Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

LDAP secret engine support (#1032) #1033

Merged
merged 28 commits into from
Apr 13, 2024
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
28 commits
Select commit Hold shift + click to select a range
5d526ba
Initial commit for LDAP secrets engine
JordanStopford Aug 23, 2023
1b5aaad
Fix docs and linting issues
JordanStopford Aug 29, 2023
682d5eb
Fix linting error
JordanStopford Sep 4, 2023
df51d22
Run tests with docker container so we don't need to install vault
JordanStopford Mar 13, 2024
2dc7358
More tests
JordanStopford Mar 13, 2024
d1f5fd2
Merge branch 'main' into ldap-secrets
JordanStopford Mar 13, 2024
922bc96
Fix indentation
JordanStopford Mar 13, 2024
72258d3
Fix client not being available
JordanStopford Mar 13, 2024
1161ea4
Various test fixes
JordanStopford Mar 13, 2024
3adf09f
Merge branch 'hvac:main' into ldap-secrets
JordanStopford Mar 20, 2024
0feed5c
Reverting the changes prior to implementing unit tests
JordanStopford Mar 20, 2024
deb7d5b
Reverting the changes prior to implementing unit tests
JordanStopford Mar 20, 2024
c6221ae
Reverting the changes prior to implementing unit tests
JordanStopford Mar 20, 2024
a6a2602
Unit tests for LDAP secrets
JordanStopford Mar 20, 2024
f8e56cd
Reverting the changes prior to implementing unit tests
JordanStopford Mar 20, 2024
cda852f
Linting
JordanStopford Mar 20, 2024
0dc0cc4
Fix newline?
JordanStopford Mar 20, 2024
776db59
Fix newline?
JordanStopford Mar 20, 2024
777f961
Fix linting
JordanStopford Mar 20, 2024
476f6bc
Merge branch 'hvac:main' into ldap-secrets
JordanStopford Mar 22, 2024
a53faba
Apply suggestions from code review
briantist Apr 13, 2024
6a5d830
Update hvac/api/secrets_engines/ldap.py
briantist Apr 13, 2024
bd4b2a9
nit: remove docs character
briantist Apr 13, 2024
c705eb9
remove use of arbitrary kwargs
briantist Apr 13, 2024
d07671a
use example.com in tests
briantist Apr 13, 2024
cbe3f83
add unit test for generate_static_credentials
briantist Apr 13, 2024
f199003
Merge branch 'main' into pr/JordanStopford/1033
briantist Apr 13, 2024
d166125
Merge branch 'main' into pr/JordanStopford/1033
briantist Apr 13, 2024
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Fix docs and linting issues
  • Loading branch information
JordanStopford committed Aug 29, 2023
commit 1b5aaad3f29ebf436b2bec75e5f922f79a0a948c
12 changes: 6 additions & 6 deletions docs/usage/secrets_engines/ldap.rst
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ LDAP
.. contents::

Configure LDAP Secrets Secrets Engine
-----------------------------------
-------------------------------------

Configure the LDAP secrets engine to either manage service accounts or service account libraries.

Expand Down Expand Up @@ -50,7 +50,7 @@ Source reference: :py:meth:`hvac.api.secrets_engines.ldap.read_config`


Create or Update Static Role
---------------------
----------------------------

Create or Update a role which allows the retrieval and rotation of an LDAP account. Retrieve and rotate the actual credential via generate_static_credentials().

Expand All @@ -71,7 +71,7 @@ Source reference: :py:meth:`hvac.api.secrets_engines.ldap.create_or_update_stati


Read Static Role
---------
----------------

Retrieve the role configuration which allows the retrieval and rotation of an LDAP account. Retrieve and rotate the actual credential via generate_static_credentials().

Expand All @@ -88,7 +88,7 @@ Source reference: :py:meth:`hvac.api.secrets_engines.ldap.read_static_role`


List Static Roles
----------
-----------------

List all configured roles which allows the retrieval and rotation of an LDAP account. Retrieve and rotate the actual credential via generate_static_credentials().

Expand All @@ -105,7 +105,7 @@ Source reference: :py:meth:`hvac.api.secrets_engines.ldap.list_static_roles`


Delete Static Role
-----------
------------------

Remove the role configuration which allows the retrieval and rotation of an LDAP account.

Expand All @@ -124,7 +124,7 @@ Source reference: :py:meth:`hvac.api.secrets_engines.ldap.delete_static_role`
deletion_response = client.secrets.ldap.delete_static_role(name='sql-service-account')

Generate Static Credentials
--------------------
---------------------------

Retrieve a service account password from LDAP. Return the previous password (if known). Vault shall rotate
the password before returning it, if it has breached its configured ttl.
Expand Down
28 changes: 12 additions & 16 deletions hvac/api/secrets_engines/ldap.py
Original file line number Diff line number Diff line change
Expand Up @@ -89,7 +89,7 @@ def read_config(self, mount_point=DEFAULT_MOUNT_POINT):
return self._adapter.get(
url=api_path,
)

def rotate_root(self, mount_point=DEFAULT_MOUNT_POINT):
"""Rotate the root password for the binddn entry used to manage the ldap secrets engine.

Expand All @@ -101,13 +101,18 @@ def rotate_root(self, mount_point=DEFAULT_MOUNT_POINT):
:return: The JSON response of the request.
:rtype: dict
"""
api_path = utils.format_url("/v1/{mount_point}/rotate-root", mount_point=mount_point)
return self._adapter.post(
url=api_path
api_path = utils.format_url(
"/v1/{mount_point}/rotate-root", mount_point=mount_point
)
return self._adapter.post(url=api_path)

def create_or_update_static_role(
self, name, username=None, dn=None, rotation_period=None, mount_point=DEFAULT_MOUNT_POINT
self,
name,
username=None,
dn=None,
rotation_period=None,
mount_point=DEFAULT_MOUNT_POINT,
):
"""This endpoint creates or updates the ldap static role definition.

Expand All @@ -128,17 +133,8 @@ def create_or_update_static_role(
:rtype: requests.Response
"""
api_path = utils.format_url("/v1/{}/static-role/{}", mount_point, name)
params = {
"username": username,
"rotation_period": rotation_period
}
params.update(
utils.remove_nones(
{
"dn": dn
}
)
)
params = {"username": username, "rotation_period": rotation_period}
params.update(utils.remove_nones({"dn": dn}))
return self._adapter.post(
url=api_path,
json=params,
Expand Down
Loading