Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Backports for 1.9.x #74

Merged
merged 4 commits into from
Oct 28, 2021
Merged

Backports for 1.9.x #74

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
39942b0
Fix panic caused by shallowed error in create application (#71)
jasonodonnell Oct 18, 2021
50959c2
Remove named returns (#72)
jasonodonnell Oct 18, 2021
d0bc473
Update deps (#73)
benashz Oct 27, 2021
b6bdd8a
Add rotate-root endpoint (#70)
pcman312 Oct 28, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ jobs:
GO111MODULE: on
strategy:
matrix:
go-version: [1.14.x, 1.15.x, 1.16.x]
go-version: [1.16.x, 1.17.2]
os: [ubuntu-latest, macos-latest]
runs-on: ${{ matrix.os }}
steps:
Expand Down
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ Success! Enabled the azure secrets engine at: azure/

If you wish to work on this plugin, you'll first need
[Go](https://www.golang.org) installed on your machine
(version 1.10+ is *required*).
(version 1.17+ is *required*).

For local dev first make sure Go is properly installed, including
setting up a [GOPATH](https://golang.org/doc/code.html#GOPATH).
Expand Down
18 changes: 8 additions & 10 deletions api/api.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ package api

import (
"context"
"time"

"github.com/Azure/azure-sdk-for-go/profiles/latest/authorization/mgmt/authorization"
"github.com/Azure/go-autorest/autorest"
Expand Down Expand Up @@ -31,20 +32,17 @@ type ApplicationsClient interface {
GetApplication(ctx context.Context, applicationObjectID string) (ApplicationResult, error)
CreateApplication(ctx context.Context, displayName string) (ApplicationResult, error)
DeleteApplication(ctx context.Context, applicationObjectID string) error
AddApplicationPassword(ctx context.Context, applicationObjectID string, displayName string, endDateTime date.Time) (PasswordCredentialResult, error)
ListApplications(ctx context.Context, filter string) ([]ApplicationResult, error)
AddApplicationPassword(ctx context.Context, applicationObjectID string, displayName string, endDateTime time.Time) (PasswordCredentialResult, error)
RemoveApplicationPassword(ctx context.Context, applicationObjectID string, keyID string) error
}

type PasswordCredential struct {
DisplayName *string `json:"displayName"`
// StartDate - Start date.
StartDate *date.Time `json:"startDateTime,omitempty"`
// EndDate - End date.
EndDate *date.Time `json:"endDateTime,omitempty"`
// KeyID - Key ID.
KeyID *string `json:"keyId,omitempty"`
// Value - Key value.
SecretText *string `json:"secretText,omitempty"`
DisplayName *string `json:"displayName"`
StartDate *date.Time `json:"startDateTime,omitempty"`
EndDate *date.Time `json:"endDateTime,omitempty"`
KeyID *string `json:"keyId,omitempty"`
SecretText *string `json:"secretText,omitempty"`
}

type PasswordCredentialResult struct {
Expand Down
47 changes: 40 additions & 7 deletions api/application_aad.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ type ActiveDirectoryApplicationClient struct {
Passwords Passwords
}

func (a *ActiveDirectoryApplicationClient) GetApplication(ctx context.Context, applicationObjectID string) (result ApplicationResult, err error) {
func (a *ActiveDirectoryApplicationClient) GetApplication(ctx context.Context, applicationObjectID string) (ApplicationResult, error) {
app, err := a.Client.Get(ctx, applicationObjectID)
if err != nil {
return ApplicationResult{}, err
Expand All @@ -31,7 +31,40 @@ func (a *ActiveDirectoryApplicationClient) GetApplication(ctx context.Context, a
}, nil
}

func (a *ActiveDirectoryApplicationClient) CreateApplication(ctx context.Context, displayName string) (result ApplicationResult, err error) {
func (a *ActiveDirectoryApplicationClient) ListApplications(ctx context.Context, filter string) ([]ApplicationResult, error) {
resp, err := a.Client.List(ctx, filter)
if err != nil {
return nil, err
}

results := []ApplicationResult{}
for resp.NotDone() {
for _, app := range resp.Values() {
passCreds := []*PasswordCredential{}
for _, rawPC := range *app.PasswordCredentials {
pc := &PasswordCredential{
StartDate: rawPC.StartDate,
EndDate: rawPC.EndDate,
KeyID: rawPC.KeyID,
}
passCreds = append(passCreds, pc)
}
appResult := ApplicationResult{
AppID: app.AppID,
ID: app.ObjectID,
PasswordCredentials: passCreds,
}
results = append(results, appResult)
}
err = resp.NextWithContext(ctx)
if err != nil {
return results, fmt.Errorf("failed to get all results: %w", err)
}
}
return results, nil
}

func (a *ActiveDirectoryApplicationClient) CreateApplication(ctx context.Context, displayName string) (ApplicationResult, error) {
appURL := fmt.Sprintf("https://%s", displayName)

app, err := a.Client.Create(ctx, graphrbac.ApplicationCreateParameters{
Expand Down Expand Up @@ -62,7 +95,7 @@ func (a *ActiveDirectoryApplicationClient) DeleteApplication(ctx context.Context
return nil
}

func (a *ActiveDirectoryApplicationClient) AddApplicationPassword(ctx context.Context, applicationObjectID string, displayName string, endDateTime date.Time) (result PasswordCredentialResult, err error) {
func (a *ActiveDirectoryApplicationClient) AddApplicationPassword(ctx context.Context, applicationObjectID string, displayName string, endDateTime time.Time) (PasswordCredentialResult, error) {
keyID, err := uuid.GenerateUUID()
if err != nil {
return PasswordCredentialResult{}, err
Expand All @@ -80,7 +113,7 @@ func (a *ActiveDirectoryApplicationClient) AddApplicationPassword(ctx context.Co
now := date.Time{Time: time.Now().UTC()}
cred := graphrbac.PasswordCredential{
StartDate: &now,
EndDate: &endDateTime,
EndDate: &date.Time{endDateTime},
KeyID: to.StringPtr(keyID),
Value: to.StringPtr(password),
}
Expand All @@ -106,19 +139,19 @@ func (a *ActiveDirectoryApplicationClient) AddApplicationPassword(ctx context.Co
return PasswordCredentialResult{}, fmt.Errorf("error updating credentials: %w", err)
}

result = PasswordCredentialResult{
result := PasswordCredentialResult{
PasswordCredential: PasswordCredential{
DisplayName: to.StringPtr(displayName),
StartDate: &now,
EndDate: &endDateTime,
EndDate: &date.Time{endDateTime},
KeyID: to.StringPtr(keyID),
SecretText: to.StringPtr(password),
},
}
return result, nil
}

func (a *ActiveDirectoryApplicationClient) RemoveApplicationPassword(ctx context.Context, applicationObjectID string, keyID string) (err error) {
func (a *ActiveDirectoryApplicationClient) RemoveApplicationPassword(ctx context.Context, applicationObjectID string, keyID string) error {
// Load current credentials
resp, err := a.Client.ListPasswordCredentials(ctx, applicationObjectID)
if err != nil {
Expand Down
96 changes: 66 additions & 30 deletions api/application_msgraph.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,8 @@ func (c *AppClient) AddToUserAgent(extension string) error {
return c.client.AddToUserAgent(extension)
}

func (c *AppClient) GetApplication(ctx context.Context, applicationObjectID string) (result ApplicationResult, err error) {
func (c *AppClient) GetApplication(ctx context.Context, applicationObjectID string) (ApplicationResult, error) {
var result ApplicationResult
req, err := c.getApplicationPreparer(ctx, applicationObjectID)
if err != nil {
return result, autorest.NewErrorWithError(err, "provider", "GetApplication", nil, "Failure preparing request")
Expand All @@ -71,8 +72,35 @@ func (c *AppClient) GetApplication(ctx context.Context, applicationObjectID stri
return result, nil
}

type listApplicationsResponse struct {
Value []ApplicationResult `json:"value"`
}

func (c *AppClient) ListApplications(ctx context.Context, filter string) ([]ApplicationResult, error) {
filterArgs := url.Values{}
if filter != "" {
filterArgs.Set("$filter", filter)
}
preparer := c.GetPreparer(
autorest.AsGet(),
autorest.WithPath(fmt.Sprintf("/v1.0/applications?%s", filterArgs.Encode())),
)
listAppResp := listApplicationsResponse{}
err := c.SendRequest(ctx, preparer,
azure.WithErrorUnlessStatusCode(http.StatusOK),
autorest.ByUnmarshallingJSON(&listAppResp),
)
if err != nil {
return nil, err
}

return listAppResp.Value, nil
}

// CreateApplication create a new Azure application object.
func (c *AppClient) CreateApplication(ctx context.Context, displayName string) (result ApplicationResult, err error) {
func (c *AppClient) CreateApplication(ctx context.Context, displayName string) (ApplicationResult, error) {
var result ApplicationResult

req, err := c.createApplicationPreparer(ctx, displayName)
if err != nil {
return result, autorest.NewErrorWithError(err, "provider", "CreateApplication", nil, "Failure preparing request")
Expand All @@ -95,7 +123,7 @@ func (c *AppClient) CreateApplication(ctx context.Context, displayName string) (

// DeleteApplication deletes an Azure application object.
// This will in turn remove the service principal (but not the role assignments).
func (c *AppClient) DeleteApplication(ctx context.Context, applicationObjectID string) (err error) {
func (c *AppClient) DeleteApplication(ctx context.Context, applicationObjectID string) error {
req, err := c.deleteApplicationPreparer(ctx, applicationObjectID)
if err != nil {
return autorest.NewErrorWithError(err, "provider", "DeleteApplication", nil, "Failure preparing request")
Expand All @@ -111,32 +139,36 @@ func (c *AppClient) DeleteApplication(ctx context.Context, applicationObjectID s
c.client.ByInspecting(),
azure.WithErrorUnlessStatusCode(http.StatusNoContent, http.StatusNotFound),
autorest.ByClosing())
return autorest.NewErrorWithError(err, "provider", "DeleteApplication", resp, "Failure responding to request")

if err != nil {
return autorest.NewErrorWithError(err, "provider", "DeleteApplication", resp, "Failure responding to request")
}
return nil
}

func (c *AppClient) AddApplicationPassword(ctx context.Context, applicationObjectID string, displayName string, endDateTime date.Time) (result PasswordCredentialResult, err error) {
req, err := c.addPasswordPreparer(ctx, applicationObjectID, displayName, endDateTime)
func (c *AppClient) AddApplicationPassword(ctx context.Context, applicationObjectID string, displayName string, endDateTime time.Time) (PasswordCredentialResult, error) {
req, err := c.addPasswordPreparer(ctx, applicationObjectID, displayName, date.Time{endDateTime})
if err != nil {
return PasswordCredentialResult{}, autorest.NewErrorWithError(err, "provider", "AddApplicationPassword", nil, "Failure preparing request")
}

resp, err := c.addPasswordSender(req)
if err != nil {
result = PasswordCredentialResult{
result := PasswordCredentialResult{
Response: autorest.Response{Response: resp},
}
return result, autorest.NewErrorWithError(err, "provider", "AddApplicationPassword", resp, "Failure sending request")
}

result, err = c.addPasswordResponder(resp)
result, err := c.addPasswordResponder(resp)
if err != nil {
return result, autorest.NewErrorWithError(err, "provider", "AddApplicationPassword", resp, "Failure responding to request")
}

return result, nil
}

func (c *AppClient) RemoveApplicationPassword(ctx context.Context, applicationObjectID string, keyID string) (err error) {
func (c *AppClient) RemoveApplicationPassword(ctx context.Context, applicationObjectID string, keyID string) error {
req, err := c.removePasswordPreparer(ctx, applicationObjectID, keyID)
if err != nil {
return autorest.NewErrorWithError(err, "provider", "RemoveApplicationPassword", nil, "Failure preparing request")
Expand Down Expand Up @@ -174,8 +206,9 @@ func (c AppClient) getApplicationSender(req *http.Request) (*http.Response, erro
return autorest.SendWithSender(c.client, req, sd...)
}

func (c AppClient) getApplicationResponder(resp *http.Response) (result ApplicationResult, err error) {
err = autorest.Respond(
func (c AppClient) getApplicationResponder(resp *http.Response) (ApplicationResult, error) {
var result ApplicationResult
err := autorest.Respond(
resp,
c.client.ByInspecting(),
azure.WithErrorUnlessStatusCode(http.StatusOK),
Expand Down Expand Up @@ -214,8 +247,9 @@ func (c AppClient) addPasswordSender(req *http.Request) (*http.Response, error)
return autorest.SendWithSender(c.client, req, sd...)
}

func (c AppClient) addPasswordResponder(resp *http.Response) (result PasswordCredentialResult, err error) {
err = autorest.Respond(
func (c AppClient) addPasswordResponder(resp *http.Response) (PasswordCredentialResult, error) {
var result PasswordCredentialResult
err := autorest.Respond(
resp,
c.client.ByInspecting(),
azure.WithErrorUnlessStatusCode(http.StatusOK),
Expand Down Expand Up @@ -251,8 +285,9 @@ func (c AppClient) removePasswordSender(req *http.Request) (*http.Response, erro
return autorest.SendWithSender(c.client, req, sd...)
}

func (c AppClient) removePasswordResponder(resp *http.Response) (result autorest.Response, err error) {
err = autorest.Respond(
func (c AppClient) removePasswordResponder(resp *http.Response) (autorest.Response, error) {
var result autorest.Response
err := autorest.Respond(
resp,
c.client.ByInspecting(),
azure.WithErrorUnlessStatusCode(http.StatusNoContent),
Expand Down Expand Up @@ -284,15 +319,16 @@ func (c AppClient) createApplicationSender(req *http.Request) (*http.Response, e
return autorest.SendWithSender(c.client, req, sd...)
}

func (c AppClient) createApplicationResponder(resp *http.Response) (result ApplicationResult, err error) {
err = autorest.Respond(
func (c AppClient) createApplicationResponder(resp *http.Response) (ApplicationResult, error) {
var result ApplicationResult
err := autorest.Respond(
resp,
c.client.ByInspecting(),
azure.WithErrorUnlessStatusCode(http.StatusCreated),
autorest.ByUnmarshallingJSON(&result),
autorest.ByClosing())
result.Response = autorest.Response{Response: resp}
return result, nil
return result, err
}

func (c AppClient) deleteApplicationPreparer(ctx context.Context, applicationObjectID string) (*http.Request, error) {
Expand Down Expand Up @@ -360,7 +396,7 @@ type groupResponse struct {
DisplayName string `json:"displayName"`
}

func (c AppClient) GetGroup(ctx context.Context, groupID string) (result Group, err error) {
func (c AppClient) GetGroup(ctx context.Context, groupID string) (Group, error) {
if groupID == "" {
return Group{}, fmt.Errorf("missing groupID")
}
Expand All @@ -374,7 +410,7 @@ func (c AppClient) GetGroup(ctx context.Context, groupID string) (result Group,
)

groupResp := groupResponse{}
err = c.SendRequest(ctx, preparer,
err := c.SendRequest(ctx, preparer,
azure.WithErrorUnlessStatusCode(http.StatusOK, http.StatusNoContent),
autorest.ByUnmarshallingJSON(&groupResp),
)
Expand All @@ -396,7 +432,7 @@ type listGroupsResponse struct {
Groups []groupResponse `json:"value"`
}

func (c AppClient) ListGroups(ctx context.Context, filter string) (result []Group, err error) {
func (c AppClient) ListGroups(ctx context.Context, filter string) ([]Group, error) {
filterArgs := url.Values{}
if filter != "" {
filterArgs.Set("$filter", filter)
Expand All @@ -408,7 +444,7 @@ func (c AppClient) ListGroups(ctx context.Context, filter string) (result []Grou
)

respBody := listGroupsResponse{}
err = c.SendRequest(ctx, preparer,
err := c.SendRequest(ctx, preparer,
azure.WithErrorUnlessStatusCode(http.StatusOK, http.StatusNoContent),
autorest.ByUnmarshallingJSON(&respBody),
)
Expand All @@ -431,12 +467,12 @@ func (c AppClient) ListGroups(ctx context.Context, filter string) (result []Grou
return groups, nil
}

func (c *AppClient) CreateServicePrincipal(ctx context.Context, appID string, startDate time.Time, endDate time.Time) (spID string, password string, err error) {
spID, err = c.createServicePrincipal(ctx, appID)
func (c *AppClient) CreateServicePrincipal(ctx context.Context, appID string, startDate time.Time, endDate time.Time) (string, string, error) {
spID, err := c.createServicePrincipal(ctx, appID)
if err != nil {
return "", "", err
}
password, err = c.setPasswordForServicePrincipal(ctx, spID, startDate, endDate)
password, err := c.setPasswordForServicePrincipal(ctx, spID, startDate, endDate)
if err != nil {
dErr := c.deleteServicePrincipal(ctx, spID)
merr := multierror.Append(err, dErr)
Expand All @@ -445,7 +481,7 @@ func (c *AppClient) CreateServicePrincipal(ctx context.Context, appID string, st
return spID, password, nil
}

func (c *AppClient) createServicePrincipal(ctx context.Context, appID string) (id string, err error) {
func (c *AppClient) createServicePrincipal(ctx context.Context, appID string) (string, error) {
body := map[string]interface{}{
"appId": appID,
"accountEnabled": true,
Expand All @@ -457,7 +493,7 @@ func (c *AppClient) createServicePrincipal(ctx context.Context, appID string) (i
)

respBody := createServicePrincipalResponse{}
err = c.SendRequest(ctx, preparer,
err := c.SendRequest(ctx, preparer,
autorest.WithErrorUnlessStatusCode(http.StatusOK, http.StatusCreated),
autorest.ByUnmarshallingJSON(&respBody),
)
Expand All @@ -468,13 +504,13 @@ func (c *AppClient) createServicePrincipal(ctx context.Context, appID string) (i
return respBody.ID, nil
}

func (c *AppClient) setPasswordForServicePrincipal(ctx context.Context, spID string, startDate time.Time, endDate time.Time) (password string, err error) {
func (c *AppClient) setPasswordForServicePrincipal(ctx context.Context, spID string, startDate time.Time, endDate time.Time) (string, error) {
pathParams := map[string]interface{}{
"id": spID,
}
reqBody := map[string]interface{}{
"startDateTime": startDate.UTC().Format("2006-01-02T15:04:05Z"),
"endDateTime": startDate.UTC().Format("2006-01-02T15:04:05Z"),
"endDateTime": endDate.UTC().Format("2006-01-02T15:04:05Z"),
}

preparer := c.GetPreparer(
Expand All @@ -484,7 +520,7 @@ func (c *AppClient) setPasswordForServicePrincipal(ctx context.Context, spID str
)

respBody := PasswordCredential{}
err = c.SendRequest(ctx, preparer,
err := c.SendRequest(ctx, preparer,
autorest.WithErrorUnlessStatusCode(http.StatusOK, http.StatusNoContent),
autorest.ByUnmarshallingJSON(&respBody),
)
Expand Down