameStr, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// SetAppRoleMountPoint sets the path under which the approle auth backend is mounted
|
|
|
|
func (v *Client) SetAppRoleMountPoint(appRoleMountpoint string) {
|
|
|
|
v.config.AppRoleMountPoint = appRoleMountpoint
|
|
|
|
}
|
|
|
|
|
|
|
|
func (v *Client) getAppRolePath(roleName string) string {
|
|
|
|
appRoleMountPoint := v.config.AppRoleMountPoint
|
|
|
|
if appRoleMountPoint == "" {
|
|
|
|
appRoleMountPoint = "auth/approle"
|
|
|
|
}
|
|
|
|
return path.Join(appRoleMountPoint, "role", roleName)
|
|
|
|
}
|
|
|
|
|
|
|
|
func sanitizePath(path string) string {
|
|
|
|
path = strings.TrimSpace(path)
|
|
|
|
path = strings.TrimPrefix(path, "/")
|
|
|
|
path = strings.TrimSuffix(path, "/")
|
|
|
|
return path
|
|
|
|
}
|
|
|
|
|
2020-07-08 08:20:15 +02:00
|
|
|
func addPrefixToKvPath(p, mountPath, apiPrefix string) string {
|
|
|
|
switch {
|
|
|
|
case p == mountPath, p == strings.TrimSuffix(mountPath, "/"):
|
|
|
|
return path.Join(mountPath, apiPrefix)
|
|
|
|
default:
|
|
|
|
p = strings.TrimPrefix(p, mountPath)
|
|
|
|
return path.Join(mountPath, apiPrefix, p)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func (v *Client) getKvInfo(path string) (string, int, error) {
|
|
|
|
secret, err := v.GetSecret("sys/internal/ui/mounts/" + path)
|
|
|
|
if err != nil {
|
|
|
|
return "", 0, err
|
|
|
|
}
|
|
|
|
|
|
|
|
if secret == nil {
|
|
|
|
return "", 0, fmt.Errorf("Failed to get version and engine mountpoint for path: %s", path)
|
|
|
|
}
|
|
|
|
|
|
|
|
var mountPath string
|
|
|
|
if mountPathRaw, ok := secret.Data["path"]; ok {
|
|
|
|
mountPath = mountPathRaw.(string)
|
|
|
|
}
|
|
|
|
|
|
|
|
options := secret.Data["options"]
|
|
|
|
if options == nil {
|
|
|
|
return mountPath, 1, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
versionRaw := options.(map[string]interface{})["version"]
|
|
|
|
if versionRaw == nil {
|
|
|
|
return mountPath, 1, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
version := versionRaw.(string)
|
|
|
|
if version == "" {
|
|
|
|
return mountPath, 1, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
vNumber, err := strconv.Atoi(version)
|
|
|
|
if err != nil {
|
|
|
|
return mountPath, 0, err
|
|
|
|
}
|
|
|
|
|
|
|
|
return mountPath, vNumber, nil
|
|
|
|
}
|
|
|
|
|
2020-11-17 14:49:31 +02:00
|
|
|
func (v *Client) lookupSecretID(secretID, appRolePath string) (map[string]interface{}, error) {
|
|
|
|
reqPath := sanitizePath(path.Join(appRolePath, "/secret-id/lookup"))
|
|
|
|
secret, err := v.lClient.Write(reqPath, map[string]interface{}{
|
|
|
|
"secret_id": secretID,
|
|
|
|
})
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
return secret.Data, nil
|
2020-07-08 08:20:15 +02:00
|
|
|
}
|