scottk/vault
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/vault.git synced 2025-11-01 02:57:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

plugins/database: Allow both {{name}} and {{username}} in MySQL & Postgres (#8240)

Browse Source 
* Allow {{name}} or {{username}} in psql templates

* Fix default rotation bug; allow {{user}} and {{username}}
This commit is contained in:
Michael Golowka
2020-02-03 13:57:28 -07:00
committed by GitHub
parent 961155578d
commit be052618da
4 changed files with 685 additions and 481 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
plugins/database/mysql/mysql.go
View File

@@ -135,6 +135,7 @@ func (m *MySQL) CreateUser(ctx context.Context, statements dbplugin.Statements,
queryMap := map[string]string{
"name": username,
"username": username,
"password": password,
"expiration": expirationStr,
}
@@ -187,6 +188,7 @@ func (m *MySQL) RevokeUser(ctx context.Context, statements dbplugin.Statements,
// 1295: This command is not supported in the prepared statement protocol yet
// Reference https://mariadb.com/kb/en/mariadb/prepare-statement/
query = strings.Replace(query, "{{name}}", username, -1)
query = strings.Replace(query, "{{username}}", username, -1)
_, err = tx.ExecContext(ctx, query)
if err != nil {
return err
@@ -244,6 +246,7 @@ func (m *MySQL) RotateRootCredentials(ctx context.Context, statements []string)
// 1295: This command is not supported in the prepared statement protocol yet
// Reference https://mariadb.com/kb/en/mariadb/prepare-statement/
query = strings.Replace(query, "{{username}}", m.Username, -1)
query = strings.Replace(query, "{{name}}", m.Username, -1)
query = strings.Replace(query, "{{password}}", password, -1)
if _, err := tx.ExecContext(ctx, query); err != nil {
@@ -283,10 +286,11 @@ func (m *MySQL) SetCredentials(ctx context.Context, statements dbplugin.Statemen
queryMap := map[string]string{
"name": username,
"username": username,
"password": password,
}
if err := m.executePreparedStatmentsWithMap(ctx, statements.Rotation, queryMap); err != nil {
if err := m.executePreparedStatmentsWithMap(ctx, rotateStatements, queryMap); err != nil {
return "", "", err
}
return username, password, nil

308
plugins/database/mysql/mysql_test.go
View File

@@ -53,6 +53,28 @@ func TestMySQL_Initialize(t *testing.T) {
}
func TestMySQL_CreateUser(t *testing.T) {
t.Run("missing creation statements", func(t *testing.T) {
db := new(MetadataLen, MetadataLen, UsernameLen)
usernameConfig := dbplugin.UsernameConfig{
DisplayName: "test-long-displayname",
RoleName: "test-long-rolename",
}
username, password, err := db.CreateUser(context.Background(), dbplugin.Statements{}, usernameConfig, time.Now().Add(time.Minute))
if err == nil {
t.Fatalf("expected err, got nil")
}
if username != "" {
t.Fatalf("expected empty username, got [%s]", username)
}
if password != "" {
t.Fatalf("expected empty password, got [%s]", password)
}
})
t.Run("non-legacy", func(t *testing.T) {
// Shared test container for speed - there should not be any overlap between the tests
cleanup, connURL := mysqlhelper.PrepareMySQLTestContainer(t, false, "secret")
defer cleanup()
@@ -66,55 +88,11 @@ func TestMySQL_CreateUser(t *testing.T) {
t.Fatalf("err: %s", err)
}
usernameConfig := dbplugin.UsernameConfig{
DisplayName: "test-long-displayname",
RoleName: "test-long-rolename",
}
testCreateUser(t, db, connURL)
})
// Test with no configured Creation Statement
_, _, err = db.CreateUser(context.Background(), dbplugin.Statements{}, usernameConfig, time.Now().Add(time.Minute))
if err == nil {
t.Fatal("Expected error when no creation statement is provided")
}
statements := dbplugin.Statements{
Creation: []string{testMySQLRoleWildCard},
}
username, password, err := db.CreateUser(context.Background(), statements, usernameConfig, time.Now().Add(time.Minute))
if err != nil {
t.Fatalf("err: %s", err)
}
if err := mysqlhelper.TestCredsExist(t, connURL, username, password); err != nil {
t.Fatalf("Could not connect with new credentials: %s", err)
}
// Test a second time to make sure usernames don't collide
username, password, err = db.CreateUser(context.Background(), statements, usernameConfig, time.Now().Add(time.Minute))
if err != nil {
t.Fatalf("err: %s", err)
}
if err := mysqlhelper.TestCredsExist(t, connURL, username, password); err != nil {
t.Fatalf("Could not connect with new credentials: %s", err)
}
// Test with a manually prepare statement
statements.Creation = []string{testMySQLRolePreparedStmt}
username, password, err = db.CreateUser(context.Background(), statements, usernameConfig, time.Now().Add(time.Minute))
if err != nil {
t.Fatalf("err: %s", err)
}
if err := mysqlhelper.TestCredsExist(t, connURL, username, password); err != nil {
t.Fatalf("Could not connect with new credentials: %s", err)
}
}
func TestMySQL_CreateUser_Legacy(t *testing.T) {
t.Run("legacy", func(t *testing.T) {
// Shared test container for speed - there should not be any overlap between the tests
cleanup, connURL := mysqlhelper.PrepareMySQLTestContainer(t, true, "secret")
defer cleanup()
@@ -128,19 +106,59 @@ func TestMySQL_CreateUser_Legacy(t *testing.T) {
t.Fatalf("err: %s", err)
}
testCreateUser(t, db, connURL)
})
}
func testCreateUser(t *testing.T, db *MySQL, connURL string) {
type testCase struct {
createStmts []string
}
tests := map[string]testCase{
"create name": {
createStmts: []string{`
CREATE USER '{{name}}'@'%' IDENTIFIED BY '{{password}}';
GRANT SELECT ON *.* TO '{{name}}'@'%';`,
},
},
"create username": {
createStmts: []string{`
CREATE USER '{{username}}'@'%' IDENTIFIED BY '{{password}}';
GRANT SELECT ON *.* TO '{{username}}'@'%';`,
},
},
"prepared statement name": {
createStmts: []string{`
CREATE USER '{{name}}'@'%' IDENTIFIED BY '{{password}}';
set @grants=CONCAT("GRANT SELECT ON ", "*", ".* TO '{{name}}'@'%'");
PREPARE grantStmt from @grants;
EXECUTE grantStmt;
DEALLOCATE PREPARE grantStmt;
`,
},
},
"prepared statement username": {
createStmts: []string{`
CREATE USER '{{username}}'@'%' IDENTIFIED BY '{{password}}';
set @grants=CONCAT("GRANT SELECT ON ", "*", ".* TO '{{username}}'@'%'");
PREPARE grantStmt from @grants;
EXECUTE grantStmt;
DEALLOCATE PREPARE grantStmt;
`,
},
},
}
for name, test := range tests {
t.Run(name, func(t *testing.T) {
usernameConfig := dbplugin.UsernameConfig{
DisplayName: "test-long-displayname",
RoleName: "test-long-rolename",
}
// Test with no configured Creation Statement
_, _, err = db.CreateUser(context.Background(), dbplugin.Statements{}, usernameConfig, time.Now().Add(time.Minute))
if err == nil {
t.Fatal("Expected error when no creation statement is provided")
}
statements := dbplugin.Statements{
Creation: []string{testMySQLRoleWildCard},
Creation: test.createStmts,
}
username, password, err := db.CreateUser(context.Background(), statements, usernameConfig, time.Now().Add(time.Minute))
@@ -161,9 +179,31 @@ func TestMySQL_CreateUser_Legacy(t *testing.T) {
if err := mysqlhelper.TestCredsExist(t, connURL, username, password); err != nil {
t.Fatalf("Could not connect with new credentials: %s", err)
}
})
}
}
func TestMySQL_RotateRootCredentials(t *testing.T) {
type testCase struct {
statements []string
}
tests := map[string]testCase{
"empty statements": {
statements: nil,
},
"default username": {
statements: []string{defaultMySQLRotateCredentialsSQL},
},
"default name": {
statements: []string{`
ALTER USER '{{username}}'@'%' IDENTIFIED BY '{{password}}';`,
},
},
}
for name, test := range tests {
t.Run(name, func(t *testing.T) {
cleanup, connURL := mysqlhelper.PrepareMySQLTestContainer(t, false, "secret")
defer cleanup()
@@ -175,8 +215,12 @@ func TestMySQL_RotateRootCredentials(t *testing.T) {
"password": "secret",
}
// Give a timeout just in case the test decides to be problematic
ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
defer cancel()
db := new(MetadataLen, MetadataLen, UsernameLen)
_, err := db.Init(context.Background(), connectionDetails, true)
_, err := db.Init(ctx, connectionDetails, true)
if err != nil {
t.Fatalf("err: %s", err)
}
@@ -185,7 +229,7 @@ func TestMySQL_RotateRootCredentials(t *testing.T) {
t.Fatal("Database should be initialized")
}
newConf, err := db.RotateRootCredentials(context.Background(), nil)
newConf, err := db.RotateRootCredentials(ctx, test.statements)
if err != nil {
t.Fatalf("err: %v", err)
}
@@ -197,9 +241,31 @@ func TestMySQL_RotateRootCredentials(t *testing.T) {
if err != nil {
t.Fatalf("err: %s", err)
}
})
}
}
func TestMySQL_RevokeUser(t *testing.T) {
type testCase struct {
revokeStmts []string
}
tests := map[string]testCase{
"empty statements": {
revokeStmts: nil,
},
"default name": {
revokeStmts: []string{defaultMysqlRevocationStmts},
},
"default username": {
revokeStmts: []string{`
REVOKE ALL PRIVILEGES, GRANT OPTION FROM '{{username}}'@'%';
DROP USER '{{username}}'@'%'`,
},
},
}
// Shared test container for speed - there should not be any overlap between the tests
cleanup, connURL := mysqlhelper.PrepareMySQLTestContainer(t, false, "secret")
defer cleanup()
@@ -207,14 +273,24 @@ func TestMySQL_RevokeUser(t *testing.T) {
"connection_url": connURL,
}
// Give a timeout just in case the test decides to be problematic
initCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
defer cancel()
db := new(MetadataLen, MetadataLen, UsernameLen)
_, err := db.Init(context.Background(), connectionDetails, true)
_, err := db.Init(initCtx, connectionDetails, true)
if err != nil {
t.Fatalf("err: %s", err)
}
for name, test := range tests {
t.Run(name, func(t *testing.T) {
statements := dbplugin.Statements{
Creation: []string{testMySQLRoleWildCard},
Creation: []string{`
CREATE USER '{{name}}'@'%' IDENTIFIED BY '{{password}}';
GRANT SELECT ON *.* TO '{{name}}'@'%';`,
},
Revocation: test.revokeStmts,
}
usernameConfig := dbplugin.UsernameConfig{
@@ -222,7 +298,11 @@ func TestMySQL_RevokeUser(t *testing.T) {
RoleName: "test",
}
username, password, err := db.CreateUser(context.Background(), statements, usernameConfig, time.Now().Add(time.Minute))
// Give a timeout just in case the test decides to be problematic
ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
defer cancel()
username, password, err := db.CreateUser(ctx, statements, usernameConfig, time.Now().Add(time.Minute))
if err != nil {
t.Fatalf("err: %s", err)
}
@@ -231,7 +311,6 @@ func TestMySQL_RevokeUser(t *testing.T) {
t.Fatalf("Could not connect with new credentials: %s", err)
}
// Test default revoke statements
err = db.RevokeUser(context.Background(), statements, username)
if err != nil {
t.Fatalf("err: %s", err)
@@ -240,36 +319,43 @@ func TestMySQL_RevokeUser(t *testing.T) {
if err := mysqlhelper.TestCredsExist(t, connURL, username, password); err == nil {
t.Fatal("Credentials were not revoked")
}
statements.Creation = []string{testMySQLRoleWildCard}
username, password, err = db.CreateUser(context.Background(), statements, usernameConfig, time.Now().Add(time.Minute))
if err != nil {
t.Fatalf("err: %s", err)
}
if err := mysqlhelper.TestCredsExist(t, connURL, username, password); err != nil {
t.Fatalf("Could not connect with new credentials: %s", err)
}
// Test custom revoke statements
statements.Revocation = []string{testMySQLRevocationSQL}
err = db.RevokeUser(context.Background(), statements, username)
if err != nil {
t.Fatalf("err: %s", err)
}
if err := mysqlhelper.TestCredsExist(t, connURL, username, password); err == nil {
t.Fatal("Credentials were not revoked")
})
}
}
func TestMySQL_SetCredentials(t *testing.T) {
type testCase struct {
rotateStmts []string
}
tests := map[string]testCase{
"empty statements": {
rotateStmts: nil,
},
"custom statement name": {
rotateStmts: []string{`
ALTER USER '{{name}}'@'%' IDENTIFIED BY '{{password}}';`},
},
"custom statement username": {
rotateStmts: []string{`
ALTER USER '{{username}}'@'%' IDENTIFIED BY '{{password}}';`},
},
}
for name, test := range tests {
t.Run(name, func(t *testing.T) {
cleanup, connURL := mysqlhelper.PrepareMySQLTestContainer(t, false, "secret")
defer cleanup()
// create the database user and verify we can access
dbUser := "vaultstatictest"
createTestMySQLUser(t, connURL, dbUser, "password", testRoleStaticCreate)
initPassword := "password"
createStatements := `
CREATE USER '{{name}}'@'%' IDENTIFIED BY '{{password}}';
GRANT SELECT ON *.* TO '{{name}}'@'%';`
createTestMySQLUser(t, connURL, dbUser, initPassword, createStatements)
if err := mysqlhelper.TestCredsExist(t, connURL, dbUser, "password"); err != nil {
t.Fatalf("Could not connect with credentials: %s", err)
}
@@ -278,15 +364,19 @@ func TestMySQL_SetCredentials(t *testing.T) {
"connection_url": connURL,
}
// Give a timeout just in case the test decides to be problematic
ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
defer cancel()
db := new(MetadataLen, MetadataLen, UsernameLen)
_, err := db.Init(context.Background(), connectionDetails, true)
_, err := db.Init(ctx, connectionDetails, true)
if err != nil {
t.Fatalf("err: %s", err)
}
newPassword, err := db.GenerateCredentials(context.Background())
newPassword, err := db.GenerateCredentials(ctx)
if err != nil {
t.Fatal(err)
t.Fatalf("unable to generate password: %s", err)
}
userConfig := dbplugin.StaticUserConfig{
@@ -295,29 +385,30 @@ func TestMySQL_SetCredentials(t *testing.T) {
}
statements := dbplugin.Statements{
Rotation: []string{testRoleStaticRotate},
Rotation: test.rotateStmts,
}
_, _, err = db.SetCredentials(context.Background(), statements, userConfig)
username, password, err := db.SetCredentials(ctx, statements, userConfig)
if err != nil {
t.Fatalf("err: %s", err)
}
if username != userConfig.Username {
t.Fatalf("expected username [%s], got [%s]", userConfig.Username, username)
}
if password != userConfig.Password {
t.Fatalf("expected password [%s] got [%s]", userConfig.Password, password)
}
// verify new password works
if err := mysqlhelper.TestCredsExist(t, connURL, dbUser, newPassword); err != nil {
t.Fatalf("Could not connect with new credentials: %s", err)
}
// call SetCredentials again, password will change
newPassword, _ = db.GenerateCredentials(context.Background())
userConfig.Password = newPassword
_, _, err = db.SetCredentials(context.Background(), statements, userConfig)
if err != nil {
t.Fatalf("err: %s", err)
// verify old password doesn't work
if err := mysqlhelper.TestCredsExist(t, connURL, dbUser, initPassword); err == nil {
t.Fatalf("Should not be able to connect with initial credentials")
}
if err := mysqlhelper.TestCredsExist(t, connURL, dbUser, newPassword); err != nil {
t.Fatalf("Could not connect with new credentials: %s", err)
})
}
}
@@ -399,28 +490,3 @@ func createTestMySQLUser(t *testing.T, connURL, username, password, query string
stmt.Close()
}
}
const testMySQLRolePreparedStmt = `
CREATE USER '{{name}}'@'%' IDENTIFIED BY '{{password}}';
set @grants=CONCAT("GRANT SELECT ON ", "*", ".* TO '{{name}}'@'%'");
PREPARE grantStmt from @grants;
EXECUTE grantStmt;
DEALLOCATE PREPARE grantStmt;
`
const testMySQLRoleWildCard = `
CREATE USER '{{name}}'@'%' IDENTIFIED BY '{{password}}';
GRANT SELECT ON *.* TO '{{name}}'@'%';
`
const testMySQLRevocationSQL = `
REVOKE ALL PRIVILEGES, GRANT OPTION FROM '{{name}}'@'%';
DROP USER '{{name}}'@'%';
`
const testRoleStaticCreate = `
CREATE USER '{{name}}'@'%' IDENTIFIED BY '{{password}}';
GRANT SELECT ON *.* TO '{{name}}'@'%';
`
const testRoleStaticRotate = `
ALTER USER '{{name}}'@'%' IDENTIFIED BY '{{password}}';
`

9
plugins/database/postgresql/postgresql.go
View File

@@ -26,10 +26,6 @@ ALTER ROLE "{{name}}" VALID UNTIL '{{expiration}}';
`
defaultPostgresRotateRootCredentialsSQL = `
ALTER ROLE "{{username}}" WITH PASSWORD '{{password}}';
`
defaultPostgresRotateCredentialsSQL = `
ALTER ROLE "{{name}}" WITH PASSWORD '{{password}}';
`
)
@@ -149,6 +145,7 @@ func (p *PostgreSQL) SetCredentials(ctx context.Context, statements dbplugin.Sta
m := map[string]string{
"name": staticUser.Username,
"username": staticUser.Username,
"password": password,
}
if err := dbtxn.ExecuteTxQuery(ctx, tx, m, query); err != nil {
@@ -217,6 +214,7 @@ func (p *PostgreSQL) CreateUser(ctx context.Context, statements dbplugin.Stateme
m := map[string]string{
"name": username,
"username": username,
"password": password,
"expiration": expirationStr,
}
@@ -272,6 +270,7 @@ func (p *PostgreSQL) RenewUser(ctx context.Context, statements dbplugin.Statemen
m := map[string]string{
"name": username,
"username": username,
"expiration": expirationStr,
}
if err := dbtxn.ExecuteTxQuery(ctx, tx, m, query); err != nil {
@@ -320,6 +319,7 @@ func (p *PostgreSQL) customRevokeUser(ctx context.Context, username string, revo
m := map[string]string{
"name": username,
"username": username,
}
if err := dbtxn.ExecuteTxQuery(ctx, tx, m, query); err != nil {
return err
@@ -479,6 +479,7 @@ func (p *PostgreSQL) RotateRootCredentials(ctx context.Context, statements []str
continue
}
m := map[string]string{
"name": p.Username,
"username": p.Username,
"password": password,
}

401
plugins/database/postgresql/postgresql_test.go
View File

@@ -6,7 +6,6 @@ import (
"fmt"
"os"
"strings"
"sync"
"testing"
"time"
@@ -17,10 +16,6 @@ import (
"github.com/ory/dockertest"
)
var (
testPostgresImagePull sync.Once
)
func preparePostgresTestContainer(t *testing.T) (cleanup func(), retURL string) {
if os.Getenv("PG_URL") != "" {
return func() {}, os.Getenv("PG_URL")
@@ -97,7 +92,73 @@ func TestPostgreSQL_Initialize(t *testing.T) {
}
func TestPostgreSQL_CreateUser_missingArgs(t *testing.T) {
db := new()
usernameConfig := dbplugin.UsernameConfig{
DisplayName: "test",
RoleName: "test",
}
username, password, err := db.CreateUser(context.Background(), dbplugin.Statements{}, usernameConfig, time.Now().Add(time.Minute))
if err == nil {
t.Fatalf("expected err, got nil")
}
if username != "" {
t.Fatalf("expected empty username, got [%s]", username)
}
if password != "" {
t.Fatalf("expected empty password, got [%s]", password)
}
}
func TestPostgreSQL_CreateUser(t *testing.T) {
type testCase struct {
createStmts []string
}
tests := map[string]testCase{
"admin name": {
createStmts: []string{`
CREATE ROLE "{{name}}" WITH
LOGIN
PASSWORD '{{password}}'
VALID UNTIL '{{expiration}}';
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO "{{name}}";`,
},
},
"admin username": {
createStmts: []string{`
CREATE ROLE "{{username}}" WITH
LOGIN
PASSWORD '{{password}}'
VALID UNTIL '{{expiration}}';
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO "{{username}}";`,
},
},
"read only name": {
createStmts: []string{`
CREATE ROLE "{{name}}" WITH
LOGIN
PASSWORD '{{password}}'
VALID UNTIL '{{expiration}}';
GRANT SELECT ON ALL TABLES IN SCHEMA public TO "{{name}}";
GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO "{{name}}";`,
},
},
"read only username": {
createStmts: []string{`
CREATE ROLE "{{username}}" WITH
LOGIN
PASSWORD '{{password}}'
VALID UNTIL '{{expiration}}';
GRANT SELECT ON ALL TABLES IN SCHEMA public TO "{{username}}";
GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO "{{username}}";`,
},
},
}
// Shared test container for speed - there should not be any overlap between the tests
cleanup, connURL := preparePostgresTestContainer(t)
defer cleanup()
@@ -111,22 +172,22 @@ func TestPostgreSQL_CreateUser(t *testing.T) {
t.Fatalf("err: %s", err)
}
for name, test := range tests {
t.Run(name, func(t *testing.T) {
usernameConfig := dbplugin.UsernameConfig{
DisplayName: "test",
RoleName: "test",
}
// Test with no configured Creation Statement
_, _, err = db.CreateUser(context.Background(), dbplugin.Statements{}, usernameConfig, time.Now().Add(time.Minute))
if err == nil {
t.Fatal("Expected error when no creation statement is provided")
}
statements := dbplugin.Statements{
Creation: []string{testPostgresRole},
Creation: test.createStmts,
}
username, password, err := db.CreateUser(context.Background(), statements, usernameConfig, time.Now().Add(time.Minute))
// Give a timeout just in case the test decides to be problematic
ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
defer cancel()
username, password, err := db.CreateUser(ctx, statements, usernameConfig, time.Now().Add(time.Minute))
if err != nil {
t.Fatalf("err: %s", err)
}
@@ -135,21 +196,36 @@ func TestPostgreSQL_CreateUser(t *testing.T) {
t.Fatalf("Could not connect with new credentials: %s", err)
}
statements.Creation = []string{testPostgresReadOnlyRole}
username, password, err = db.CreateUser(context.Background(), statements, usernameConfig, time.Now().Add(time.Minute))
if err != nil {
t.Fatalf("err: %s", err)
}
// Sleep to make sure we haven't expired if granularity is only down to the second
// Ensure that the role doesn't expire immediately
time.Sleep(2 * time.Second)
if err = testCredsExist(t, connURL, username, password); err != nil {
t.Fatalf("Could not connect with new credentials: %s", err)
}
})
}
}
func TestPostgreSQL_RenewUser(t *testing.T) {
type testCase struct {
renewalStmts []string
}
tests := map[string]testCase{
"empty renewal statements": {
renewalStmts: nil,
},
"default renewal name": {
renewalStmts: []string{defaultPostgresRenewSQL},
},
"default renewal username": {
renewalStmts: []string{`
ALTER ROLE "{{username}}" VALID UNTIL '{{expiration}}';`,
},
},
}
// Shared test container for speed - there should not be any overlap between the tests
cleanup, connURL := preparePostgresTestContainer(t)
defer cleanup()
@@ -158,13 +234,21 @@ func TestPostgreSQL_RenewUser(t *testing.T) {
}
db := new()
_, err := db.Init(context.Background(), connectionDetails, true)
// Give a timeout just in case the test decides to be problematic
initCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
defer cancel()
_, err := db.Init(initCtx, connectionDetails, true)
if err != nil {
t.Fatalf("err: %s", err)
}
for name, test := range tests {
t.Run(name, func(t *testing.T) {
statements := dbplugin.Statements{
Creation: []string{testPostgresRole},
Creation: []string{createAdminUser},
Renewal: test.renewalStmts,
}
usernameConfig := dbplugin.UsernameConfig{
@@ -172,7 +256,11 @@ func TestPostgreSQL_RenewUser(t *testing.T) {
RoleName: "test",
}
username, password, err := db.CreateUser(context.Background(), statements, usernameConfig, time.Now().Add(2*time.Second))
// Give a timeout just in case the test decides to be problematic
ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
defer cancel()
username, password, err := db.CreateUser(ctx, statements, usernameConfig, time.Now().Add(2*time.Second))
if err != nil {
t.Fatalf("err: %s", err)
}
@@ -181,7 +269,7 @@ func TestPostgreSQL_RenewUser(t *testing.T) {
t.Fatalf("Could not connect with new credentials: %s", err)
}
err = db.RenewUser(context.Background(), statements, username, time.Now().Add(time.Minute))
err = db.RenewUser(ctx, statements, username, time.Now().Add(time.Minute))
if err != nil {
t.Fatalf("err: %s", err)
}
@@ -192,31 +280,31 @@ func TestPostgreSQL_RenewUser(t *testing.T) {
if err = testCredsExist(t, connURL, username, password); err != nil {
t.Fatalf("Could not connect with new credentials: %s", err)
}
statements.Renewal = []string{defaultPostgresRenewSQL}
username, password, err = db.CreateUser(context.Background(), statements, usernameConfig, time.Now().Add(2*time.Second))
if err != nil {
t.Fatalf("err: %s", err)
})
}
if err = testCredsExist(t, connURL, username, password); err != nil {
t.Fatalf("Could not connect with new credentials: %s", err)
}
err = db.RenewUser(context.Background(), statements, username, time.Now().Add(time.Minute))
if err != nil {
t.Fatalf("err: %s", err)
}
// Sleep longer than the initial expiration time
time.Sleep(2 * time.Second)
if err = testCredsExist(t, connURL, username, password); err != nil {
t.Fatalf("Could not connect with new credentials: %s", err)
}
}
func TestPostgreSQL_RotateRootCredentials(t *testing.T) {
type testCase struct {
statements []string
}
tests := map[string]testCase{
"empty statements": {
statements: nil,
},
"default name": {
statements: []string{`
ALTER ROLE "{{name}}" WITH PASSWORD '{{password}}';`,
},
},
"default username": {
statements: []string{defaultPostgresRotateRootCredentialsSQL},
},
}
for name, test := range tests {
t.Run(name, func(t *testing.T) {
cleanup, connURL := preparePostgresTestContainer(t)
defer cleanup()
@@ -233,7 +321,11 @@ func TestPostgreSQL_RotateRootCredentials(t *testing.T) {
connProducer := db.SQLConnectionProducer
_, err := db.Init(context.Background(), connectionDetails, true)
// Give a timeout just in case the test decides to be problematic
ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
defer cancel()
_, err := db.Init(ctx, connectionDetails, true)
if err != nil {
t.Fatalf("err: %s", err)
}
@@ -242,7 +334,7 @@ func TestPostgreSQL_RotateRootCredentials(t *testing.T) {
t.Fatal("Database should be initialized")
}
newConf, err := db.RotateRootCredentials(context.Background(), nil)
newConf, err := db.RotateRootCredentials(ctx, test.statements)
if err != nil {
t.Fatalf("err: %v", err)
}
@@ -252,11 +344,36 @@ func TestPostgreSQL_RotateRootCredentials(t *testing.T) {
err = db.Close()
if err != nil {
t.Fatalf("err: %s", err)
t.Fatalf("failed to close: %s", err)
}
})
}
}
func TestPostgreSQL_RevokeUser(t *testing.T) {
type testCase struct {
revokeStmts []string
}
tests := map[string]testCase{
"empty statements": {
revokeStmts: nil,
},
"explicit default name": {
revokeStmts: []string{defaultPostgresRevocationSQL},
},
"explicit default username": {
revokeStmts: []string{`
REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA public FROM "{{username}}";
REVOKE ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public FROM "{{username}}";
REVOKE USAGE ON SCHEMA public FROM "{{username}}";
DROP ROLE IF EXISTS "{{username}}";`,
},
},
}
// Shared test container for speed - there should not be any overlap between the tests
cleanup, connURL := preparePostgresTestContainer(t)
defer cleanup()
@@ -265,13 +382,21 @@ func TestPostgreSQL_RevokeUser(t *testing.T) {
}
db := new()
_, err := db.Init(context.Background(), connectionDetails, true)
// Give a timeout just in case the test decides to be problematic
initCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
defer cancel()
_, err := db.Init(initCtx, connectionDetails, true)
if err != nil {
t.Fatalf("err: %s", err)
}
for name, test := range tests {
t.Run(name, func(t *testing.T) {
statements := dbplugin.Statements{
Creation: []string{testPostgresRole},
Creation: []string{createAdminUser},
Revocation: test.revokeStmts,
}
usernameConfig := dbplugin.UsernameConfig{
@@ -297,46 +422,116 @@ func TestPostgreSQL_RevokeUser(t *testing.T) {
if err := testCredsExist(t, connURL, username, password); err == nil {
t.Fatal("Credentials were not revoked")
}
username, password, err = db.CreateUser(context.Background(), statements, usernameConfig, time.Now().Add(2*time.Second))
if err != nil {
t.Fatalf("err: %s", err)
})
}
}
if err = testCredsExist(t, connURL, username, password); err != nil {
t.Fatalf("Could not connect with new credentials: %s", err)
func TestPostgreSQL_SetCredentials_missingArgs(t *testing.T) {
type testCase struct {
statements dbplugin.Statements
userConfig dbplugin.StaticUserConfig
}
// Test custom revoke statements
statements.Revocation = []string{defaultPostgresRevocationSQL}
err = db.RevokeUser(context.Background(), statements, username)
if err != nil {
t.Fatalf("err: %s", err)
tests := map[string]testCase{
"empty rotation statements": {
statements: dbplugin.Statements{
Rotation: nil,
},
userConfig: dbplugin.StaticUserConfig{
Username: "testuser",
Password: "password",
},
},
"empty username": {
statements: dbplugin.Statements{
Rotation: []string{`
ALTER ROLE "{{name}}" WITH PASSWORD '{{password}}';`,
},
},
userConfig: dbplugin.StaticUserConfig{
Username: "",
Password: "password",
},
},
"empty password": {
statements: dbplugin.Statements{
Rotation: []string{`
ALTER ROLE "{{name}}" WITH PASSWORD '{{password}}';`,
},
},
userConfig: dbplugin.StaticUserConfig{
Username: "testuser",
Password: "",
},
},
}
if err := testCredsExist(t, connURL, username, password); err == nil {
t.Fatal("Credentials were not revoked")
for name, test := range tests {
t.Run(name, func(t *testing.T) {
db := new()
username, password, err := db.SetCredentials(context.Background(), test.statements, test.userConfig)
if err == nil {
t.Fatalf("expected err, got nil")
}
if username != "" {
t.Fatalf("expected empty username, got [%s]", username)
}
if password != "" {
t.Fatalf("expected empty password, got [%s]", password)
}
})
}
}
func TestPostgresSQL_SetCredentials(t *testing.T) {
type testCase struct {
rotationStmts []string
}
tests := map[string]testCase{
"name rotation": {
rotationStmts: []string{`
ALTER ROLE "{{name}}" WITH PASSWORD '{{password}}';`,
},
},
"username rotation": {
rotationStmts: []string{`
ALTER ROLE "{{username}}" WITH PASSWORD '{{password}}';`,
},
},
}
for name, test := range tests {
t.Run(name, func(t *testing.T) {
// Shared test container for speed - there should not be any overlap between the tests
cleanup, connURL := preparePostgresTestContainer(t)
defer cleanup()
// create the database user
dbUser := "vaultstatictest"
createTestPGUser(t, connURL, dbUser, "password", testRoleStaticCreate)
initPassword := "password"
createTestPGUser(t, connURL, dbUser, initPassword, testRoleStaticCreate)
connectionDetails := map[string]interface{}{
"connection_url": connURL,
}
db := new()
_, err := db.Init(context.Background(), connectionDetails, true)
// Give a timeout just in case the test decides to be problematic
ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
defer cancel()
_, err := db.Init(ctx, connectionDetails, true)
if err != nil {
t.Fatalf("err: %s", err)
}
statements := dbplugin.Statements{
Rotation: test.rotationStmts,
}
password, err := db.GenerateCredentials(context.Background())
if err != nil {
t.Fatal(err)
@@ -347,17 +542,11 @@ func TestPostgresSQL_SetCredentials(t *testing.T) {
Password: password,
}
// Test with no configured Rotation Statement
username, password, err := db.SetCredentials(context.Background(), dbplugin.Statements{}, usernameConfig)
if err == nil {
t.Fatalf("err: %s", err)
if err := testCredsExist(t, connURL, dbUser, initPassword); err != nil {
t.Fatalf("Could not connect with initial credentials: %s", err)
}
statements := dbplugin.Statements{
Rotation: []string{testPostgresStaticRoleRotate},
}
// User should not exist, make sure we can create
username, password, err = db.SetCredentials(context.Background(), statements, usernameConfig)
username, password, err := db.SetCredentials(ctx, statements, usernameConfig)
if err != nil {
t.Fatalf("err: %s", err)
}
@@ -366,20 +555,10 @@ func TestPostgresSQL_SetCredentials(t *testing.T) {
t.Fatalf("Could not connect with new credentials: %s", err)
}
// call SetCredentials again, password will change
newPassword, _ := db.GenerateCredentials(context.Background())
usernameConfig.Password = newPassword
username, password, err = db.SetCredentials(context.Background(), statements, usernameConfig)
if err != nil {
t.Fatalf("err: %s", err)
if err := testCredsExist(t, connURL, username, initPassword); err == nil {
t.Fatalf("Should not be able to connect with initial credentials")
}
if password != newPassword {
t.Fatal("passwords should have changed")
}
if err := testCredsExist(t, connURL, username, password); err != nil {
t.Fatalf("Could not connect with new credentials: %s", err)
})
}
}
@@ -395,7 +574,7 @@ func testCredsExist(t testing.TB, connURL, username, password string) error {
return db.Ping()
}
const testPostgresRole = `
const createAdminUser = `
CREATE ROLE "{{name}}" WITH
LOGIN
PASSWORD '{{password}}'
@@ -403,37 +582,6 @@ CREATE ROLE "{{name}}" WITH
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO "{{name}}";
`
const testPostgresReadOnlyRole = `
CREATE ROLE "{{name}}" WITH
LOGIN
PASSWORD '{{password}}'
VALID UNTIL '{{expiration}}';
GRANT SELECT ON ALL TABLES IN SCHEMA public TO "{{name}}";
GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO "{{name}}";
`
const testPostgresBlockStatementRole = `
DO $$
BEGIN
IF NOT EXISTS (SELECT * FROM pg_catalog.pg_roles WHERE rolname='foo-role') THEN
CREATE ROLE "foo-role";
CREATE SCHEMA IF NOT EXISTS foo AUTHORIZATION "foo-role";
ALTER ROLE "foo-role" SET search_path = foo;
GRANT TEMPORARY ON DATABASE "postgres" TO "foo-role";
GRANT ALL PRIVILEGES ON SCHEMA foo TO "foo-role";
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA foo TO "foo-role";
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA foo TO "foo-role";
GRANT ALL PRIVILEGES ON ALL FUNCTIONS IN SCHEMA foo TO "foo-role";
END IF;
END
$$
CREATE ROLE "{{name}}" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';
GRANT "foo-role" TO "{{name}}";
ALTER ROLE "{{name}}" SET search_path = foo;
GRANT CONNECT ON DATABASE "postgres" TO "{{name}}";
`
var testPostgresBlockStatementRoleSlice = []string{
`
DO $$
@@ -465,27 +613,12 @@ REVOKE USAGE ON SCHEMA public FROM "{{name}}";
DROP ROLE IF EXISTS "{{name}}";
`
const testPostgresStaticRole = `
CREATE ROLE "{{name}}" WITH
LOGIN
PASSWORD '{{password}}';
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO "{{name}}";
`
const testRoleStaticCreate = `
CREATE ROLE "{{name}}" WITH
LOGIN
PASSWORD '{{password}}';
`
const testPostgresStaticRoleRotate = `
ALTER ROLE "{{name}}" WITH PASSWORD '{{password}}';
`
const testPostgresStaticRoleGrant = `
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO "{{name}}";
`
// This is a copy of a test helper method also found in
// builtin/logical/database/rotation_test.go , and should be moved into a shared
// helper file in the future.