Skip to content

Commit

Permalink
Change auth helper interface to api.Secret. (#3263)
Browse files Browse the repository at this point in the history 
This allows us to properly handle wrapped responses.

Fixes #3217
  • Loading branch information
@jefferai
jefferai authored Aug 31, 2017
1 parent a125e90 commit 79b63de
Show file tree
Hide file tree
Showing 8 changed files with 262 additions and 49 deletions.
12 changes: 6 additions & 6 deletions builtin/credential/aws/cli.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ func GenerateLoginData(accessKey, secretKey, sessionToken, headerValue string) (
return loginData, nil
}

func (h *CLIHandler) Auth(c *api.Client, m map[string]string) (string, error) {
func (h *CLIHandler) Auth(c *api.Client, m map[string]string) (*api.Secret, error) {
mount, ok := m["mount"]
if !ok {
mount = "aws"
Expand All @@ -87,23 +87,23 @@ func (h *CLIHandler) Auth(c *api.Client, m map[string]string) (string, error) {

loginData, err := GenerateLoginData(m["aws_access_key_id"], m["aws_secret_access_key"], m["aws_security_token"], headerValue)
if err != nil {
return "", err
return nil, err
}
if loginData == nil {
return "", fmt.Errorf("got nil response from GenerateLoginData")
return nil, fmt.Errorf("got nil response from GenerateLoginData")
}
loginData["role"] = role
path := fmt.Sprintf("auth/%s/login", mount)
secret, err := c.Logical().Write(path, loginData)

if err != nil {
return "", err
return nil, err
}
if secret == nil {
return "", fmt.Errorf("empty response from credential provider")
return nil, fmt.Errorf("empty response from credential provider")
}

return secret.Auth.ClientToken, nil
return secret, nil
}

func (h *CLIHandler) Help() string {
Expand Down
10 changes: 5 additions & 5 deletions builtin/credential/cert/cli.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,13 +10,13 @@ import (

type CLIHandler struct{}

func (h *CLIHandler) Auth(c *api.Client, m map[string]string) (string, error) {
func (h *CLIHandler) Auth(c *api.Client, m map[string]string) (*api.Secret, error) {
var data struct {
Mount string `mapstructure:"mount"`
Name string `mapstructure:"name"`
}
if err := mapstructure.WeakDecode(m, &data); err != nil {
return "", err
return nil, err
}

if data.Mount == "" {
Expand All @@ -29,13 +29,13 @@ func (h *CLIHandler) Auth(c *api.Client, m map[string]string) (string, error) {
path := fmt.Sprintf("auth/%s/login", data.Mount)
secret, err := c.Logical().Write(path, options)
if err != nil {
return "", err
return nil, err
}
if secret == nil {
return "", fmt.Errorf("empty response from credential provider")
return nil, fmt.Errorf("empty response from credential provider")
}

return secret.Auth.ClientToken, nil
return secret, nil
}

func (h *CLIHandler) Help() string {
Expand Down
10 changes: 5 additions & 5 deletions builtin/credential/github/cli.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ import (

type CLIHandler struct{}

func (h *CLIHandler) Auth(c *api.Client, m map[string]string) (string, error) {
func (h *CLIHandler) Auth(c *api.Client, m map[string]string) (*api.Secret, error) {
mount, ok := m["mount"]
if !ok {
mount = "github"
Expand All @@ -19,7 +19,7 @@ func (h *CLIHandler) Auth(c *api.Client, m map[string]string) (string, error) {
token, ok := m["token"]
if !ok {
if token = os.Getenv("VAULT_AUTH_GITHUB_TOKEN"); token == "" {
return "", fmt.Errorf("GitHub token should be provided either as 'value' for 'token' key,\nor via an env var VAULT_AUTH_GITHUB_TOKEN")
return nil, fmt.Errorf("GitHub token should be provided either as 'value' for 'token' key,\nor via an env var VAULT_AUTH_GITHUB_TOKEN")
}
}

Expand All @@ -28,13 +28,13 @@ func (h *CLIHandler) Auth(c *api.Client, m map[string]string) (string, error) {
"token": token,
})
if err != nil {
return "", err
return nil, err
}
if secret == nil {
return "", fmt.Errorf("empty response from credential provider")
return nil, fmt.Errorf("empty response from credential provider")
}

return secret.Auth.ClientToken, nil
return secret, nil
}

func (h *CLIHandler) Help() string {
Expand Down
12 changes: 6 additions & 6 deletions builtin/credential/ldap/cli.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ import (

type CLIHandler struct{}

func (h *CLIHandler) Auth(c *api.Client, m map[string]string) (string, error) {
func (h *CLIHandler) Auth(c *api.Client, m map[string]string) (*api.Secret, error) {
mount, ok := m["mount"]
if !ok {
mount = "ldap"
Expand All @@ -21,7 +21,7 @@ func (h *CLIHandler) Auth(c *api.Client, m map[string]string) (string, error) {
if !ok {
username = usernameFromEnv()
if username == "" {
return "", fmt.Errorf("'username' not supplied and neither 'LOGNAME' nor 'USER' env vars set")
return nil, fmt.Errorf("'username' not supplied and neither 'LOGNAME' nor 'USER' env vars set")
}
}
password, ok := m["password"]
Expand All @@ -31,7 +31,7 @@ func (h *CLIHandler) Auth(c *api.Client, m map[string]string) (string, error) {
password, err = pwd.Read(os.Stdin)
fmt.Println()
if err != nil {
return "", err
return nil, err
}
}

Expand All @@ -51,13 +51,13 @@ func (h *CLIHandler) Auth(c *api.Client, m map[string]string) (string, error) {
path := fmt.Sprintf("auth/%s/login/%s", mount, username)
secret, err := c.Logical().Write(path, data)
if err != nil {
return "", err
return nil, err
}
if secret == nil {
return "", fmt.Errorf("empty response from credential provider")
return nil, fmt.Errorf("empty response from credential provider")
}

return secret.Auth.ClientToken, nil
return secret, nil
}

func (h *CLIHandler) Help() string {
Expand Down
12 changes: 6 additions & 6 deletions builtin/credential/okta/cli.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,15 +13,15 @@ import (
type CLIHandler struct{}

// Auth cli method
func (h *CLIHandler) Auth(c *api.Client, m map[string]string) (string, error) {
func (h *CLIHandler) Auth(c *api.Client, m map[string]string) (*api.Secret, error) {
mount, ok := m["mount"]
if !ok {
mount = "okta"
}

username, ok := m["username"]
if !ok {
return "", fmt.Errorf("'username' var must be set")
return nil, fmt.Errorf("'username' var must be set")
}
password, ok := m["password"]
if !ok {
Expand All @@ -30,7 +30,7 @@ func (h *CLIHandler) Auth(c *api.Client, m map[string]string) (string, error) {
password, err = pwd.Read(os.Stdin)
fmt.Println()
if err != nil {
return "", err
return nil, err
}
}

Expand All @@ -41,13 +41,13 @@ func (h *CLIHandler) Auth(c *api.Client, m map[string]string) (string, error) {
path := fmt.Sprintf("auth/%s/login/%s", mount, username)
secret, err := c.Logical().Write(path, data)
if err != nil {
return "", err
return nil, err
}
if secret == nil {
return "", fmt.Errorf("empty response from credential provider")
return nil, fmt.Errorf("empty response from credential provider")
}

return secret.Auth.ClientToken, nil
return secret, nil
}

// Help method for okta cli
Expand Down
14 changes: 7 additions & 7 deletions builtin/credential/userpass/cli.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ type CLIHandler struct {
DefaultMount string
}

func (h *CLIHandler) Auth(c *api.Client, m map[string]string) (string, error) {
func (h *CLIHandler) Auth(c *api.Client, m map[string]string) (*api.Secret, error) {
var data struct {
Username string `mapstructure:"username"`
Password string `mapstructure:"password"`
Expand All @@ -23,18 +23,18 @@ func (h *CLIHandler) Auth(c *api.Client, m map[string]string) (string, error) {
Passcode string `mapstructure:"passcode"`
}
if err := mapstructure.WeakDecode(m, &data); err != nil {
return "", err
return nil, err
}

if data.Username == "" {
return "", fmt.Errorf("'username' must be specified")
return nil, fmt.Errorf("'username' must be specified")
}
if data.Password == "" {
fmt.Printf("Password (will be hidden): ")
password, err := pwd.Read(os.Stdin)
fmt.Println()
if err != nil {
return "", err
return nil, err
}
data.Password = password
}
Expand All @@ -55,13 +55,13 @@ func (h *CLIHandler) Auth(c *api.Client, m map[string]string) (string, error) {
path := fmt.Sprintf("auth/%s/login/%s", data.Mount, data.Username)
secret, err := c.Logical().Write(path, options)
if err != nil {
return "", err
return nil, err
}
if secret == nil {
return "", fmt.Errorf("empty response from credential provider")
return nil, fmt.Errorf("empty response from credential provider")
}

return secret.Auth.ClientToken, nil
return secret, nil
}

func (h *CLIHandler) Help() string {
Expand Down
Loading

0 comments on commit 79b63de

Please sign in to comment.