-
Notifications
You must be signed in to change notification settings - Fork 0
/
path_config_rotate_root.go
70 lines (58 loc) · 2 KB
/
path_config_rotate_root.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
package auth0
import (
"context"
"fmt"
"github.com/hashicorp/errwrap"
"github.com/hashicorp/vault/sdk/framework"
"github.com/hashicorp/vault/sdk/logical"
)
func pathConfigRotateRoot(b *backend) *framework.Path {
return &framework.Path{
Pattern: "config/rotate-root",
Operations: map[logical.Operation]framework.OperationHandler{
logical.UpdateOperation: &framework.PathOperation{
Callback: b.pathConfigRotateRootUpdate,
},
},
HelpSynopsis: pathConfigRotateRootHelpSyn,
HelpDescription: pathConfigRotateRootHelpDesc,
}
}
func (b *backend) pathConfigRotateRootUpdate(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
config, err := b.readConfigRoot(ctx, req.Storage)
if err != nil {
return nil, errwrap.Wrapf("error reading root configuration: {{err}}", err)
}
client, err := b.client(ctx, req.Storage)
if err != nil {
return logical.ErrorResponse(fmt.Sprintf("failed to create the auth0 client. err: %s", err)), nil
}
if client == nil {
return nil, fmt.Errorf("nil client")
}
resp, err := client.rotateSecret(config.ClientID)
if err != nil {
return logical.ErrorResponse(fmt.Sprintf("failed to rotate client secret. err: %s", err)), nil
}
config.ClientSecret = resp.ClientSecret
newEntry, err := logical.StorageEntryJSON(configTokenKey, config)
if err != nil {
return nil, errwrap.Wrapf("error generating new config/root JSON: {{err}}", err)
}
if err := req.Storage.Put(ctx, newEntry); err != nil {
return nil, errwrap.Wrapf("error saving new config/root: {{err}}", err)
}
return &logical.Response{
Data: map[string]interface{}{
"id": config.ClientID,
"domain": config.Domain,
},
}, nil
}
const pathConfigRotateRootHelpSyn = `
Request to rotate the root cloudflare token used by Vault
`
const pathConfigRotateRootHelpDesc = `
This path attempts to rotate the cloudflare credentials used by Vault for
this mount. It is only valid if Vault has been configured to use cloudflare
token via the config/token endpoint.`