From 100a12fd6040c861687b2279b16d46af5f9be1c7 Mon Sep 17 00:00:00 2001 From: Clint Date: Fri, 24 Jul 2020 05:57:56 -0500 Subject: [PATCH] Use write-ahead-logs to cleanup any orphaned Service Principals (#42) * Use WAL for App cleanup * Fix typo * Reduce maxWALAge * Add StringToTimeHookFunc to decoding of WAL entries * add new errMockProvider struct to simulate an error * rough test * small refactor * refactor * Update path_service_principal_test.go Co-authored-by: Jim Kalafut * Update path_service_principal.go Co-authored-by: Calvin Leung Huang Co-authored-by: Jim Kalafut Co-authored-by: Calvin Leung Huang --- backend.go | 6 +++ backend_test.go | 36 +++++++++++++ go.mod | 2 +- go.sum | 15 ------ path_service_principal.go | 25 ++++++--- path_service_principal_test.go | 95 ++++++++++++++++++++++++++++++++++ scripts/local_dev.sh | 2 +- wal.go | 62 ++++++++++++++++++++++ 8 files changed, 220 insertions(+), 23 deletions(-) create mode 100644 wal.go diff --git a/backend.go b/backend.go index ae5e63e4..0e647353 100644 --- a/backend.go +++ b/backend.go @@ -55,6 +55,12 @@ func backend() *azureSecretBackend { }, BackendType: logical.TypeLogical, Invalidate: b.invalidate, + + WALRollback: b.walRollback, + + // Role assignment can take up to a few minutes, so ensure we don't try + // to roll back during creation. + WALRollbackMinAge: 10 * time.Minute, } b.getProvider = newAzureProvider diff --git a/backend_test.go b/backend_test.go index b647d3b0..9c7f5453 100644 --- a/backend_test.go +++ b/backend_test.go @@ -73,6 +73,42 @@ type mockProvider struct { failNextCreateApplication bool } +// errMockProvider simulates a normal provider which fails to associate a role, +// returning an error +type errMockProvider struct { + *mockProvider +} + +// CreateRoleAssignment for the errMockProvider intentionally fails +func (e *errMockProvider) CreateRoleAssignment(ctx context.Context, scope string, roleAssignmentName string, parameters authorization.RoleAssignmentCreateParameters) (authorization.RoleAssignment, error) { + return authorization.RoleAssignment{}, errors.New("PrincipalNotFound") +} + +// GetApplication for the errMockProvider only returns an application if that +// key is found, unlike mockProvider which returns the same application object +// id each time. Existing tests depend on the mockProvider behavior, which is +// why errMockProvider has it's own version. +func (e *errMockProvider) GetApplication(ctx context.Context, applicationObjectID string) (graphrbac.Application, error) { + for s := range e.applications { + if s == applicationObjectID { + return graphrbac.Application{ + AppID: to.StringPtr(s), + }, nil + } + } + return graphrbac.Application{}, errors.New("not found") +} + +func newErrMockProvider() AzureProvider { + return &errMockProvider{ + mockProvider: &mockProvider{ + subscriptionID: generateUUID(), + applications: make(map[string]bool), + passwords: make(map[string]bool), + }, + } +} + func newMockProvider() AzureProvider { return &mockProvider{ subscriptionID: generateUUID(), diff --git a/go.mod b/go.mod index d82d7a67..b692939b 100644 --- a/go.mod +++ b/go.mod @@ -23,7 +23,7 @@ require ( github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d // indirect github.com/kr/text v0.2.0 // indirect github.com/mattn/go-colorable v0.1.6 // indirect - github.com/mitchellh/mapstructure v1.3.2 // indirect + github.com/mitchellh/mapstructure v1.3.2 github.com/pierrec/lz4 v2.5.2+incompatible // indirect golang.org/x/crypto v0.0.0-20200604202706-70a84ac30bf9 // indirect golang.org/x/net v0.0.0-20200602114024-627f9648deb9 // indirect diff --git a/go.sum b/go.sum index 2596f9b1..c83aed70 100644 --- a/go.sum +++ b/go.sum @@ -142,13 +142,11 @@ github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU= -github.com/mattn/go-colorable v0.1.4 h1:snbPLB8fVfU9iwbbo30TPtbLRzwWu6aJS6Xh4eaaviA= github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE= github.com/mattn/go-colorable v0.1.6 h1:6Su7aK7lXmJ/U79bYtBjLNaha4Fs1Rg9plHpcH+vvnE= github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc= github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4= github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s= -github.com/mattn/go-isatty v0.0.10 h1:qxFzApOv4WsAL965uUPIsXzAKCZxN2p9UqdhFS4ZW10= github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84= github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE= github.com/mattn/go-isatty v0.0.12 h1:wuysRhFDzyxgEmMf5xjvJ2M9dZoWAXNNr5LSBS7uHXY= @@ -162,9 +160,7 @@ github.com/mitchellh/go-testing-interface v0.0.0-20171004221916-a61a99592b77/go. github.com/mitchellh/go-testing-interface v1.0.0 h1:fzU/JVNcaqHQEcVFAKeR41fkiLdIPrefOvVG1VZ96U0= github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI= github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo= -github.com/mitchellh/mapstructure v1.1.2 h1:fmNYVwqnSfB9mZU6OS2O6GsXM+wcskZDuKQzvN1EDeE= github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y= -github.com/mitchellh/mapstructure v1.2.2 h1:dxe5oCinTXiTIcfgmZecdCzPmAJKd46KsCWc35r0TV4= github.com/mitchellh/mapstructure v1.2.2/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo= github.com/mitchellh/mapstructure v1.3.2 h1:mRS76wmkOn3KkKAyXDu42V+6ebnXWIztFSYGN7GeoRg= github.com/mitchellh/mapstructure v1.3.2/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo= @@ -172,7 +168,6 @@ github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx github.com/oklog/run v1.0.0 h1:Ru7dDtJNOyC66gQ5dQmaCa0qIsAUFY3sFpK1Xk8igrw= github.com/oklog/run v1.0.0/go.mod h1:dlhp/R75TPv97u0XWUtDeV/lRKWPKSdTuV0TZvrmrQA= github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc= -github.com/pierrec/lz4 v2.0.5+incompatible h1:2xWsjqPFWcplujydGg4WmhC/6fZqK42wMM8aXeqhl0I= github.com/pierrec/lz4 v2.0.5+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY= github.com/pierrec/lz4 v2.5.2+incompatible h1:WCjObylUIOlKy/+7Abdn34TLIkXiA4UWUMhxq9m9ZXI= github.com/pierrec/lz4 v2.5.2+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY= @@ -193,9 +188,7 @@ github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXf github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM= -golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2 h1:VklqNMn3ovrHsnt90PveolxSbWFaJdECFbxSq0Mqo2M= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= -golang.org/x/crypto v0.0.0-20190418165655-df01cb2cc480 h1:O5YqonU5IWby+w98jVUG9h7zlCWCcH4RHyPVReBmhzk= golang.org/x/crypto v0.0.0-20190418165655-df01cb2cc480/go.mod h1:WFFai1msRO1wXaEeE5yQxYXgSfI8pQAWXbQop6sCtWE= golang.org/x/crypto v0.0.0-20200604202706-70a84ac30bf9 h1:vEg9joUBmeBcK9iSJftGNf3coIG4HqZElCPehJsfAYM= golang.org/x/crypto v0.0.0-20200604202706-70a84ac30bf9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= @@ -207,10 +200,8 @@ golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73r golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20181201002055-351d144fa1fc/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= -golang.org/x/net v0.0.0-20190311183353-d8887717615a h1:oWX7TPOiFAMXLq8o0ikBYfCJVlRHBcsciT5bXOrH628= golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= -golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7 h1:fHDIZ2oxGnUZRN6WgWFCbYBjH9uqVPRCUVUDhs0wnbA= golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200602114024-627f9648deb9 h1:pNX+40auqi2JqRfOP1akLGtYcn15TUbkhwuCO3foqqM= golang.org/x/net v0.0.0-20200602114024-627f9648deb9/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= @@ -218,17 +209,14 @@ golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAG golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.0.0-20190423024810-112230192c58 h1:8gQV6CLnAEikrhgkHFbMAEhagSSnXWGV915qUMm9mrU= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190129075346-302c3dd5f1cc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= -golang.org/x/sys v0.0.0-20190403152447-81d4e9dc473e h1:nFYrTHrdrAOpShe27kaFHjsqYSEQ0KWqdWLu3xuZJts= golang.org/x/sys v0.0.0-20190403152447-81d4e9dc473e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20191008105621-543471e840be h1:QAcqgptGM8IQBC9K/RC4o+O9YmqEm0diQn9QmZw/0mU= golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -239,7 +227,6 @@ golang.org/x/sys v0.0.0-20200602225109-6fdc65e7d980/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= -golang.org/x/time v0.0.0-20190308202827-9d24e82272b4 h1:SvFZT6jyqRaOeXpc5h/JSfZenJ2O330aBsf7JfSUXmQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1 h1:NusfzzA6yGQ+ua51ck7E3omNUX/JuqbFSaRGqU8CcLI= golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= @@ -258,7 +245,6 @@ google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013 h1:+kGHl1aib/qcwaR google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo= google.golang.org/grpc v1.14.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw= google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c= -google.golang.org/grpc v1.22.0 h1:J0UbZOIrCAl+fpTOf8YLs4dJo8L/owV4LYVtAXQoPkw= google.golang.org/grpc v1.22.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg= google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg= google.golang.org/grpc v1.27.0 h1:rRYRFMVgRv6E0D70Skyfsr28tDXIuuPZyWGMPdMcnXg= @@ -272,7 +258,6 @@ google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2 google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU= google.golang.org/protobuf v1.24.0 h1:UhZDfRO8JRQru4/+LlLE0BRKGF8L+PICnvYZmx/fEGA= google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4= -gopkg.in/square/go-jose.v2 v2.3.1 h1:SK5KegNXmKmqE342YYN2qPHEnUYeoMiXXl1poUlI+o4= gopkg.in/square/go-jose.v2 v2.3.1/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI= gopkg.in/square/go-jose.v2 v2.5.1 h1:7odma5RETjNHWJnR32wx8t+Io4djHE1PqxCFx3iiZ2w= gopkg.in/square/go-jose.v2 v2.5.1/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI= diff --git a/path_service_principal.go b/path_service_principal.go index 409fba5d..3015e423 100644 --- a/path_service_principal.go +++ b/path_service_principal.go @@ -77,7 +77,7 @@ func (b *azureSecretBackend) pathSPRead(ctx context.Context, req *logical.Reques if role.ApplicationObjectID != "" { resp, err = b.createStaticSPSecret(ctx, client, roleName, role) } else { - resp, err = b.createSPSecret(ctx, client, roleName, role) + resp, err = b.createSPSecret(ctx, req.Storage, client, roleName, role) } if err != nil { @@ -91,9 +91,10 @@ func (b *azureSecretBackend) pathSPRead(ctx context.Context, req *logical.Reques } // createSPSecret generates a new App/Service Principal. -func (b *azureSecretBackend) createSPSecret(ctx context.Context, c *client, roleName string, role *roleEntry) (*logical.Response, error) { +func (b *azureSecretBackend) createSPSecret(ctx context.Context, s logical.Storage, c *client, roleName string, role *roleEntry) (*logical.Response, error) { // Create the App, which is the top level object to be tracked in the secret - // and deleted upon revocation. If any subsequent step fails, the App is deleted. + // and deleted upon revocation. If any subsequent step fails, the App will be + // deleted as part of WAL rollback. app, err := c.createApp(ctx) if err != nil { return nil, err @@ -101,26 +102,38 @@ func (b *azureSecretBackend) createSPSecret(ctx context.Context, c *client, role appID := to.String(app.AppID) appObjID := to.String(app.ObjectID) + // Write a WAL entry in case the SP create process doesn't complete + walID, err := framework.PutWAL(ctx, s, walAppKey, &walApp{ + AppID: appID, + AppObjID: appObjID, + Expiration: time.Now().Add(maxWALAge), + }) + if err != nil { + return nil, errwrap.Wrapf("error writing WAL: {{err}}", err) + } + // Create a service principal associated with the new App sp, password, err := c.createSP(ctx, app, spExpiration) if err != nil { - c.deleteApp(ctx, appObjID) return nil, err } // Assign Azure roles to the new SP raIDs, err := c.assignRoles(ctx, sp, role.AzureRoles) if err != nil { - c.deleteApp(ctx, appObjID) return nil, err } // Assign Azure group memberships to the new SP if err := c.addGroupMemberships(ctx, sp, role.AzureGroups); err != nil { - c.deleteApp(ctx, appObjID) return nil, err } + // SP is fully created so delete the WAL + if err := framework.DeleteWAL(ctx, s, walID); err != nil { + return nil, errwrap.Wrapf("error deleting WAL: {{err}}", err) + } + data := map[string]interface{}{ "client_id": appID, "client_secret": password, diff --git a/path_service_principal_test.go b/path_service_principal_test.go index 4cb0e073..9abad420 100644 --- a/path_service_principal_test.go +++ b/path_service_principal_test.go @@ -11,8 +11,10 @@ import ( "github.com/Azure/go-autorest/autorest/to" log "github.com/hashicorp/go-hclog" "github.com/hashicorp/go-uuid" + "github.com/hashicorp/vault/sdk/framework" "github.com/hashicorp/vault/sdk/helper/logging" "github.com/hashicorp/vault/sdk/logical" + "github.com/mitchellh/mapstructure" ) var ( @@ -49,6 +51,99 @@ var ( } ) +// TestSP_WAL_Cleanup tests that any Service Principal that gets created, but +// fails to have roles associated with it, gets cleaned up by the periodic WAL +// function. +func TestSP_WAL_Cleanup(t *testing.T) { + b, s := getTestBackend(t, true) + + // overwrite the normal test backend provider with the errMockProvider + errMockProvider := newErrMockProvider() + b.getProvider = func(s *clientSettings) (AzureProvider, error) { + return errMockProvider, nil + } + + // verify basic cred issuance + t.Run("Role assign fail", func(t *testing.T) { + name := generateUUID() + testRoleCreate(t, b, s, name, testRole) + + // create a short timeout to short-circuit the retry process and trigger the + // deadline error + ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second) + defer cancel() + + resp, err := b.HandleRequest(ctx, &logical.Request{ + Operation: logical.ReadOperation, + Path: "creds/" + name, + Storage: s, + }) + + if err == nil || !strings.Contains(err.Error(), "context deadline exceeded") { + t.Fatalf("expected deadline error, but got '%s'", err.Error()) + } + if resp.IsError() { + t.Fatalf("expected no response error, actual:%#v", resp.Error()) + } + + assertEmptyWAL(t, b, errMockProvider, s) + }) +} + +func assertEmptyWAL(t *testing.T, b *azureSecretBackend, emp AzureProvider, s logical.Storage) { + t.Helper() + + wal, err := framework.ListWAL(context.Background(), s) + if err != nil { + t.Fatalf("error listing wal: %s", err) + } + req := &logical.Request{ + Storage: s, + } + + // loop of WAL entries and trigger the rollback method for each, simulating + // Vault's rollback mechanism + for _, v := range wal { + ctx := context.Background() + entry, err := framework.GetWAL(ctx, s, v) + if err != nil { + t.Fatal(err) + } + + // Decode the WAL data + var app walApp + d, err := mapstructure.NewDecoder(&mapstructure.DecoderConfig{ + DecodeHook: mapstructure.StringToTimeHookFunc(time.RFC3339), + Result: &app, + }) + if err != nil { + t.Fatal(err) + } + err = d.Decode(entry.Data) + if err != nil { + t.Fatal(err) + } + + _, err = emp.GetApplication(context.Background(), app.AppObjID) + if err != nil { + t.Fatalf("expected to find application (%s), but wasn't found", app.AppObjID) + } + + err = b.walRollback(ctx, req, entry.Kind, entry.Data) + if err != nil { + t.Fatal(err) + } + if err := framework.DeleteWAL(ctx, s, v); err != nil { + t.Fatal(err) + } + + _, err = emp.GetApplication(context.Background(), app.AppObjID) + if err == nil { + t.Fatalf("expected error getting application") + } + } +} + func TestSPRead(t *testing.T) { b, s := getTestBackend(t, true) diff --git a/scripts/local_dev.sh b/scripts/local_dev.sh index 4366a903..b77261d3 100755 --- a/scripts/local_dev.sh +++ b/scripts/local_dev.sh @@ -46,7 +46,7 @@ function cleanup { trap cleanup EXIT echo " Authing" -vault auth root &>/dev/null +vault login root &>/dev/null echo "--> Building" go build -o "$SCRATCH/plugins/$PLUGIN_NAME" "./cmd/$PLUGIN_NAME" diff --git a/wal.go b/wal.go new file mode 100644 index 00000000..f3dc4ede --- /dev/null +++ b/wal.go @@ -0,0 +1,62 @@ +package azuresecrets + +import ( + "context" + "fmt" + "time" + + "github.com/hashicorp/vault/sdk/logical" + "github.com/mitchellh/mapstructure" +) + +const walAppKey = "appCreate" + +// Eventually expire the WAL if for some reason the rollback operation consistently fails +var maxWALAge = 24 * time.Hour + +type walApp struct { + AppID string + AppObjID string + Expiration time.Time +} + +func (b *azureSecretBackend) walRollback(ctx context.Context, req *logical.Request, kind string, data interface{}) error { + if kind != walAppKey { + return fmt.Errorf("unknown rollback type %q", kind) + } + // Decode the WAL data + var entry walApp + d, err := mapstructure.NewDecoder(&mapstructure.DecoderConfig{ + DecodeHook: mapstructure.StringToTimeHookFunc(time.RFC3339), + Result: &entry, + }) + if err != nil { + return err + } + err = d.Decode(data) + if err != nil { + return err + } + + client, err := b.getClient(ctx, req.Storage) + if err != nil { + return err + } + + b.Logger().Debug("rolling back SP", "appID", entry.AppID, "appObjID", entry.AppObjID) + + // Attempt to delete the App. deleteApp doesn't return an error if the app isn't + // found, so no special handling is needed for that case. If we don't succeed within + // maxWALAge (e.g. client creds have changed and the delete will never succeed), + // unconditionally remove the WAL. + if err := client.deleteApp(ctx, entry.AppObjID); err != nil { + b.Logger().Warn("rollback error deleting App", "err", err) + + if time.Now().After(entry.Expiration) { + return nil + } + return err + } + + return nil +}