-
Notifications
You must be signed in to change notification settings - Fork 1.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
acl: add token expiration and ACL role functionality #14320
Commits on Jul 12, 2022
-
server: add ACL token expiration config parameters. (#13667)
This commit adds configuration parameters to control ACL token expirations. This includes both limits on the min and max TTL expiration values, as well as a GC threshold for expired tokens.
Configuration menu - View commit details
-
Copy full SHA for 08845ce - Browse repository at this point
Copy the full SHA 08845ceView commit details
Commits on Jul 13, 2022
-
core: add ACL token expiry state, struct, and RPC handling. (#13718)
The ACL token state schema has been updated to utilise two new indexes which track expiration of tokens that are configured with an expiration TTL or time. A new state function allows listing ACL expired tokens which will be used by internal garbage collection. The ACL endpoint has been modified so that all validation happens within a single function call. This is easier to understand and see at a glance. The ACL token validation now also includes logic for expiry TTL and times. The ACL endpoint upsert tests have been condensed into a single, table driven test. There is a new token canonicalize which provides a single place for token canonicalization, rather than logic spread in the RPC handler.
Configuration menu - View commit details
-
Copy full SHA for 8981c5a - Browse repository at this point
Copy the full SHA 8981c5aView commit details
Commits on Jul 15, 2022
-
acl: add token expiry checking to ACL token resolution. (#13756)
This commit adds basic expiry checking when performing ACL token resolution. This expiry checking is local to each server and does not at this time take into account potential time skew on server hosts. A new error message has been created so clients whose token has expired get a clear message, rather than a generic token not found. The ACL resolution tests have been refactored into table driven tests, so additions are easier in the future.
Configuration menu - View commit details
-
Copy full SHA for ee2e7d1 - Browse repository at this point
Copy the full SHA ee2e7d1View commit details
Commits on Jul 19, 2022
-
core: add expired token garbage collection periodic jobs. (#13805)
Two new periodic core jobs have been added which handle removing expired local and global tokens from state. The local core job is run on every leader; the global core job is only run on the leader within the authoritative region.
Configuration menu - View commit details
-
Copy full SHA for 14bcc74 - Browse repository at this point
Copy the full SHA 14bcc74View commit details
Commits on Jul 20, 2022
-
acl: enable configuration and visualisation of token expiration for u…
…sers (#13846) * api: add ACL token expiry params to HTTP API * cli: allow setting and displaying ACL token expiry
Configuration menu - View commit details
-
Copy full SHA for add4ea9 - Browse repository at this point
Copy the full SHA add4ea9View commit details
Commits on Aug 2, 2022
-
Configuration menu - View commit details
-
Copy full SHA for 892ab8a - Browse repository at this point
Copy the full SHA 892ab8aView commit details
Commits on Aug 9, 2022
-
core: add ACL role state schema and functionality. (#13955)
This commit includes the new state schema for ACL roles along with state interaction functions for CRUD actions. The change also includes snapshot persist and restore functionality and the addition of FSM messages for Raft updates which will come via RPC endpoints.
Configuration menu - View commit details
-
Copy full SHA for d6a9c14 - Browse repository at this point
Copy the full SHA d6a9c14View commit details
Commits on Aug 11, 2022
-
rpc: add ACL Role RPC endpoint for CRUD actions.
New ACL Role RPC endpoints have been created to allow the creation, update, read, and deletion of ACL roles. All endpoints require a management token; in the future readers will also be allowed to view roles associated to their ACL token. The create endpoint in particular is responsible for deduplicating ACL policy links and ensuring named policies are found within state. This is done within the RPC handler so we perform a single loop through the links for slight efficiency.
Configuration menu - View commit details
-
Copy full SHA for 4efb82a - Browse repository at this point
Copy the full SHA 4efb82aView commit details -
http: add ACL Role HTTP endpoints for CRUD actions.
These new endpoints are exposed under the /v1/acl/roles and /v1/acl/role endpoints.
Configuration menu - View commit details
-
Copy full SHA for fafc100 - Browse repository at this point
Copy the full SHA fafc100View commit details -
Configuration menu - View commit details
-
Copy full SHA for 3826b1f - Browse repository at this point
Copy the full SHA 3826b1fView commit details -
Merge pull request #14057 from hashicorp/f-gh-13120-acl-role-rpc-endp…
…oints ACL Role: add RPC, HTTP API, and API SDK functionality.
Configuration menu - View commit details
-
Copy full SHA for b8fe43a - Browse repository at this point
Copy the full SHA b8fe43aView commit details
Commits on Aug 12, 2022
-
Configuration menu - View commit details
-
Copy full SHA for ff798dc - Browse repository at this point
Copy the full SHA ff798dcView commit details
Commits on Aug 17, 2022
-
core: add ACL role functionality to ACL tokens.
ACL tokens can now utilize ACL roles in order to provide API authorization. Each ACL token can be created and linked to an array of policies as well as an array of ACL role links. The link can be provided via the role name or ID, but internally, is always resolved to the ID as this is immutable whereas the name can be changed by operators. When resolving an ACL token, the policies linked from an ACL role are unpacked and combined with the policy array to form the complete auth set for the token. The ACL token creation endpoint handles deduplicating ACL role links as well as ensuring they exist within state. When reading a token, Nomad will also ensure the ACL role link is current. This handles ACL roles being deleted from under a token from a UX standpoint.
Configuration menu - View commit details
-
Copy full SHA for 6a26bda - Browse repository at this point
Copy the full SHA 6a26bdaView commit details -
Configuration menu - View commit details
-
Copy full SHA for 9e69124 - Browse repository at this point
Copy the full SHA 9e69124View commit details -
Configuration menu - View commit details
-
Copy full SHA for 9953159 - Browse repository at this point
Copy the full SHA 9953159View commit details -
Merge pull request #14110 from hashicorp/f-gh-13120-acl-role-token-su…
…pport ACL: add ACL role functionality to ACL tokens
Configuration menu - View commit details
-
Copy full SHA for 37a4c32 - Browse repository at this point
Copy the full SHA 37a4c32View commit details
Commits on Aug 22, 2022
-
acl: add replication to ACL Roles from authoritative region. (#14176)
ACL Roles along with policies and global token will be replicated from the authoritative region to all federated regions. This involves a new replication loop running on the federated leader. Policies and roles may be replicated at different times, meaning the policies and role references may not be present within the local state upon replication upsert. In order to bypass the RPC and state check, a new RPC request parameter has been added. This is used by the replication process; all other callers will trigger the ACL role policy validation check. There is a new ACL RPC endpoint to allow the reading of a set of ACL Roles which is required by the replication process and matches ACL Policies and Tokens. A bug within the ACL Role listing RPC has also been fixed which returned incorrect data during blocking queries where a deletion had occurred.
Configuration menu - View commit details
-
Copy full SHA for f2effdc - Browse repository at this point
Copy the full SHA f2effdcView commit details -
acl: make listing RPC and HTTP API a stub return object. (#14211)
Making the ACL Role listing return object a stub future-proofs the endpoint. In the event the role object grows, we are not bound by having to return all fields within the list endpoint or change the signature of the endpoint to reduce the list return size.
Configuration menu - View commit details
-
Copy full SHA for 4be6de2 - Browse repository at this point
Copy the full SHA 4be6de2View commit details
Commits on Aug 24, 2022
-
acl: allow tokens to lookup linked roles. (#14227)
When listing or reading an ACL role, roles linked to the ACL token used for authentication can be returned to the caller.
Configuration menu - View commit details
-
Copy full SHA for f4db3b6 - Browse repository at this point
Copy the full SHA f4db3b6View commit details -
Configuration menu - View commit details
-
Copy full SHA for 34a1591 - Browse repository at this point
Copy the full SHA 34a1591View commit details -
Configuration menu - View commit details
-
Copy full SHA for f0b24d1 - Browse repository at this point
Copy the full SHA f0b24d1View commit details
Commits on Aug 25, 2022
-
acl: fix a bug where roles could be duplicated by name.
An ACL roles name must be unique, however, a bug meant multiple roles of the same same could be created. This fixes that problem with checks in the RPC handler and state store.
Configuration menu - View commit details
-
Copy full SHA for 69d6961 - Browse repository at this point
Copy the full SHA 69d6961View commit details -
Merge pull request #14291 from hashicorp/f-gh-13120-sso-various-small…
…-fixes acl: three small fixes for CLI and state consistency
Configuration menu - View commit details
-
Copy full SHA for b2483ed - Browse repository at this point
Copy the full SHA b2483edView commit details -
Configuration menu - View commit details
-
Copy full SHA for 7b3bd10 - Browse repository at this point
Copy the full SHA 7b3bd10View commit details
Commits on Aug 30, 2022
-
Configuration menu - View commit details
-
Copy full SHA for bf46203 - Browse repository at this point
Copy the full SHA bf46203View commit details