Correctly handle reloading auth plugin backends

vault/plugin_reload.go

@@ -2,10 +2,13 @@ package vault
 
 import (
 	"fmt"
+	"strings"
+
+	"github.com/hashicorp/vault/logical"
 )
 
 // reloadPluginMounts reloads provided mounts, regardless of
-// plugin name, as long as the backend type is of plugin.
+// plugin name, as long as the backend type is plugin.
 func (c *Core) reloadMatchingPluginMounts(mounts []string) error {
 	c.mountsLock.Lock()
 	defer c.mountsLock.Unlock()
@@ -15,11 +18,20 @@ func (c *Core) reloadMatchingPluginMounts(mounts []string) error {
 		if entry == nil {
 			return fmt.Errorf("cannot fetch mount entry on %s", mount)
 		}
-		err := c.reloadPluginCommon(entry)
-		if err != nil {
-			return err
+
+		var isAuth bool
+		fullPath := c.router.MatchingMount(mount)
+		if strings.HasPrefix(fullPath, credentialRoutePrefix) {
+			isAuth = true
+		}
+
+		if entry.Type == "plugin" {
+			err := c.reloadPluginCommon(entry, isAuth)
+			if err != nil {
+				return err
+			}
+			c.logger.Info("core: successfully reloaded plugin", "plugin", entry.Config.PluginName, "path", entry.Path)
 		}
-		c.logger.Info("core: successfully reloaded plugin", "plugin", entry.Config.PluginName, "path", entry.Path)
 	}
 	return nil
 }
@@ -33,57 +45,76 @@ func (c *Core) reloadMatchingPlugin(pluginName string) error {
 
 	// Filter mount entries that only matches the plugin name
 	for _, entry := range c.mounts.Entries {
-		if entry.Config.PluginName == pluginName {
-			err := c.reloadPluginCommon(entry)
+		if entry.Config.PluginName == pluginName && entry.Type == "plugin" {
+			err := c.reloadPluginCommon(entry, false)
+			if err != nil {
+				return err
+			}
+			c.logger.Info("core: successfully reloaded plugin", "plugin", pluginName, "path", entry.Path)
+		}
+	}
+
+	// Filter auth mount entries that ony matches the plugin name
+	for _, entry := range c.auth.Entries {
+		if entry.Config.PluginName == pluginName && entry.Type == "plugin" {
+			err := c.reloadPluginCommon(entry, true)
 			if err != nil {
 				return err
 			}
 			c.logger.Info("core: successfully reloaded plugin", "plugin", pluginName, "path", entry.Path)
 		}
 	}
+
 	return nil
 }
 
-func (c *Core) reloadPluginCommon(entry *MountEntry) error {
-	if entry.Type == "plugin" {
-		path := entry.Path
+// reloadPluginCommon is a generic method to reload a backend provided a
+// MountEntry. entry.Type should be checked by the caller to ensure that
+// it's a "plugin" type.
+func (c *Core) reloadPluginCommon(entry *MountEntry, isAuth bool) error {
+	path := entry.Path
 
-		// Fast-path out if the backend doesn't exist
-		raw, ok := c.router.root.Get(path)
-		if !ok {
-			return nil
-		}
+	// Fast-path out if the backend doesn't exist
+	raw, ok := c.router.root.Get(path)
+	if !ok {
+		return nil
+	}
 
-		// Call backend's Cleanup routine
-		re := raw.(*routeEntry)
-		re.backend.Cleanup()
+	// Call backend's Cleanup routine
+	re := raw.(*routeEntry)
+	re.backend.Cleanup()
 
-		view := re.storageView
+	view := re.storageView
 
-		sysView := c.mountEntrySysView(entry)
-		conf := make(map[string]string)
-		if entry.Config.PluginName != "" {
-			conf["plugin_name"] = entry.Config.PluginName
-		}
+	sysView := c.mountEntrySysView(entry)
+	conf := make(map[string]string)
+	if entry.Config.PluginName != "" {
+		conf["plugin_name"] = entry.Config.PluginName
+	}
 
+	var backend logical.Backend
+	var err error
+	if !isAuth {
 		// Dispense a new backend
-		backend, err := c.newLogicalBackend(entry.Type, sysView, view, conf)
-		if err != nil {
-			return err
-		}
-		if backend == nil {
-			return fmt.Errorf("nil backend of type %q returned from creation function", entry.Type)
-		}
-
-		// Call initialize; this takes care of init tasks that must be run after
-		// the ignore paths are collected.
-		if err := backend.Initialize(); err != nil {
-			return err
-		}
+		backend, err = c.newLogicalBackend(entry.Type, sysView, view, conf)
+	} else {
+		backend, err = c.newCredentialBackend(entry.Type, sysView, view, conf)
+	}
+	if err != nil {
+		return err
+	}
+	if backend == nil {
+		return fmt.Errorf("nil backend of type %q returned from creation function", entry.Type)
+	}
 
-		// Set the backend back
-		re.backend = backend
+	// Call initialize; this takes care of init tasks that must be run after
+	// the ignore paths are collected.
+	if err := backend.Initialize(); err != nil {
+		return err
 	}
 
+	// Set the backend back
+	re.backend = backend
+
 	return nil
 }