Sanitize policy behavior across backends #3324
Conversation
|
Note, see #3318 -- I think we shouldn't encode 'default' in, as it will make it harder to support a no-default flag as a future enhancement. We should let the core do the right thing. |
* Ingress TypeCommaStringSlice * Read returns a slice * Default is not added to the saved set of policies, we let core do its thing Fixes #3318
jefferai
changed the title
| @@ -133,7 +133,7 @@ func (b *backend) pathCertRead( | |||
| Data: map[string]interface{}{ | |||
| "certificate": cert.Certificate, | |||
| "display_name": cert.DisplayName, | |||
| "policies": strings.Join(cert.Policies, ","), | |||
| "policies": cert.Policies, | |||
There was a problem hiding this comment.
Any concern with the behavior change of the return here? I like this better but this does break compatibility.
| @@ -86,7 +84,7 @@ func (b *backend) pathGroupRead( | |||
|
|
|||
| return &logical.Response{ | |||
| Data: map[string]interface{}{ | |||
| "policies": strings.Join(group.Policies, ","), | |||
| "policies": group.Policies, | |||
There was a problem hiding this comment.
Same backwards compatibility concerns as above.
| @@ -93,7 +93,7 @@ func (b *backend) pathUserRead( | |||
| return &logical.Response{ | |||
| Data: map[string]interface{}{ | |||
| "groups": strings.Join(user.Groups, ","), | |||
| "policies": strings.Join(user.Policies, ","), | |||
| "policies": user.Policies, | |||
There was a problem hiding this comment.
Same backwards compatibility concerns as above.
There was a problem hiding this comment.
Yes, it breaks compatibility. I'm inclined to just make the change though rather than move to another field. (As I mentioned in chat, we'd definitely note this in CHANGES.)
I don't think in most cases these lookup endpoints are used by non-humans (and humans can easily understand it either way), and for anyone trying to feed them from a read into a write, the writes now accept slices so that will still work.
* oss/master: changelog++ update enterprise urls /docs/vault-enterprise -> /docs/enterprise (#3333) Fixed docs to reflect correct HTTP method for /sys/config/auditing endpoing (#3331) changelog++ Change behavior of TTL in sign-intermediate (#3325) changelog++ Sanitize policy behavior across backends (#3324) Fix typo in transit error remove token header from login samples (#3320) Fix navigation and prameters in the 'gcp' auth backend docs. (#3317) changelog++
thing
Fixes #3318
Fixes #3323