Combined Database Backend: Static Accounts #6834
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
… Other cleanup after feedback
…base backend gPRC
…nd automatic rotation
…end, starting with PostgreSQL implementation
…he static database user on delete of the Vault role. Default false
|
Also there is a compilation error in one of the tests due to an unsatisfied interface https://circleci.com/gh/hashicorp/vault/2920#tests/containers/1. |
|
@chrishoffman I added stubs for the missing methods in 779e195 |
chrishoffman
previously approved these changes
Jun 18, 2019
chrishoffman
previously approved these changes
Jun 18, 2019
* master: (98 commits) Added a note about JWT (#6899) Update api and sdk to remove direct gogo dep Update sdk in api/ Remove gogo proto from where it snuck in fix failing region test fix test Update api/sdk in main repo Bump API's SDK version Return integers, not floats, when reading token params Update description field for some token store role values to be accurate Bump api/sdk dep Bump api against latest sdk Update go-plugin dep changelog++ Add a force capability to delete in the policy store Fix some tests add es docs to sidebars Upgrade github.com/lib/pq to pickup SCRAM-SHA-* methods (#6895) Update elasticdb.html.md update doc to 7.1.1 ...
catsby
dismissed
briankassouf’s stale review
I addressed Brian's feedback and got his approval to merge in a conversation off GitHub
This was referenced Jun 19, 2019
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Static Database Accounts with Automatic Rotation
This pull request introduces Static Accounts, adding support for managing traditional static credentials alongside our current dynamic credentials in the combined database secret backend, with automatic rotation. Static Accounts are Vault Roles that are associated with a specific username in a database that is automatically rotated by Vault on a user defined rotation period. To create a static account, users write to
/database/static-roles/:static-role-namesimilar to the existing dynamic roles, and supply new fields specific to static accounts:username(string, required): Name of the static user account for Vault to managerotation_period(string/int, required): Period for automatic credential rotation of the given username. Not valid unless used with "username".`rotation_statements(list, required): Specifies the database statements to be executed to rotate the accounts credentialsAfter successful creation, requesting credentials for the static account is done by reading
/database/static-creds/:static-role-name. The response contains theusername, current password, the date and time of the last password rotation performed by Vault, and the approximate TTL for the current password until the next rotation. Each subsequent call to read the credentials will return the same password value, up until the TTL reaches zero and the rotation occurs.Internally when static accounts are created they are added to an internal priority queue for tracking. Periodically (approximately every 5 seconds) the queue is checked for any accounts that require rotation. Accounts that need rotation are removed from the queue and have their passwords are rotated according to their
rotation_statements. The new passwords are saved and the static account is then placed back onto the queue with newly calculated time-to-rotate based on therotation_periodand the current time.This PR includes support for static accounts with the Postgres database backend only. Future database plugins can be added by fully implementing the new plugin methods that are added in this PR:
GenerateCredentials: returns a generated password according to the database plugin'sGeneratePasswordmethodSetCredentials: instructs the database plugin to set the specified database user's password to a specific, given valueThis pull request builds continues/supersedes #6680