From c1bc59c36e97903bb14dfa605c4b179d164d0897 Mon Sep 17 00:00:00 2001 From: dani <29378233+kheina@users.noreply.github.com> Date: Fri, 5 Jan 2024 19:38:47 +0100 Subject: [PATCH] enable support for ssh valid certs additional valid principals field (#512) * enable support for ssh valid certs additional valid principals field * chore: Bump Dependencies to 0.14.3 Release --------- Co-authored-by: Danielle Miu <29378233+DanielleMiu@users.noreply.github.com> Co-authored-by: prsekar --- ...redential_library_vault_ssh_certificate.md | 1 + ...redential_library_vault_ssh_certificate.go | 46 +++++++++++++++---- ...tial_library_vault_ssh_certificate_test.go | 12 ++++- 3 files changed, 49 insertions(+), 10 deletions(-) diff --git a/docs/resources/credential_library_vault_ssh_certificate.md b/docs/resources/credential_library_vault_ssh_certificate.md index 843e1c62..bd5d2a5d 100644 --- a/docs/resources/credential_library_vault_ssh_certificate.md +++ b/docs/resources/credential_library_vault_ssh_certificate.md @@ -89,6 +89,7 @@ resource "boundary_credential_library_vault_ssh_certificate" "baz" { ### Optional +- `additional_valid_principals` (List of String) Principals to be signed as "valid_principles" in addition to username. - `critical_options` (Map of String) Specifies a map of the critical options that the certificate should be signed for. - `description` (String) The Vault credential library description. - `extensions` (Map of String) Specifies a map of the extensions that the certificate should be signed for. diff --git a/internal/provider/resource_credential_library_vault_ssh_certificate.go b/internal/provider/resource_credential_library_vault_ssh_certificate.go index 70056553..ac35fc12 100644 --- a/internal/provider/resource_credential_library_vault_ssh_certificate.go +++ b/internal/provider/resource_credential_library_vault_ssh_certificate.go @@ -14,15 +14,16 @@ import ( ) const ( - credentialLibraryVaultSshCertificateType = "vault-ssh-certificate" - credentialLibraryVaultSshCertificatePathKey = "path" - credentialLibraryVaultSshCertificateUsernameKey = "username" - credentialLibraryVaultSshCertificateKeyTypeKey = "key_type" - credentialLibraryVaultSshCertificateKeyBitsKey = "key_bits" - credentialLibraryVaultSshCertificateTtlKey = "ttl" - credentialLibraryVaultSshCertificateKeyIdKey = "key_id" - credentialLibraryVaultSshCertificateCriticalOptionsKey = "critical_options" - credentialLibraryVaultSshCertificateExtensionsKey = "extensions" + credentialLibraryVaultSshCertificateType = "vault-ssh-certificate" + credentialLibraryVaultSshCertificatePathKey = "path" + credentialLibraryVaultSshCertificateUsernameKey = "username" + credentialLibraryVaultSshCertificateKeyTypeKey = "key_type" + credentialLibraryVaultSshCertificateKeyBitsKey = "key_bits" + credentialLibraryVaultSshCertificateTtlKey = "ttl" + credentialLibraryVaultSshCertificateKeyIdKey = "key_id" + credentialLibraryVaultSshCertificateCriticalOptionsKey = "critical_options" + credentialLibraryVaultSshCertificateExtensionsKey = "extensions" + credentialLibraryVaultSshCertificateAdditionalValidPrincipalsKey = "additional_valid_principals" ) var libraryVaultSshCertificateAttrs = []string{ @@ -34,6 +35,7 @@ var libraryVaultSshCertificateAttrs = []string{ credentialLibraryVaultSshCertificateKeyIdKey, credentialLibraryVaultSshCertificateCriticalOptionsKey, credentialLibraryVaultSshCertificateExtensionsKey, + credentialLibraryVaultSshCertificateAdditionalValidPrincipalsKey, } func resourceCredentialLibraryVaultSshCertificate() *schema.Resource { @@ -110,6 +112,14 @@ func resourceCredentialLibraryVaultSshCertificate() *schema.Resource { Type: schema.TypeMap, Optional: true, }, + credentialLibraryVaultSshCertificateAdditionalValidPrincipalsKey: { + Description: "Principals to be signed as \"valid_principles\" in addition to username.", + Type: schema.TypeList, + Elem: &schema.Schema{ + Type: schema.TypeString, + }, + Optional: true, + }, }, } } @@ -185,6 +195,13 @@ func resourceCredentialLibraryCreateVaultSshCertificate(ctx context.Context, d * opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryExtensions(e)) } } + if v, ok := d.GetOk(credentialLibraryVaultSshCertificateAdditionalValidPrincipalsKey); ok { + avp := []string{} + for _, vv := range v.([]interface{}) { + avp = append(avp, vv.(string)) + } + opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryAdditionalValidPrincipals(avp)) + } var credentialStoreId string cid, ok := d.GetOk(credentialStoreIdKey) @@ -375,6 +392,17 @@ func resourceCredentialLibraryUpdateVaultSshCertificate(ctx context.Context, d * } opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryExtensions(e)) } + if d.HasChange(credentialLibraryVaultSshCertificateAdditionalValidPrincipalsKey) { + // set defaults first in case the value was omitted and we want to remove it + opts = append(opts, credentiallibraries.DefaultVaultSSHCertificateCredentialLibraryAdditionalValidPrincipals()) + if v, ok := d.GetOk(credentialLibraryVaultSshCertificateAdditionalValidPrincipalsKey); ok { + avp := []string{} + for _, vv := range v.([]interface{}) { + avp = append(avp, vv.(string)) + } + opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryAdditionalValidPrincipals(avp)) + } + } if len(opts) > 0 { opts = append(opts, credentiallibraries.WithAutomaticVersioning(true)) diff --git a/internal/provider/resource_credential_library_vault_ssh_certificate_test.go b/internal/provider/resource_credential_library_vault_ssh_certificate_test.go index c14db251..a283b1dc 100644 --- a/internal/provider/resource_credential_library_vault_ssh_certificate_test.go +++ b/internal/provider/resource_credential_library_vault_ssh_certificate_test.go @@ -69,6 +69,9 @@ resource "boundary_credential_library_vault_ssh_certificate" "ext_co_example" { critical_options = { force-command = "/bin/foo" } + additional_valid_principals = [ + "principal-1" + ] }`, vaultSshCertCredLibName, vaultSshCertCredLibDesc, vaultSshCertCredLibPath, @@ -86,6 +89,10 @@ resource "boundary_credential_library_vault_ssh_certificate" "ext_co_example" { permit-pty = "" permit-X11-forwarding = "" } + additional_valid_principals = [ + "principal-2", + "principal-3" + ] }`, vaultSshCertCredLibName, vaultSshCertCredLibDesc, vaultSshCertCredLibPath, @@ -161,13 +168,14 @@ func TestAccCredentialLibraryVaultSshCertificate(t *testing.T) { }, importStep(vaultSshCertCredResc), { - // create with extensions and critical options + // create with extensions, critical options, and additional valid principals Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultSshCertCredLibResourceExtensionsCriticalOpts), Check: resource.ComposeTestCheckFunc( resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, NameKey, vaultSshCertCredLibName), resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, DescriptionKey, vaultSshCertCredLibDesc), resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultPathKey, vaultSshCertCredLibPath), resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateUsernameKey, vaultSshCertCredUsername), + resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateAdditionalValidPrincipalsKey+".#", "1"), testAccCheckCredentialLibraryResourceExists(provider, vaultSshCertCredExtCOResc), ), @@ -183,6 +191,7 @@ func TestAccCredentialLibraryVaultSshCertificate(t *testing.T) { resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateUsernameKey, vaultSshCertCredUsername), resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateCriticalOptionsKey+".%", "0"), resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateExtensionsKey+".%", "2"), + resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateAdditionalValidPrincipalsKey+".#", "2"), testAccCheckCredentialLibraryResourceExists(provider, vaultSshCertCredExtCOResc), ), @@ -198,6 +207,7 @@ func TestAccCredentialLibraryVaultSshCertificate(t *testing.T) { resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateUsernameKey, vaultSshCertCredUsername), resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateCriticalOptionsKey+".%", "2"), resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateExtensionsKey+".%", "1"), + resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateAdditionalValidPrincipalsKey+".#", "0"), testAccCheckCredentialLibraryResourceExists(provider, vaultSshCertCredExtCOResc), ),