Skip to content

Commit c0015bd

Browse files
benashzbenashz
authored
auth_login: enforce empty client token (hashicorp#2029)
other fixes: - parallelize AuthLogin tests - ensure VAULT_TOKEN is not set from the test make targets
1 parent 2653605 commit c0015bd

15 files changed

+301
-1
lines changed

‎Makefile

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ build: go-version-check fmtcheck
1515
go install
1616

1717
test: go-version-check fmtcheck
18-
TF_ACC= go test $(TESTARGS) -timeout 10m $(TEST_PATH)
18+
TF_ACC= VAULT_TOKEN= go test $(TESTARGS) -timeout 10m $(TEST_PATH)
1919

2020
testacc: fmtcheck
2121
TF_ACC=1 go test $(TESTARGS) -timeout 30m $(TEST_PATH)

‎internal/provider/auth.go

+4
Original file line numberDiff line numberDiff line change
@@ -211,6 +211,10 @@ func (l *AuthLoginCommon) copyParamsExcluding(excludes ...string) (map[string]in
211211
}
212212

213213
func (l *AuthLoginCommon) login(client *api.Client, path string, params map[string]interface{}) (*api.Secret, error) {
214+
if client.Token() != "" {
215+
return nil, fmt.Errorf("vault login client has a token set")
216+
}
217+
214218
return client.Logical().Write(path, params)
215219
}
216220

‎internal/provider/auth_aws_test.go

+21
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ package provider
55

66
import (
77
"encoding/json"
8+
"errors"
89
"fmt"
910
"net/http"
1011
"reflect"
@@ -286,9 +287,29 @@ func TestAuthLoginAWS_Login(t *testing.T) {
286287
wantErr: true,
287288
expectErr: authLoginInitCheckError,
288289
},
290+
{
291+
name: "error-vault-token-set",
292+
authLogin: &AuthLoginAWS{
293+
AuthLoginCommon{
294+
authField: "baz",
295+
mount: "foo",
296+
params: map[string]interface{}{
297+
consts.FieldRole: "bob",
298+
},
299+
initialized: true,
300+
},
301+
},
302+
handler: &testLoginHandler{
303+
handlerFunc: handlerFunc,
304+
},
305+
token: "foo",
306+
wantErr: true,
307+
expectErr: errors.New("vault login client has a token set"),
308+
},
289309
}
290310
for _, tt := range tests {
291311
t.Run(tt.name, func(t *testing.T) {
312+
t.Parallel()
292313
testAuthLogin(t, tt)
293314
})
294315
}

‎internal/provider/auth_azure_test.go

+23
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ package provider
55

66
import (
77
"encoding/json"
8+
"errors"
89
"fmt"
910
"net/http"
1011
"testing"
@@ -240,6 +241,27 @@ func TestAuthLoginAzure_Login(t *testing.T) {
240241
},
241242
wantErr: false,
242243
},
244+
{
245+
name: "error-vault-token-set",
246+
authLogin: &AuthLoginAzure{
247+
AuthLoginCommon: AuthLoginCommon{
248+
authField: consts.FieldAuthLoginAzure,
249+
params: map[string]interface{}{
250+
consts.FieldRole: "alice",
251+
consts.FieldJWT: "jwt1",
252+
consts.FieldSubscriptionID: "sub1",
253+
consts.FieldResourceGroupName: "res1",
254+
consts.FieldVMSSName: "vmss1",
255+
},
256+
initialized: true,
257+
},
258+
},
259+
handler: &testLoginHandler{
260+
handlerFunc: handlerFunc,
261+
},
262+
wantErr: true,
263+
expectErr: errors.New("vault login client has a token set"),
264+
},
243265
{
244266
name: "error-uninitialized",
245267
authLogin: &AuthLoginAzure{
@@ -258,6 +280,7 @@ func TestAuthLoginAzure_Login(t *testing.T) {
258280
}
259281
for _, tt := range tests {
260282
t.Run(tt.name, func(t *testing.T) {
283+
t.Parallel()
261284
testAuthLogin(t, tt)
262285
})
263286
}

‎internal/provider/auth_cert_test.go

+24
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ package provider
55

66
import (
77
"encoding/json"
8+
"errors"
89
"fmt"
910
"net/http"
1011
"os"
@@ -294,6 +295,28 @@ func TestAuthLoginCert_Login(t *testing.T) {
294295
tls: true,
295296
wantErr: false,
296297
},
298+
{
299+
name: "error-vault-token-set",
300+
authLogin: &AuthLoginCert{
301+
AuthLoginCommon{
302+
authField: "baz",
303+
mount: "qux",
304+
params: map[string]interface{}{
305+
consts.FieldName: "bob",
306+
consts.FieldCertFile: certFile,
307+
consts.FieldKeyFile: keyFile,
308+
consts.FieldSkipTLSVerify: true,
309+
},
310+
initialized: true,
311+
},
312+
},
313+
handler: &testLoginHandler{
314+
handlerFunc: handlerFunc,
315+
},
316+
token: "foo",
317+
wantErr: true,
318+
expectErr: errors.New("vault login client has a token set"),
319+
},
297320
{
298321
name: "error-uninitialized",
299322
authLogin: &AuthLoginCert{
@@ -312,6 +335,7 @@ func TestAuthLoginCert_Login(t *testing.T) {
312335
}
313336
for _, tt := range tests {
314337
t.Run(tt.name, func(t *testing.T) {
338+
t.Parallel()
315339
testAuthLogin(t, tt)
316340
})
317341
}

‎internal/provider/auth_gcp_test.go

+38
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ package provider
55

66
import (
77
"encoding/json"
8+
"errors"
89
"fmt"
910
"net/http"
1011
"os"
@@ -168,6 +169,42 @@ func TestAuthLoginGCP_Login(t *testing.T) {
168169
testutil.SkipTestEnvUnset(t, consts.EnvVarGoogleApplicationCreds, envVarGCPServiceAccount)
169170
},
170171
},
172+
{
173+
name: "error-vault-token-set",
174+
authLogin: &AuthLoginGCP{
175+
AuthLoginCommon{
176+
authField: "baz",
177+
mount: "qux",
178+
params: map[string]interface{}{
179+
consts.FieldRole: "bob",
180+
consts.FieldCredentials: os.Getenv(consts.EnvVarGoogleApplicationCreds),
181+
consts.FieldServiceAccount: os.Getenv(envVarGCPServiceAccount),
182+
},
183+
initialized: true,
184+
},
185+
},
186+
handler: &testLoginHandler{
187+
excludeParams: []string{consts.FieldJWT},
188+
handlerFunc: handlerFunc,
189+
},
190+
expectReqCount: 1,
191+
expectReqPaths: []string{
192+
"/v1/auth/qux/login",
193+
},
194+
expectReqParams: []map[string]interface{}{{
195+
consts.FieldRole: "bob",
196+
}},
197+
want: &api.Secret{
198+
Auth: &api.SecretAuth{
199+
Metadata: map[string]string{
200+
consts.FieldRole: "bob",
201+
},
202+
},
203+
},
204+
token: "foo",
205+
wantErr: true,
206+
expectErr: errors.New("vault login client has a token set"),
207+
},
171208
{
172209
name: "no-jwt",
173210
authLogin: &AuthLoginGCP{
@@ -201,6 +238,7 @@ func TestAuthLoginGCP_Login(t *testing.T) {
201238
}
202239
for _, tt := range tests {
203240
t.Run(tt.name, func(t *testing.T) {
241+
t.Parallel()
204242
testAuthLogin(t, tt)
205243
})
206244
}

‎internal/provider/auth_jwt_test.go

+21
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ package provider
55

66
import (
77
"encoding/json"
8+
"errors"
89
"fmt"
910
"net/http"
1011
"testing"
@@ -157,6 +158,25 @@ func TestAuthLoginJWT_Login(t *testing.T) {
157158
},
158159
wantErr: false,
159160
},
161+
{
162+
name: "error-vault-token-set",
163+
authLogin: &AuthLoginJWT{
164+
AuthLoginCommon: AuthLoginCommon{
165+
authField: consts.FieldAuthLoginJWT,
166+
params: map[string]interface{}{
167+
consts.FieldRole: "alice",
168+
consts.FieldJWT: "jwt1",
169+
},
170+
initialized: true,
171+
},
172+
},
173+
handler: &testLoginHandler{
174+
handlerFunc: handlerFunc,
175+
},
176+
token: "foo",
177+
wantErr: true,
178+
expectErr: errors.New("vault login client has a token set"),
179+
},
160180
{
161181
name: "error-uninitialized",
162182
authLogin: &AuthLoginJWT{
@@ -175,6 +195,7 @@ func TestAuthLoginJWT_Login(t *testing.T) {
175195
}
176196
for _, tt := range tests {
177197
t.Run(tt.name, func(t *testing.T) {
198+
t.Parallel()
178199
testAuthLogin(t, tt)
179200
})
180201
}

‎internal/provider/auth_kerberos_test.go

+35
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ package provider
66
import (
77
"encoding/base64"
88
"encoding/json"
9+
"errors"
910
"fmt"
1011
"net/http"
1112
"reflect"
@@ -221,9 +222,43 @@ func TestAuthLoginKerberos_Login(t *testing.T) {
221222
},
222223
wantErr: false,
223224
},
225+
{
226+
name: "error-vault-token-set",
227+
authLogin: &AuthLoginKerberos{
228+
authHeaderFunc: getTestAuthHeaderFunc(&krbauth.LoginCfg{
229+
Username: "alice",
230+
Service: "service1",
231+
Realm: "realm1",
232+
KeytabPath: "/etc/kerberos/keytab",
233+
Krb5ConfPath: "/etc/kerberos/krb5.conf",
234+
DisableFASTNegotiation: true,
235+
RemoveInstanceName: false,
236+
}),
237+
AuthLoginCommon: AuthLoginCommon{
238+
authField: consts.FieldAuthLoginKerberos,
239+
params: map[string]interface{}{
240+
consts.FieldUsername: "alice",
241+
consts.FieldService: "service1",
242+
consts.FieldRealm: "realm1",
243+
consts.FieldKeytabPath: "/etc/kerberos/keytab",
244+
consts.FieldKRB5ConfPath: "/etc/kerberos/krb5.conf",
245+
consts.FieldDisableFastNegotiation: true,
246+
consts.FieldRemoveInstanceName: false,
247+
},
248+
initialized: true,
249+
},
250+
},
251+
handler: &testLoginHandler{
252+
handlerFunc: handlerFunc,
253+
},
254+
token: "foo",
255+
wantErr: true,
256+
expectErr: errors.New("vault login client has a token set"),
257+
},
224258
}
225259
for _, tt := range tests {
226260
t.Run(tt.name, func(t *testing.T) {
261+
t.Parallel()
227262
testAuthLogin(t, tt)
228263
})
229264
}

‎internal/provider/auth_oci_test.go

+21
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ package provider
55

66
import (
77
"encoding/json"
8+
"errors"
89
"fmt"
910
"net/http"
1011
"testing"
@@ -187,6 +188,25 @@ func TestAuthLoginOCI_Login(t *testing.T) {
187188
},
188189
wantErr: false,
189190
},
191+
{
192+
name: "error-vault-token-set",
193+
authLogin: &AuthLoginOCI{
194+
AuthLoginCommon: AuthLoginCommon{
195+
authField: consts.FieldAuthLoginOCI,
196+
params: map[string]interface{}{
197+
consts.FieldRole: "alice",
198+
consts.FieldAuthType: ociAuthTypeAPIKeys,
199+
},
200+
initialized: true,
201+
},
202+
},
203+
handler: &testLoginHandler{
204+
handlerFunc: handlerFunc,
205+
},
206+
token: "foo",
207+
wantErr: true,
208+
expectErr: errors.New("vault login client has a token set"),
209+
},
190210
{
191211
name: "error-uninitialized",
192212
authLogin: &AuthLoginOCI{
@@ -205,6 +225,7 @@ func TestAuthLoginOCI_Login(t *testing.T) {
205225
}
206226
for _, tt := range tests {
207227
t.Run(tt.name, func(t *testing.T) {
228+
t.Parallel()
208229
testAuthLogin(t, tt)
209230
})
210231
}

‎internal/provider/auth_oidc_test.go

+21
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ package provider
55

66
import (
77
"encoding/json"
8+
"errors"
89
"fmt"
910
"net/http"
1011
"reflect"
@@ -229,6 +230,25 @@ func TestAuthLoginOIDC_Login(t *testing.T) {
229230
}
230231

231232
tests := []authLoginTest{
233+
{
234+
name: "error-vault-token-set",
235+
authLogin: &AuthLoginOIDC{
236+
AuthLoginCommon{
237+
authField: "baz",
238+
mount: "foo",
239+
params: map[string]interface{}{
240+
consts.FieldRole: "bob",
241+
},
242+
initialized: true,
243+
},
244+
},
245+
handler: &testLoginHandler{
246+
handlerFunc: handlerFunc,
247+
},
248+
token: "foo",
249+
wantErr: true,
250+
expectErr: errors.New("vault login client has a token set"),
251+
},
232252
{
233253
name: "error-uninitialized",
234254
authLogin: &AuthLoginOIDC{
@@ -246,6 +266,7 @@ func TestAuthLoginOIDC_Login(t *testing.T) {
246266
}
247267
for _, tt := range tests {
248268
t.Run(tt.name, func(t *testing.T) {
269+
t.Parallel()
249270
testAuthLogin(t, tt)
250271
})
251272
}

0 commit comments

Comments
 (0)