Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update token/clientKey on hmac change #125

Merged
merged 6 commits into from
Jun 25, 2021
Merged

Update token/clientKey on hmac change #125

merged 6 commits into from
Jun 25, 2021

Conversation

louisruch
Copy link
Contributor

@louisruch louisruch commented Jun 23, 2021

What does this PR do

The Boundary API does not return the ClientCertKey or the Token in the response, instead it returns an hmac for each of those fields. This PRs updates these fields to (changed in Boundary) when a change was detected on the corresponding hmac during a read request. This will allow tf to detect the ClientCertKey or the Token has changed.

Please note this will currently fail when changing a token back due to outstanding work on Boundary. However, it will at least notify the tf user that there was a change and they should update the tf file to match the current state.

This PR also updates:

  • the change log to prepare the provider for release
  • updates to the latest changes in the API/SDK

PR verification steps

Please note because of the outstanding work in Boundary to support changing back to a previously used token, the unit test cannot fully verify the final update back to the tf config. I did however verify the changes to detect token and certKey works by setting ExpectNonEmptyPlan: false and running the unit test:

Step 7/8 error: After applying this test step, the plan was not empty.
        stdout:
        
        
        An execution plan has been generated and is shown below.
        Resource actions are indicated with the following symbols:
          ~ update in-place
        
        Terraform will perform the following actions:
        
          # boundary_credential_store_vault.example will be updated in-place
          ~ resource "boundary_credential_store_vault" "example" {
              ~ address                     = "https://localhost:55209" -> "https://localhost:55208"
              ~ ca_cert                     = <<-EOT
                    -----BEGIN CERTIFICATE-----
                  - omitted by Louis to reduce size
                    -----END CERTIFICATE-----
                EOT
              ~ client_certificate          = <<-EOT
                    -----BEGIN CERTIFICATE-----
                  - omitted by Louis to reduce size
                    -----END CERTIFICATE-----
                EOT
              ~ client_certificate_key      = (sensitive value)
                id                          = "csvlt_sua590Vwix"
                name                        = "foo_random"
              ~ token                       = (sensitive value)
                # (7 unchanged attributes hidden)
            }

Without the changes from this PR the final step fails without the client_certificate_key and token detected as diffs:

Step 7/8 error: After applying this test step, the plan was not empty.
        stdout:
        
        
        An execution plan has been generated and is shown below.
        Resource actions are indicated with the following symbols:
          ~ update in-place
        
        Terraform will perform the following actions:
        
          # boundary_credential_store_vault.example will be updated in-place
          ~ resource "boundary_credential_store_vault" "example" {
              ~ address                     = "https://localhost:55213" -> "https://localhost:55212"
              ~ ca_cert                     = <<-EOT
                    -----BEGIN CERTIFICATE-----
                  - omited by Louis to reduce size
                    -----END CERTIFICATE-----
                EOT
              ~ client_certificate          = <<-EOT
                    -----BEGIN CERTIFICATE-----
                  - omitted by Louis to reduce size
                    -----END CERTIFICATE-----
                EOT
                id                          = "csvlt_eulp64wt7v"
                name                        = "foo_random"
                # (9 unchanged attributes hidden)
            }

@louisruch louisruch force-pushed the louis-token-update branch from 6a6f7bd to 373e5db Compare June 24, 2021 23:48
@louisruch louisruch requested review from malnick and talanknight June 25, 2021 18:26
@louisruch
Copy link
Contributor Author

@talanknight @malnick PTAL

* Adds claim scopes attribute to OIDC auth method
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/112)).
* Adds account claim maps attribute to OIDC auth method
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/111)).
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for including these, completely slipped on my PR for the library and store PR.

@louisruch louisruch merged commit e1f8352 into main Jun 25, 2021
@louisruch louisruch deleted the louis-token-update branch June 25, 2021 20:30
louisruch added a commit that referenced this pull request Aug 16, 2021
* docs: update host catalog resource with correct value for type attribute

* build: add Makefile target for auto-generating docs

* bugfix: make OIDC account attribute for subject ForceNew

* docs: update auto-generated docs

* Add credential library resource for Vault (#114)

* Integrate with Vault to retrieve and manage per session credentials

Co-authored-by: Louis Ruch <[email protected]>

* Update token/clientKey on hmac change (#125)

* Update token/clientKey on hmac change

* Update changelog

* Update docs

* Prep for 1.0.3

* v1.0.3

* Update terraform-plugin-sdk

* Fix Typo

* Adopt American spelling

* fix the parameter that is actually being sent as the auth method id

Co-authored-by: Jeff Malnick <[email protected]>
Co-authored-by: Louis Ruch <[email protected]>
Co-authored-by: Jeff Mitchell <[email protected]>
Co-authored-by: tf-release-bot <[email protected]>
Co-authored-by: Lewis Cowper <[email protected]>
louisruch added a commit that referenced this pull request Aug 17, 2021
* feat: add managed group resource

* feat: add tests for managed group resource

* update go.sum

* update tests

* simplify the managed group resource

* use WithDefaultPasswordAuthMethodId

* Managed groups (#129)

* docs: update host catalog resource with correct value for type attribute

* build: add Makefile target for auto-generating docs

* bugfix: make OIDC account attribute for subject ForceNew

* docs: update auto-generated docs

* Add credential library resource for Vault (#114)

* Integrate with Vault to retrieve and manage per session credentials

Co-authored-by: Louis Ruch <[email protected]>

* Update token/clientKey on hmac change (#125)

* Update token/clientKey on hmac change

* Update changelog

* Update docs

* Prep for 1.0.3

* v1.0.3

* Update terraform-plugin-sdk

* Fix Typo

* Adopt American spelling

* fix the parameter that is actually being sent as the auth method id

Co-authored-by: Jeff Malnick <[email protected]>
Co-authored-by: Louis Ruch <[email protected]>
Co-authored-by: Jeff Mitchell <[email protected]>
Co-authored-by: tf-release-bot <[email protected]>
Co-authored-by: Lewis Cowper <[email protected]>

* nits and updates

* OIDC auth method + get filter from attributes

* Add changelog

* Fix schema description

Co-authored-by: Riley Guerin <[email protected]>
Co-authored-by: Louis Ruch <[email protected]>
Co-authored-by: Jeff Mitchell <[email protected]>
Co-authored-by: tf-release-bot <[email protected]>
Co-authored-by: Lewis Cowper <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants