Fix max_ttl not being honored in database backend when default_ttl is zero (#3814)

Fixes #3812

builtin/logical/postgresql/path_role_create.go

@@ -63,6 +63,11 @@ func (b *backend) pathRoleCreateRead(ctx context.Context, req *logical.Request,
 		}
 	}
 
+	ttl := lease.Lease
+	if ttl == 0 || (lease.LeaseMax > 0 && ttl > lease.LeaseMax) {
+		ttl = lease.LeaseMax
+	}
+
 	// Generate the username, password and expiration. PG limits user to 63 characters
 	displayName := req.DisplayName
 	if len(displayName) > 26 {
@@ -81,7 +86,7 @@ func (b *backend) pathRoleCreateRead(ctx context.Context, req *logical.Request,
 		return nil, err
 	}
 	expiration := time.Now().
-		Add(lease.Lease).
+		Add(ttl).
 		Format("2006-01-02 15:04:05-0700")
 
 	// Get our handle
@@ -142,7 +147,7 @@ func (b *backend) pathRoleCreateRead(ctx context.Context, req *logical.Request,
 		"username": username,
 		"role":     name,
 	})
-	resp.Secret.TTL = lease.Lease
+	resp.Secret.TTL = ttl
 	return resp, nil
 }