mirror of
https://github.com/status-im/consul.git
synced 2025-01-10 22:06:20 +00:00
4f2d9a91e5
Does the required dance with the local HTTP endpoint to get the required data for the jwt based auth setup in Azure. Keeps support for 'legacy' mode where all login data is passed on via the auth methods parameters. Refactored check for hardcoded /login fields.
92 lines
3.1 KiB
Go
92 lines
3.1 KiB
Go
package ca
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
"github.com/hashicorp/vault/api"
|
|
|
|
"github.com/hashicorp/consul/agent/structs"
|
|
)
|
|
|
|
// VaultAuthenticator defines the interface for logging into Vault using an auth method.
|
|
type VaultAuthenticator interface {
|
|
// Login to Vault and return a Vault token.
|
|
Login(ctx context.Context, client *api.Client) (*api.Secret, error)
|
|
}
|
|
|
|
// LoginDataGenerator is used to generate the login data for a Vault login API request.
|
|
type LoginDataGeneratorFn func(authMethod *structs.VaultAuthMethod) (map[string]any, error)
|
|
|
|
var _ VaultAuthenticator = (*VaultAuthClient)(nil)
|
|
|
|
// VaultAuthClient is a VaultAuthenticator that logs into Vault through the /auth/<method>/login API.
|
|
type VaultAuthClient struct {
|
|
// AuthMethod holds the configuration for the Vault auth method login.
|
|
AuthMethod *structs.VaultAuthMethod
|
|
// LoginPath is optional and can be used to explicitly set the API path that the client
|
|
// will use for a login request. If it is empty the path will be derived from AuthMethod.MountPath.
|
|
LoginPath string
|
|
// LoginDataGen derives the parameter map containing the data for the login API request.
|
|
// For some auth methods this is needed to transform the AuthMethod.Params into the login data
|
|
// used for the API request.
|
|
LoginDataGen LoginDataGeneratorFn
|
|
}
|
|
|
|
// NewVaultAPIAuthClient creates a VaultAuthClient that uses the Vault API to perform a login.
|
|
func NewVaultAPIAuthClient(authMethod *structs.VaultAuthMethod, loginPath string) *VaultAuthClient {
|
|
if loginPath == "" {
|
|
loginPath = fmt.Sprintf("auth/%s/login", authMethod.MountPath)
|
|
}
|
|
return &VaultAuthClient{
|
|
AuthMethod: authMethod,
|
|
LoginPath: loginPath,
|
|
}
|
|
}
|
|
|
|
// Login performs a Vault login operation and returns the associated Vault token.
|
|
func (c *VaultAuthClient) Login(ctx context.Context, client *api.Client) (*api.Secret, error) {
|
|
var err error
|
|
loginData := c.AuthMethod.Params
|
|
|
|
// If a login data generator is provided then use it to transform the auth method params
|
|
// into the appropriate login data for the API request.
|
|
if c.LoginDataGen != nil {
|
|
loginData, err = c.LoginDataGen(c.AuthMethod)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("aws auth failed to generate login data: %w", err)
|
|
}
|
|
}
|
|
|
|
if ctx == nil {
|
|
ctx = context.Background()
|
|
}
|
|
return client.Logical().WriteWithContext(ctx, c.LoginPath, loginData)
|
|
}
|
|
|
|
func toMapStringString(in map[string]interface{}) (map[string]string, error) {
|
|
out := make(map[string]string, len(in))
|
|
for k, v := range in {
|
|
if s, ok := v.(string); ok {
|
|
out[k] = s
|
|
} else {
|
|
return nil, fmt.Errorf("invalid type for field %s: expected a string but got %T", k, v)
|
|
}
|
|
}
|
|
return out, nil
|
|
}
|
|
|
|
// legacyCheck is used to see if all the parameters needed to /login have been
|
|
// hardcoded in the auth-method's config Parameters field.
|
|
// Note it returns true if any /login specific fields are found (vs. all). This
|
|
// is because the AWS client has multiple possible ways to call /login with
|
|
// different parameters.
|
|
func legacyCheck(params map[string]any, expectedKeys ...string) bool {
|
|
for _, key := range expectedKeys {
|
|
if v, ok := params[key]; ok && v != "" {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|