Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

PostgreSQL - Add username customization #10766

Merged
merged 7 commits into from
Feb 4, 2021
+424 −43
Merged

PostgreSQL - Add username customization #10766

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
db780b1
PostgreSQL - add username customization
pcman312 Jan 25, 2021
7382d22
Linting
pcman312 Jan 25, 2021
21b2f8e
Fix template function calls
pcman312 Jan 26, 2021
5f67346
Changed back to errwrap
pcman312 Jan 26, 2021
3b2f71f
GetString -> strutil; minor code review things
pcman312 Feb 3, 2021
9b39ce5
Merge branch 'master' into customize-username-postgres
pcman312 Feb 4, 2021
dd2c614
go mod tidy
pcman312 Feb 4, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
59 changes: 57 additions & 2 deletions go.sum
View file
Open in desktop

Large diffs are not rendered by default.

40 changes: 33 additions & 7 deletions plugins/database/postgresql/postgresql.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,14 +8,16 @@ import (
"strings"

"github.com/hashicorp/errwrap"

calvn marked this conversation as resolved.
Show resolved Hide resolved
"github.com/hashicorp/go-multierror"
dbplugin "github.com/hashicorp/vault/sdk/database/dbplugin/v5"
"github.com/hashicorp/vault/sdk/database/helper/connutil"
"github.com/hashicorp/vault/sdk/database/helper/credsutil"
"github.com/hashicorp/vault/sdk/database/helper/dbutil"
"github.com/hashicorp/vault/sdk/helper/dbtxn"
"github.com/hashicorp/vault/sdk/helper/strutil"
"github.com/hashicorp/vault/sdk/helper/template"
"github.com/lib/pq"
"github.com/mitchellh/mapstructure"
)

const (
Expand All @@ -28,6 +30,8 @@ ALTER ROLE "{{username}}" WITH PASSWORD '{{password}}';
`

expirationFormat = "2006-01-02 15:04:05-0700"

defaultUserNameTemplate = `{{ printf "v-%s-%s-%s-%s" (.DisplayName | truncate 8) (.RoleName | truncate 8) (random 20) (unix_time) | truncate 63 }}`
)

var (
Expand Down Expand Up @@ -68,19 +72,46 @@ func new() *PostgreSQL {

type PostgreSQL struct {
*connutil.SQLConnectionProducer

usernameProducer template.StringTemplate
}

func (p *PostgreSQL) Initialize(ctx context.Context, req dbplugin.InitializeRequest) (dbplugin.InitializeResponse, error) {
newConf, err := p.SQLConnectionProducer.Init(ctx, req.Config, req.VerifyConnection)
if err != nil {
return dbplugin.InitializeResponse{}, err
}

usernameTemplate := getString(req.Config, "username_template")
if usernameTemplate == "" {
usernameTemplate = defaultUserNameTemplate
}

up, err := template.NewTemplate(template.Template(usernameTemplate))
if err != nil {
return dbplugin.InitializeResponse{}, fmt.Errorf("unable to initialize username template: %w", err)
}
p.usernameProducer = up

_, err = p.usernameProducer.Generate(dbplugin.UsernameMetadata{})
if err != nil {
return dbplugin.InitializeResponse{}, fmt.Errorf("invalid username template - did you reference a field that isn't available? : %w", err)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: does the error returned here tell you which field evaluated was invalid? I feel that "invalid username template: %w" might be sufficient here if so.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Example errors:

Input: foo-{{random 5}}-{{.FooBar}}
unable to apply template: template: template:1:19: executing "template" at <.FooBar>: can't evaluate field FooBar in type dbplugin.UsernameMetadata

Input: foo-{{random 5}}-{{FooBar}}
unable to parse template: template: template:1: function "FooBar" not defined

I'll look to see if the error that's returned is structured in any meaningful way so we can make this a bit nicer to users who aren't familiar with these errors.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unfortunately the errors coming back from the template library (the Go one, not the one in Vault) are not structured in a useful way here. I will remove this message and put a note in the docs about common error messages.

}

resp := dbplugin.InitializeResponse{
Config: newConf,
}
return resp, nil
}

func getString(m map[string]interface{}, key string) string {
var result string
if err := mapstructure.Decode(m[key], &result); err != nil {
calvn marked this conversation as resolved.
Show resolved Hide resolved
return ""
}
return result
}

func (p *PostgreSQL) Type() (string, error) {
return postgreSQLTypeName, nil
}
Expand Down Expand Up @@ -224,12 +255,7 @@ func (p *PostgreSQL) NewUser(ctx context.Context, req dbplugin.NewUserRequest) (
p.Lock()
defer p.Unlock()

username, err := credsutil.GenerateUsername(
credsutil.DisplayName(req.UsernameConfig.DisplayName, 8),
credsutil.RoleName(req.UsernameConfig.RoleName, 8),
credsutil.Separator("-"),
credsutil.MaxLength(63),
)
username, err := p.usernameProducer.Generate(req.UsernameConfig)
if err != nil {
return dbplugin.NewUserResponse{}, err
}
Expand Down
Loading