From 3ea8ebf8aa5bf7f45335c008afd49da6d83d425a Mon Sep 17 00:00:00 2001
From: Ed Cook <ecook@pivotal.io>
Date: Wed, 13 May 2020 16:50:48 +0100
Subject: [PATCH] Add support for using om client credentials

- `om` uses client credentials over username/password if both are set,
`hammer om` does not do anything to avoid this behaviour
---
 README.md                                     |  8 +++++
 environment/config.go                         | 36 +++++++++++--------
 environment/config_test.go                    | 14 ++++----
 environment/fixtures/lemon.json               |  2 ++
 environment/fixtures/lemon.yaml               |  2 ++
 .../fixtures/claim_manatee_response.json      |  2 ++
 integration/fixtures/om_script.sh             |  2 +-
 integration/fixtures/om_script_json.sh        |  2 +-
 integration/om_command_test.go                |  2 +-
 om/runner.go                                  | 16 ++++++---
 om/runner_test.go                             | 18 ++++++----
 11 files changed, 69 insertions(+), 35 deletions(-)

diff --git a/README.md b/README.md
index 01d5da0..2258646 100644
--- a/README.md
+++ b/README.md
@@ -25,6 +25,8 @@ In order to run the `hammer` tool against a given environment you need to have a
   "name": "ENVIRONMENT-NAME",
   "ops_manager": {
     "url": "OPSMAN-URL",
+    "client_id": "OPSMAN-CLIENT-ID",
+    "client_secret": "OPSMAN-CLIENT-SECRET",
     "username": "OPSMAN-USERNAME",
     "password": "OPSMAN-PASSWORD"
   },
@@ -41,6 +43,8 @@ Or the equivalent in yaml:
 ```yaml
 name: ENVIRONMENT-NAME
 ops_manager:
+  client_id: OPSMAN-CLIENT-ID
+  client_secret: OPSMAN-CLIENT-SECRET
   password: OPSMAN-PASSWORD
   url: OPSMAN-URL
   username: OPSMAN-USERNAME
@@ -56,6 +60,10 @@ This file can then be passed into the tool via `hammer -t path-to-env-config <co
 `ops_manager_ssh_user` is an optional field and if not set then `hammer -t path-to-env-config ssh opsman` will use
 `ubuntu` to ssh to the OpsManager VM, if users need to ssh via a different username they should set this as appropriate.
 
+Only one set of `ops_manager.client_id` and `ops_manager.client_secret` or `ops_manager.username` and `ops_manager.password`
+need to be specified in order to use `hammer om`, if both sets are specified then in line with `om` the client details
+will be used.
+
 NB: `sys_domain` and `pks_api.url` are only needed for using `hammer cf-login` and `hammer pks-login` respectively.
 
 ## Development
diff --git a/environment/config.go b/environment/config.go
index fb34899..4bf8d95 100644
--- a/environment/config.go
+++ b/environment/config.go
@@ -23,12 +23,14 @@ import (
 const defaultSSHUser = "ubuntu"
 
 type OpsManager struct {
-	Username   string
-	Password   string
-	URL        url.URL
-	IP         net.IP
-	PrivateKey string
-	SshUser    string
+	Username     string
+	Password     string
+	ClientID     string
+	ClientSecret string
+	URL          url.URL
+	IP           net.IP
+	PrivateKey   string
+	SshUser      string
 }
 
 type PKSApi struct {
@@ -61,9 +63,11 @@ type environmentReader struct {
 	ServiceSubnet string   `yaml:"service_subnet_name"`
 	AZs           []string `yaml:"azs"`
 	OpsManager    struct {
-		URL      string `yaml:"url"`
-		Username string `yaml:"username"`
-		Password string `yaml:"password"`
+		URL          string `yaml:"url"`
+		Username     string `yaml:"username"`
+		Password     string `yaml:"password"`
+		ClientID     string `yaml:"client_id"`
+		ClientSecret string `yaml:"client_secret"`
 	} `yaml:"ops_manager"`
 	PKSApi struct {
 		Username string `yaml:"uaa_admin_user"`
@@ -127,12 +131,14 @@ func newLockfile(data environmentReader) (Config, error) {
 		ServiceSubnet: data.ServiceSubnet,
 		AZs:           data.AZs,
 		OpsManager: OpsManager{
-			Username:   data.OpsManager.Username,
-			Password:   data.OpsManager.Password,
-			URL:        *parsedOpsManagerURL,
-			IP:         opsManagerIp,
-			PrivateKey: data.PrivateKey,
-			SshUser:    sshUser,
+			Username:     data.OpsManager.Username,
+			Password:     data.OpsManager.Password,
+			ClientID:     data.OpsManager.ClientID,
+			ClientSecret: data.OpsManager.ClientSecret,
+			URL:          *parsedOpsManagerURL,
+			IP:           opsManagerIp,
+			PrivateKey:   data.PrivateKey,
+			SshUser:      sshUser,
 		},
 		PKSApi: PKSApi{
 			Username: data.PKSApi.Username,
diff --git a/environment/config_test.go b/environment/config_test.go
index 9309e40..da6f92e 100644
--- a/environment/config_test.go
+++ b/environment/config_test.go
@@ -76,12 +76,14 @@ func checkMatchLemon(e Config) {
 			"URL":      Equal(mustParseURL("https://api.pks.lemon-lemon.cf-app.com")),
 		}),
 		"OpsManager": MatchAllFields(Fields{
-			"Username":   Equal("pivotalcf"),
-			"Password":   Equal("fakePassword"),
-			"URL":        Equal(mustParseURL("https://pcf.lemon.cf-app.com")),
-			"IP":         Equal(net.ParseIP("35.225.148.133")),
-			"SshUser":    Equal("ubuntu"),
-			"PrivateKey": ContainSubstring("BEGIN RSA"),
+			"Username":     Equal("pivotalcf"),
+			"Password":     Equal("fakePassword"),
+			"ClientID":     Equal("fakeClientID"),
+			"ClientSecret": Equal("fakeClientSecret"),
+			"URL":          Equal(mustParseURL("https://pcf.lemon.cf-app.com")),
+			"IP":           Equal(net.ParseIP("35.225.148.133")),
+			"SshUser":      Equal("ubuntu"),
+			"PrivateKey":   ContainSubstring("BEGIN RSA"),
 		}),
 	}))
 }
diff --git a/environment/fixtures/lemon.json b/environment/fixtures/lemon.json
index 3e2d2c6..1210598 100644
--- a/environment/fixtures/lemon.json
+++ b/environment/fixtures/lemon.json
@@ -22,6 +22,8 @@
   "ops_manager": {
     "password": "fakePassword",
     "url": "https://pcf.lemon.cf-app.com",
+    "client_id": "fakeClientID",
+    "client_secret": "fakeClientSecret",
     "username": "pivotalcf"
   },
   "ops_manager_cidr": "10.0.0.0/24",
diff --git a/environment/fixtures/lemon.yaml b/environment/fixtures/lemon.yaml
index 21a5ea5..d7c60ee 100644
--- a/environment/fixtures/lemon.yaml
+++ b/environment/fixtures/lemon.yaml
@@ -20,6 +20,8 @@ name: lemon
 ops_manager:
   password: fakePassword
   url: https://pcf.lemon.cf-app.com
+  client_id: "fakeClientID"
+  client_secret: "fakeClientSecret"
   username: pivotalcf
 ops_manager_cidr: 10.0.0.0/24
 ops_manager_dns: pcf.lemon.cf-app.com
diff --git a/integration/fixtures/claim_manatee_response.json b/integration/fixtures/claim_manatee_response.json
index 79ff3b0..5e21177 100644
--- a/integration/fixtures/claim_manatee_response.json
+++ b/integration/fixtures/claim_manatee_response.json
@@ -22,6 +22,8 @@
   "ops_manager": {
     "password": "fakePassword",
     "url": "https://pcf.manatee.cf-app.com",
+    "client_id": "fakeClientID",
+    "client_secret": "fakeClientSecret",
     "username": "pivotalcf"
   },
   "ops_manager_cidr": "10.0.0.0/24",
diff --git a/integration/fixtures/om_script.sh b/integration/fixtures/om_script.sh
index 9e3eb35..7fa07ed 100644
--- a/integration/fixtures/om_script.sh
+++ b/integration/fixtures/om_script.sh
@@ -1 +1 @@
-om -t 'https://pcf.manatee.cf-app.com' -k -u 'pivotalcf' -p 'fakePassword' 'foo'
+OM_CLIENT_ID='fakeClientID' OM_CLIENT_SECRET='fakeClientSecret' OM_USERNAME='pivotalcf' OM_PASSWORD='fakePassword' om -t 'https://pcf.manatee.cf-app.com' -k 'foo'
diff --git a/integration/fixtures/om_script_json.sh b/integration/fixtures/om_script_json.sh
index 4eb9309..0db731c 100644
--- a/integration/fixtures/om_script_json.sh
+++ b/integration/fixtures/om_script_json.sh
@@ -1 +1 @@
-om -t 'https://pcf.manatee.cf-app.com' -k -u 'pivotalcf' -p 'fakePassword' 'configure-product' '--product-name' 'p-rabbitmq' '--product-properties' '{".rabbitmq-server.server_admin_credentials":{"value":{"identity":"admin","password":"admin"}}}'
+OM_CLIENT_ID='fakeClientID' OM_CLIENT_SECRET='fakeClientSecret' OM_USERNAME='pivotalcf' OM_PASSWORD='fakePassword' om -t 'https://pcf.manatee.cf-app.com' -k 'configure-product' '--product-name' 'p-rabbitmq' '--product-properties' '{".rabbitmq-server.server_admin_credentials":{"value":{"identity":"admin","password":"admin"}}}'
diff --git a/integration/om_command_test.go b/integration/om_command_test.go
index 11407ab..597210d 100644
--- a/integration/om_command_test.go
+++ b/integration/om_command_test.go
@@ -67,7 +67,7 @@ var _ = Describe("OM", func() {
 
 			Eventually(session).Should(Exit(0))
 			Eventually(string(session.Err.Contents())).Should(Equal(""))
-			Eventually(string(session.Out.Contents())).Should(Equal("# om\nexport OM_TARGET=https://pcf.manatee.cf-app.com\nexport OM_USERNAME=pivotalcf\nexport OM_PASSWORD=fakePassword\n"))
+			Eventually(string(session.Out.Contents())).Should(Equal("# om\nexport OM_TARGET='https://pcf.manatee.cf-app.com'\nexport OM_CLIENT_ID='fakeClientID'\nexport OM_CLIENT_SECRET='fakeClientSecret'\nexport OM_USERNAME='pivotalcf'\nexport OM_PASSWORD='fakePassword'\n"))
 		})
 	})
 })
diff --git a/om/runner.go b/om/runner.go
index fc36d3e..6252848 100644
--- a/om/runner.go
+++ b/om/runner.go
@@ -28,14 +28,22 @@ func (r Runner) Run(data environment.Config, dryRun bool, omArgs ...string) erro
 
 	if len(omArgs) > 0 {
 		omCommandLines = []string{
-			fmt.Sprintf(`om -t '%s' -k -u '%s' -p '%s' %s`, data.OpsManager.URL.String(), data.OpsManager.Username, data.OpsManager.Password, quoteArgs(omArgs)),
+			fmt.Sprintf(`OM_CLIENT_ID='%s' OM_CLIENT_SECRET='%s' OM_USERNAME='%s' OM_PASSWORD='%s' om -t '%s' -k %s`,
+				data.OpsManager.ClientID,
+				data.OpsManager.ClientSecret,
+				data.OpsManager.Username,
+				data.OpsManager.Password,
+				data.OpsManager.URL.String(),
+				quoteArgs(omArgs)),
 		}
 		omPrereqs = []string{"om"}
 	} else {
 		omCommandLines = []string{
-			fmt.Sprintf(`echo "export OM_TARGET=%s"`, data.OpsManager.URL.String()),
-			fmt.Sprintf(`echo "export OM_USERNAME=%s"`, data.OpsManager.Username),
-			fmt.Sprintf(`echo "export OM_PASSWORD=%s"`, data.OpsManager.Password),
+			fmt.Sprintf(`echo "export OM_TARGET='%s'"`, data.OpsManager.URL.String()),
+			fmt.Sprintf(`echo "export OM_CLIENT_ID='%s'"`, data.OpsManager.ClientID),
+			fmt.Sprintf(`echo "export OM_CLIENT_SECRET='%s'"`, data.OpsManager.ClientSecret),
+			fmt.Sprintf(`echo "export OM_USERNAME='%s'"`, data.OpsManager.Username),
+			fmt.Sprintf(`echo "export OM_PASSWORD='%s'"`, data.OpsManager.Password),
 		}
 	}
 
diff --git a/om/runner_test.go b/om/runner_test.go
index 179f18d..298ee3c 100644
--- a/om/runner_test.go
+++ b/om/runner_test.go
@@ -39,9 +39,11 @@ var _ = Describe("om runner", func() {
 		url, _ := url.Parse("https://www.test-url.io")
 		data = environment.Config{
 			OpsManager: environment.OpsManager{
-				URL:      *url,
-				Username: "username",
-				Password: "password",
+				URL:          *url,
+				Username:     "username",
+				Password:     "password",
+				ClientID:     "client_id",
+				ClientSecret: "client_secret",
 			},
 		}
 
@@ -64,9 +66,11 @@ var _ = Describe("om runner", func() {
 
 			lines, prereqs, _ := scriptRunner.RunScriptArgsForCall(0)
 			Expect(lines).To(Equal([]string{
-				`echo "export OM_TARGET=https://www.test-url.io"`,
-				`echo "export OM_USERNAME=username"`,
-				`echo "export OM_PASSWORD=password"`,
+				`echo "export OM_TARGET='https://www.test-url.io'"`,
+				`echo "export OM_CLIENT_ID='client_id'"`,
+				`echo "export OM_CLIENT_SECRET='client_secret'"`,
+				`echo "export OM_USERNAME='username'"`,
+				`echo "export OM_PASSWORD='password'"`,
 			}))
 			Expect(prereqs).To(HaveLen(0))
 		})
@@ -86,7 +90,7 @@ var _ = Describe("om runner", func() {
 
 			lines, prereqs, _ := scriptRunner.RunScriptArgsForCall(0)
 			Expect(lines).To(Equal([]string{
-				`om -t 'https://www.test-url.io' -k -u 'username' -p 'password' 'arg1' 'arg2' 'arg3'`,
+				`OM_CLIENT_ID='client_id' OM_CLIENT_SECRET='client_secret' OM_USERNAME='username' OM_PASSWORD='password' om -t 'https://www.test-url.io' -k 'arg1' 'arg2' 'arg3'`,
 			}))
 			Expect(prereqs).To(ConsistOf("om"))
 		})