Skip to content

Commit d25ab97

Browse files
author
benlfhuang
committed
vault支持跨账号角色授权登陆
1 parent db95682 commit d25ab97

18 files changed

+250
-433
lines changed

Diff for: ‎.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,4 @@
1515
# vendor/
1616

1717
.idea
18+
/cmd/vault-plugin-auth-tencentcloud/vault-plugin-auth-tencentcloud

Diff for: ‎backend_test.go

+7-23
Original file line numberDiff line numberDiff line change
@@ -366,29 +366,13 @@ func (e *testEnv) getIsAccTestCreds(t *testing.T) (creds common.CredentialIface)
366366
}
367367

368368
func (e *testEnv) LoginSuccess(t *testing.T) {
369-
370-
var creds common.CredentialIface
371-
var err error
372-
373-
if e.isAccTest {
374-
creds = e.getIsAccTestCreds(t)
375-
} else {
376-
creds, err = clients.NewConfigurationCredentialProvider(&clients.Configuration{
377-
// dummy creds are fine
378-
SecretId: e.clientConfigSecretId,
379-
SecretKey: e.clientConfigSecretKey,
380-
Token: e.token,
381-
}).GetCredential()
382-
}
383-
384-
if err != nil {
385-
t.Fatal(err)
386-
}
387-
388-
data, err := tools.GenerateLoginData(e.arn.RoleName, creds, "us-west-2")
389-
if err != nil {
390-
t.Fatal(err)
391-
}
369+
data := tools.GenerateLoginDataV2(
370+
e.arn.RoleName,
371+
"na-ashburn",
372+
e.clientConfigSecretId,
373+
e.clientConfigSecretKey,
374+
e.token,
375+
)
392376
req := &logical.Request{
393377
Operation: logical.UpdateOperation,
394378
Path: "login",

Diff for: ‎cli.go

+5-10
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ import (
55
"fmt"
66
"strings"
77

8-
"github.com/hashicorp/vault-plugin-auth-tencentcloud/clients"
98
"github.com/hashicorp/vault-plugin-auth-tencentcloud/tools"
109
"github.com/hashicorp/vault/api"
1110
)
@@ -20,15 +19,11 @@ func (h *CLIHandler) Auth(c *api.Client, m map[string]string) (*api.Secret, erro
2019
mount = "tencentcloud"
2120
}
2221
role := m["role"]
23-
24-
creds, err := clients.ChainedCredsToCli(m["secret_id"], m["secret_key"], m["token"])
25-
if err != nil {
26-
return nil, err
27-
}
28-
loginData, err := tools.GenerateLoginData(role, creds, m["region"])
29-
if err != nil {
30-
return nil, err
31-
}
22+
sid := m["secret_id"]
23+
skey := m["secret_key"]
24+
token := m["token"]
25+
region := m["region"]
26+
loginData := tools.GenerateLoginDataV2(role, sid, skey, token, region)
3227
path := fmt.Sprintf("auth/%s/login", mount)
3328
secret, err := c.Logical().Write(path, loginData)
3429
if err != nil {

Diff for: ‎clients/cam.go

+2-5
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,14 @@
11
package clients
22

33
import (
4-
"fmt"
5-
64
cam "github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cam/v20190116"
75
"github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common/profile"
86
"github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common/regions"
97
)
108

119
// init New CAM Client
12-
func NewCAMClient(secretId, secretKey string) (*CAMClient, error) {
13-
creds, err := ChainedCredsToCli(secretId, secretKey, "")
10+
func NewCAMClient(secretId, secretKey, token string) (*CAMClient, error) {
11+
creds, err := ChainedCredsToCli(secretId, secretKey, token)
1412
if err != nil {
1513
return nil, err
1614
}
@@ -34,7 +32,6 @@ func (c *CAMClient) GetRoleName(roleId string) (roleName string, err error) {
3432
req := cam.NewGetRoleRequest()
3533
req.RoleId = &roleId
3634
roleRsp, err := c.client.GetRole(req)
37-
fmt.Println(roleRsp.ToJsonString())
3835
if err != nil {
3936
return "", err
4037
}

Diff for: ‎clients/cam_test.go

+65
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
package clients
2+
3+
import (
4+
"fmt"
5+
cam "github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cam/v20190116"
6+
"github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common/profile"
7+
"github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common/regions"
8+
"testing"
9+
)
10+
11+
func TestCAMClient_GetRoleName(t *testing.T) {
12+
secretId := "xxxx"
13+
secretKey := "xxxx"
14+
token := "xxxx"
15+
16+
creds, err := ChainedCredsToCli(secretId, secretKey, token)
17+
if err != nil {
18+
fmt.Printf("错误信息,%v", err)
19+
}
20+
profile := profile.NewClientProfile()
21+
profile.Language = "en-US"
22+
profile.HttpProfile.ReqTimeout = 90
23+
client, err := cam.NewClient(creds, regions.Ashburn, profile)
24+
if err != nil {
25+
fmt.Printf("错误信息,%v", err)
26+
}
27+
type fields struct {
28+
client *cam.Client
29+
}
30+
type args struct {
31+
roleId string
32+
}
33+
tests := []struct {
34+
name string
35+
fields fields
36+
args args
37+
wantRoleName string
38+
wantErr bool
39+
}{
40+
{
41+
name: "TestCAMClient_GetRoleName",
42+
fields: fields{
43+
client: client,
44+
},
45+
args: args{
46+
roleId: "4611686028425447636",
47+
},
48+
},
49+
}
50+
for _, tt := range tests {
51+
t.Run(tt.name, func(t *testing.T) {
52+
c := &CAMClient{
53+
client: tt.fields.client,
54+
}
55+
gotRoleName, err := c.GetRoleName(tt.args.roleId)
56+
if (err != nil) != tt.wantErr {
57+
t.Errorf("GetRoleName() error = %v, wantErr %v", err, tt.wantErr)
58+
return
59+
}
60+
if gotRoleName != tt.wantRoleName {
61+
t.Errorf("GetRoleName() gotRoleName = %v, want %v", gotRoleName, tt.wantRoleName)
62+
}
63+
})
64+
}
65+
}

Diff for: ‎clients/sts.go

+54
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
package clients
2+
3+
import (
4+
"github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common/profile"
5+
sts "github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/sts/v20180813"
6+
)
7+
8+
// NewStsClient init New STS Client
9+
func NewStsClient(secretId, secretKey, token, region string) (*STSClient, error) {
10+
creds, err := ChainedCredsToCli(secretId, secretKey, token)
11+
if err != nil {
12+
return nil, err
13+
}
14+
profile := profile.NewClientProfile()
15+
profile.Language = "en-US"
16+
profile.HttpProfile.ReqTimeout = 90
17+
client, err := sts.NewClient(creds, region, profile)
18+
if err != nil {
19+
return nil, err
20+
}
21+
return &STSClient{client: client}, nil
22+
}
23+
24+
// STSClient STS Client
25+
type STSClient struct {
26+
client *sts.Client
27+
}
28+
29+
// CallerIdentityRsp caller identity response
30+
type CallerIdentityRsp struct {
31+
Arn string
32+
AccountId string
33+
UserId string
34+
PrincipalId string
35+
Type string
36+
RequestId string
37+
}
38+
39+
// GetCallerIdentity get caller identity
40+
func (c *STSClient) GetCallerIdentity() (rsp *CallerIdentityRsp, err error) {
41+
req := sts.NewGetCallerIdentityRequest()
42+
callerIdentityRsp, err := c.client.GetCallerIdentity(req)
43+
if err != nil {
44+
return nil, err
45+
}
46+
return &CallerIdentityRsp{
47+
Type: *callerIdentityRsp.Response.Type,
48+
Arn: *callerIdentityRsp.Response.Arn,
49+
AccountId: *callerIdentityRsp.Response.AccountId,
50+
UserId: *callerIdentityRsp.Response.UserId,
51+
PrincipalId: *callerIdentityRsp.Response.PrincipalId,
52+
RequestId: *callerIdentityRsp.Response.RequestId,
53+
}, nil
54+
}

Diff for: ‎docs/Tencent Cloud - Auth Methods - HTTP API.md

+8-6
Original file line numberDiff line numberDiff line change
@@ -164,18 +164,20 @@ Fetch a token. This endpoint verifies the signature of the signed GetCallerIdent
164164
### Parameters
165165

166166
- `role` `(string: <required>)` - Name of the role.
167-
- `identity_request_url` `(string: <required>)` - Base64-encoded HTTP URL used in the signed request.
168-
- `identity_request_headers` `(string: <required>)` - Base64-encoded, JSON-serialized representation of the sts:
169-
GetCallerIdentity HTTP request headers. The JSON serialization assumes that each header key maps to either a string
170-
value or an array of string values (though the length of that array will probably only be one).
167+
- `region` `(string: <optional>)` - Name of the region.
168+
- `secret_id` `(string: <required>)` - Tencentcloud secret id
169+
- `secret_key` `(string: <required>)` - Tencentcloud secret key
170+
- `token` `(string: <required>)` - Tencentcloud token
171171

172172
### Sample Payload
173173

174174
```json
175175
{
176176
"role": "dev-role",
177-
"identity_request_url": "...",
178-
"identity_request_headers": "..."
177+
"region": "...",
178+
"secret_id": "...",
179+
"secret_key": "...",
180+
"token": "..."
179181
}
180182
```
181183

Diff for: ‎docs/Tencent Cloud Auth Method.md

+4-2
Original file line numberDiff line numberDiff line change
@@ -93,8 +93,10 @@ $ vault write auth/tencentcloud/role/dev-role arn='qcs::cam::uin/100021543443:ro
9393
```shell
9494
$ vault write auth/tencentcloud/login \
9595
role=dev-role \
96-
identity_request_url=$IDENTITY_REQUEST_URL_BASE_64 \
97-
identity_request_headers=$IDENTITY_REQUEST_HEADERS_BASE_64
96+
region=$IDENTITY_REQUEST_REGION \
97+
secret_id=$IDENTITY_REQUEST_SECRET_ID \
98+
secret_key=$IDENTITY_REQUEST_SECRET_KEY \
99+
token=$IDENTITY_REQUEST_TOKEN
98100
```
99101

100102
For the CAM auth method, generating the signed request is a non-standard operation. The Vault CLI supports generating

Diff for: ‎go.mod

+3-6
Original file line numberDiff line numberDiff line change
@@ -10,16 +10,15 @@ require (
1010
github.com/hashicorp/go-uuid v1.0.2
1111
github.com/hashicorp/vault/api v1.3.0
1212
github.com/hashicorp/vault/sdk v0.3.0
13-
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cam v1.0.286
14-
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.285
15-
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/sts v1.0.293
13+
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cam v1.0.1016
14+
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.1016
15+
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/sts v1.0.1016
1616
)
1717

1818
require (
1919
github.com/armon/go-metrics v0.3.9 // indirect
2020
github.com/armon/go-radix v1.0.0 // indirect
2121
github.com/cenkalti/backoff/v3 v3.0.0 // indirect
22-
github.com/davecgh/go-spew v1.1.1 // indirect
2322
github.com/evanphx/json-patch/v5 v5.5.0 // indirect
2423
github.com/fatih/color v1.7.0 // indirect
2524
github.com/golang/protobuf v1.5.2 // indirect
@@ -47,7 +46,6 @@ require (
4746
github.com/oklog/run v1.0.0 // indirect
4847
github.com/pierrec/lz4 v2.5.2+incompatible // indirect
4948
github.com/pkg/errors v0.9.1 // indirect
50-
github.com/pmezard/go-difflib v1.0.0 // indirect
5149
github.com/ryanuber/go-glob v1.0.0 // indirect
5250
go.uber.org/atomic v1.9.0 // indirect
5351
golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97 // indirect
@@ -59,5 +57,4 @@ require (
5957
google.golang.org/grpc v1.41.0 // indirect
6058
google.golang.org/protobuf v1.26.0 // indirect
6159
gopkg.in/square/go-jose.v2 v2.5.1 // indirect
62-
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c // indirect
6360
)

Diff for: ‎go.sum

+6-5
Original file line numberDiff line numberDiff line change
@@ -223,12 +223,14 @@ github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81P
223223
github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
224224
github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY=
225225
github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
226-
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cam v1.0.286 h1:vKUWFu+b7zixbzuZqGbuOkzQzw2eeUxituc8MsuQ89o=
227-
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cam v1.0.286/go.mod h1:ys+65P4jdhUP5rQFSPI9O8/5s0lNcPycl5IPOTaZyVU=
228-
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.285 h1:/pxhtrvLDidDxEi0MFyICPKeJ+gvtIBdfZZSx3Nz8rA=
229-
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.285/go.mod h1:7sCQWVkxcsR38nffDW057DRGk8mUjK1Ing/EFOK8s8Y=
226+
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cam v1.0.1016 h1:i2iHHQVd1jh7ATG1AOGBl1Ok1WJQngy4Nk11RiPLnC4=
227+
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cam v1.0.1016/go.mod h1:08eNxt3v411zXWW1Pr1GMDnj4Qm6HCNgDSvG/naOrhQ=
228+
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.1016 h1:gFA+fJStsfNwOAfVrgpjej4iq1A/YdWW4GB2D6B8fGk=
229+
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.1016/go.mod h1:r5r4xbfxSaeR04b166HGsBa/R4U3SueirEUpXGuw+Q0=
230230
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/sts v1.0.293 h1:VExz4pakQsBu872prgUMIZnAVTIsJQHuAqGIZBNreVc=
231231
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/sts v1.0.293/go.mod h1:3LRL4bjS4JieTruoWSqnMA/rPOxd2TXsstNBKtN+2qQ=
232+
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/sts v1.0.1016 h1:9pXcgdNC+7Esd3soQUwn1aHgFrIw1J2+n6LCiMnTuYg=
233+
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/sts v1.0.1016/go.mod h1:yR/gWOCs7bEn5d0B9zSzTVKshBLgI30ZvVxlkLIx7No=
232234
github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM=
233235
go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
234236
go.uber.org/atomic v1.9.0 h1:ECmE8Bn/WFTYwEW/bpKD3M8VtR/zQVbavAoalC1PYyE=
@@ -324,7 +326,6 @@ google.golang.org/protobuf v1.26.0 h1:bxAC2xTBsZGibn2RTntX0oH50xLsqy1OxA9tTL3p/l
324326
google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
325327
gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
326328
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
327-
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
328329
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
329330
gopkg.in/square/go-jose.v2 v2.5.1 h1:7odma5RETjNHWJnR32wx8t+Io4djHE1PqxCFx3iiZ2w=
330331
gopkg.in/square/go-jose.v2 v2.5.1/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=

0 commit comments

Comments
 (0)