2023-03-15 19:00:52 +03:00
|
|
|
// Copyright (c) HashiCorp, Inc.
|
2024-01-02 21:36:20 +03:00
|
|
|
// SPDX-License-Identifier: BUSL-1.1
|
2023-03-15 19:00:52 +03:00
|
|
|
|
2017-10-11 20:21:20 +03:00
|
|
|
package vault
|
|
|
|
|
|
|
|
import (
|
2021-08-30 22:31:11 +03:00
|
|
|
"context"
|
2017-10-11 20:21:20 +03:00
|
|
|
"regexp"
|
|
|
|
"sync"
|
|
|
|
|
2018-04-03 03:46:59 +03:00
|
|
|
log "github.com/hashicorp/go-hclog"
|
2019-07-03 06:15:43 +03:00
|
|
|
"github.com/hashicorp/go-memdb"
|
2017-11-02 23:05:48 +03:00
|
|
|
"github.com/hashicorp/vault/helper/identity"
|
2021-08-30 22:31:11 +03:00
|
|
|
"github.com/hashicorp/vault/helper/metricsutil"
|
|
|
|
"github.com/hashicorp/vault/helper/namespace"
|
2017-10-11 20:21:20 +03:00
|
|
|
"github.com/hashicorp/vault/helper/storagepacker"
|
2019-04-13 00:54:35 +03:00
|
|
|
"github.com/hashicorp/vault/sdk/framework"
|
2021-08-30 22:31:11 +03:00
|
|
|
"github.com/hashicorp/vault/sdk/helper/consts"
|
2019-04-13 10:44:06 +03:00
|
|
|
"github.com/hashicorp/vault/sdk/logical"
|
2017-10-11 20:21:20 +03:00
|
|
|
)
|
|
|
|
|
|
|
|
const (
|
|
|
|
// Storage prefixes
|
|
|
|
entityPrefix = "entity/"
|
|
|
|
)
|
|
|
|
|
2021-04-08 19:43:39 +03:00
|
|
|
// metaKeyFormatRegEx checks if a metadata key string is valid
|
|
|
|
var metaKeyFormatRegEx = regexp.MustCompile(`^[a-zA-Z0-9=/+_-]+$`).MatchString
|
2017-10-11 20:21:20 +03:00
|
|
|
|
|
|
|
const (
|
|
|
|
// The meta key prefix reserved for Vault's internal use
|
|
|
|
metaKeyReservedPrefix = "vault-"
|
|
|
|
|
|
|
|
// The maximum number of metadata key pairs allowed to be registered
|
|
|
|
metaMaxKeyPairs = 64
|
|
|
|
|
|
|
|
// The maximum allowed length of a metadata key
|
|
|
|
metaKeyMaxLength = 128
|
|
|
|
|
|
|
|
// The maximum allowed length of a metadata value
|
|
|
|
metaValueMaxLength = 512
|
|
|
|
)
|
|
|
|
|
|
|
|
// IdentityStore is composed of its own storage view and a MemDB which
|
|
|
|
// maintains active in-memory replicas of the storage contents indexed by
|
|
|
|
// multiple fields.
|
|
|
|
type IdentityStore struct {
|
|
|
|
// IdentityStore is a secret backend in Vault
|
|
|
|
*framework.Backend
|
|
|
|
|
|
|
|
// view is the storage sub-view where all the artifacts of identity store
|
|
|
|
// gets persisted
|
|
|
|
view logical.Storage
|
|
|
|
|
|
|
|
// db is the in-memory database where the storage artifacts gets replicated
|
|
|
|
// to enable richer queries based on multiple indexes.
|
|
|
|
db *memdb.MemDB
|
|
|
|
|
2019-07-03 06:15:43 +03:00
|
|
|
// locks to make sure things are consistent
|
|
|
|
lock sync.RWMutex
|
|
|
|
oidcLock sync.RWMutex
|
2017-10-11 20:21:20 +03:00
|
|
|
|
|
|
|
// groupLock is used to protect modifications to group entries
|
|
|
|
groupLock sync.RWMutex
|
|
|
|
|
2019-06-21 20:23:39 +03:00
|
|
|
// oidcCache stores common response data as well as when the periodic func needs
|
|
|
|
// to run. This is conservatively managed, and most writes to the OIDC endpoints
|
|
|
|
// will invalidate the cache.
|
2019-07-03 06:15:43 +03:00
|
|
|
oidcCache *oidcCache
|
2019-06-21 20:23:39 +03:00
|
|
|
|
2021-09-27 20:55:29 +03:00
|
|
|
// oidcAuthCodeCache stores OIDC authorization codes to be exchanged
|
|
|
|
// for an ID token during an authorization code flow.
|
|
|
|
oidcAuthCodeCache *oidcCache
|
|
|
|
|
2017-10-11 20:21:20 +03:00
|
|
|
// logger is the server logger copied over from core
|
|
|
|
logger log.Logger
|
|
|
|
|
|
|
|
// entityPacker is used to pack multiple entity storage entries into 256
|
|
|
|
// buckets
|
|
|
|
entityPacker *storagepacker.StoragePacker
|
|
|
|
|
2021-10-15 22:20:00 +03:00
|
|
|
// localAliasPacker is used to pack multiple local alias entries into lesser
|
|
|
|
// storage entries. This is also used to cache entities in the secondary
|
|
|
|
// clusters, those entities which were created by the primary but hasn't
|
|
|
|
// reached secondary via invalidations.
|
|
|
|
localAliasPacker *storagepacker.StoragePacker
|
|
|
|
|
2017-10-11 20:21:20 +03:00
|
|
|
// groupPacker is used to pack multiple group storage entries into 256
|
|
|
|
// buckets
|
|
|
|
groupPacker *storagepacker.StoragePacker
|
2018-04-03 05:17:33 +03:00
|
|
|
|
2018-10-19 22:47:26 +03:00
|
|
|
// disableLowerCaseNames indicates whether or not identity artifacts are
|
|
|
|
// operated case insensitively
|
|
|
|
disableLowerCasedNames bool
|
2021-08-30 22:31:11 +03:00
|
|
|
|
|
|
|
router *Router
|
|
|
|
redirectAddr string
|
|
|
|
localNode LocalNode
|
|
|
|
namespacer Namespacer
|
|
|
|
metrics metricsutil.Metrics
|
|
|
|
totpPersister TOTPPersister
|
|
|
|
groupUpdater GroupUpdater
|
2021-09-27 20:55:29 +03:00
|
|
|
tokenStorer TokenStorer
|
2021-10-15 22:20:00 +03:00
|
|
|
entityCreator EntityCreator
|
2022-02-18 00:08:51 +03:00
|
|
|
mfaBackend *LoginMFABackend
|
2017-10-11 20:21:20 +03:00
|
|
|
}
|
2017-11-02 23:05:48 +03:00
|
|
|
|
|
|
|
type groupDiff struct {
|
|
|
|
New []*identity.Group
|
|
|
|
Deleted []*identity.Group
|
|
|
|
Unmodified []*identity.Group
|
|
|
|
}
|
2019-09-30 17:27:25 +03:00
|
|
|
|
|
|
|
type casesensitivity struct {
|
|
|
|
DisableLowerCasedNames bool `json:"disable_lower_cased_names"`
|
|
|
|
}
|
2021-08-30 22:31:11 +03:00
|
|
|
|
|
|
|
type LocalNode interface {
|
|
|
|
ReplicationState() consts.ReplicationState
|
|
|
|
HAState() consts.HAState
|
|
|
|
}
|
|
|
|
|
|
|
|
var _ LocalNode = &Core{}
|
|
|
|
|
|
|
|
type Namespacer interface {
|
|
|
|
NamespaceByID(context.Context, string) (*namespace.Namespace, error)
|
2022-09-06 21:11:04 +03:00
|
|
|
ListNamespaces(includePath bool) []*namespace.Namespace
|
2021-08-30 22:31:11 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
var _ Namespacer = &Core{}
|
|
|
|
|
|
|
|
type TOTPPersister interface {
|
|
|
|
PersistTOTPKey(ctx context.Context, configID string, entityID string, key string) error
|
|
|
|
}
|
|
|
|
|
|
|
|
var _ TOTPPersister = &Core{}
|
|
|
|
|
|
|
|
type GroupUpdater interface {
|
|
|
|
SendGroupUpdate(ctx context.Context, group *identity.Group) (bool, error)
|
|
|
|
}
|
|
|
|
|
|
|
|
var _ GroupUpdater = &Core{}
|
2021-09-27 20:55:29 +03:00
|
|
|
|
|
|
|
type TokenStorer interface {
|
2021-10-14 04:59:36 +03:00
|
|
|
LookupToken(context.Context, string) (*logical.TokenEntry, error)
|
|
|
|
CreateToken(context.Context, *logical.TokenEntry) error
|
2021-09-27 20:55:29 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
var _ TokenStorer = &Core{}
|
2021-10-15 22:20:00 +03:00
|
|
|
|
|
|
|
type EntityCreator interface {
|
|
|
|
CreateEntity(ctx context.Context) (*identity.Entity, error)
|
|
|
|
}
|
|
|
|
|
|
|
|
var _ EntityCreator = &Core{}
|