adding comments

api/sys_mounts.go

@@ -308,14 +308,14 @@ type UserLockoutConfigInput struct {
  LockoutThreshold string `json:"lockout_threshold,omitempty" structs:"lockout_threshold" mapstructure:"lockout_threshold"`
  LockoutDuration string `json:"lockout_duration,omitempty" structs:"lockout_duration" mapstructure:"lockout_duration"`
  LockoutCounterResetDuration string `json:"lockout_counter_reset_duration,omitempty" structs:"lockout_counter_reset_duration" mapstructure:"lockout_counter_reset_duration"`
- DisableLockout bool  `json:"lockout_disable,omitempty" structs:"lockout_disable" mapstructure:"lockout_disable"`
+ DisableLockout *bool `json:"lockout_disable,omitempty" structs:"lockout_disable" mapstructure:"lockout_disable"`
 }
 
 type UserLockoutConfigOutput struct {
- LockoutThreshold uint `json:"lockout_threshold,omitempty" structs:"lockout_threshold" mapstructure:"lockout_threshold"`
- LockoutDuration int `json:"lockout_duration,omitempty" structs:"lockout_duration" mapstructure:"lockout_duration"`
- LockoutCounterReset int `json:"lockout_counter_reset,omitempty" structs:"lockout_counter_reset" mapstructure:"lockout_counter_reset"`
- DisableLockout bool `json:"disable_lockout,omitempty" structs:"disable_lockout" mapstructure:"disable_lockout"`
+ LockoutThreshold uint  `json:"lockout_threshold,omitempty" structs:"lockout_threshold" mapstructure:"lockout_threshold"`
+ LockoutDuration int  `json:"lockout_duration,omitempty" structs:"lockout_duration" mapstructure:"lockout_duration"`
+ LockoutCounterReset int  `json:"lockout_counter_reset,omitempty" structs:"lockout_counter_reset" mapstructure:"lockout_counter_reset"`
+ DisableLockout *bool `json:"disable_lockout,omitempty" structs:"disable_lockout" mapstructure:"disable_lockout"`
 }
 
 type MountMigrationOutput struct {

command/auth_tune.go

@@ -285,7 +285,7 @@ func (c *AuthTuneCommand) Run(args []string) int {
  mountConfigInput.UserLockoutConfig.LockoutCounterResetDuration = ttlToAPI(c.flagUserLockoutCounterResetDuration)
  }
  if fl.Name == flagNameUserLockoutDisable {
- mountConfigInput.UserLockoutConfig.DisableLockout = c.flagUserLockoutDisable
+ mountConfigInput.UserLockoutConfig.DisableLockout = &c.flagUserLockoutDisable
  }
 
  if fl.Name == flagNamePluginVersion {

internalshared/configutil/userlockout.go

@@ -64,6 +64,9 @@ func ParseUserLockouts(result *SharedConfig, list *ast.ObjectList) error {
  }
 
  // Lockout Parameters
+
+ // Not setting raw entries to nil here as soon as they are parsed
+ // as they are used to set the missing user lockout configuration values later.
  {
  if userLockoutConfig.LockoutThresholdRaw != nil {
  userLockoutThresholdString := fmt.Sprintf("%v", userLockoutConfig.LockoutThresholdRaw)
@@ -100,6 +103,15 @@ func ParseUserLockouts(result *SharedConfig, list *ast.ObjectList) error {
  userLockoutsMap[userLockoutConfig.Type] = &userLockoutConfig
  }
 
+ // Use raw entries to set values for user lockout configurations fields
+ // that were not configured using config file.
+ // The raw entries would mean that the entry was configured by the user using the config file.
+ // If any of these fields are not configured using the config file (missing fields),
+ // we set values for these fields with defaults
+ // The issue with not being able to use non-raw entries is because of fields lockout threshold
+ // and disable lockout. We cannot differentiate using non-raw entries if the user configured these fields
+ // with values (0 and false) or if the the user did not configure these values in config file at all.
+ // The raw fields are set to nil after setting missing values in setNilValuesForRawUserLockoutFields function
  userLockoutsMap = setMissingUserLockoutValuesInMap(userLockoutsMap)
  for _, userLockoutValues := range userLockoutsMap {
  result.UserLockouts = append(result.UserLockouts, userLockoutValues)