smart_proxy_vault 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 3bc99e2ef5775e96638be552f22d34c29d7401df
-  data.tar.gz: 8e133958ef309ad1bb51c9881811812aa3d7356a
+  metadata.gz: 65273d38422ca44e608f96ae9ae8817d400474ee
+  data.tar.gz: 29a3c9736686f61bea73aea03aa14fb6e142961c
 SHA512:
-  metadata.gz: e8646fd374e184105847592fc1513a61bdc787259d4a68b6303396b947fadaa0c24443b81199f395baee5539a73fde4454a05e5fbcb7ba2c03ff144ddbd200b5
-  data.tar.gz: 0c0541374147afccfef1e004a8d1c3be016df10420fd7aa235d254fd8e3c73706c345d981ad52e168e55a94e14ea33fdf9a8d519a684d4cfee95e6c8dee14041
+  metadata.gz: 5e5d49e23187f0e440b7183a4796dccb69bddb27ed2a91a6af1131e03d022bdbd323b2c3ffb3039a10b1ec86e83189b75c5b79fde36d2a4aee85a07d40e264db
+  data.tar.gz: 32d359e5abce0c2e6e7990a36c476e83f9778743afc3d22fea16d38c0b726a618b1a0fed2f303b3482bb6eefe1ec8de129f1682dd08b70cb0caba4240c7063da

data/CHANGELOG.md

@@ -0,0 +1,18 @@
+# Change Log
+
+## [v0.4.0](https://github.com/theforeman/smart_proxy_vault/tree/v0.4.0)
+- Added creating tokens from roles
+- Fixed days to seconds calculation
+- Updated Vault gem dependency to 0.7.0
+
+## [v0.3.0](https://github.com/theforeman/smart_proxy_vault/tree/v0.3.0)
+- Added token renewal (Closes [\#2](https://github.com/theforeman/smart_proxy_vault/issues/2))
+- Cleaned up lib/ directory layout & module namespaces
+- Updated Vault gem dependency to 0.4.0
+
+## [v0.2.0](https://github.com/theforeman/smart_proxy_vault/tree/v0.2.0)
+- Released as a gem
+- Added unit tests
+- Fixed several assumptions that may have caused issues
+
+## [v0.1.0](https://github.com/theforeman/smart_proxy_vault/tree/v0.1.0)

data/README.md

@@ -1,13 +1,13 @@
-[![Build Status](https://img.shields.io/travis/visioncritical/smart_proxy_vault/master.svg)](https://travis-ci.org/visioncritical/smart_proxy_vault)
+[![Build Status](https://img.shields.io/travis/theforeman/smart_proxy_vault/master.svg)](https://travis-ci.org/theforeman/smart_proxy_vault)
 [![Code Quality](https://img.shields.io/codeclimate/github/visioncritical/smart_proxy_vault.svg)](https://codeclimate.com/github/visioncritical/smart_proxy_vault)
 [![Code Climate](https://img.shields.io/codeclimate/coverage/github/visioncritical/smart_proxy_vault.svg)](https://codeclimate.com/github/visioncritical/smart_proxy_vault/coverage)
 [![Gem](https://img.shields.io/gem/v/smart_proxy_vault.svg)](https://rubygems.org/gems/smart_proxy_vault/versions)
 [![GitHub license](https://img.shields.io/badge/license-GPLv3-blue.svg)](./LICENSE)
 
 
-# Smart Proxy - Vault Plugin
+# Smart Proxy - Hashicorp Vault Plugin
 
-A Smart Proxy plugin will return a Vault token after authenticating a client.
+A Smart Proxy plugin that will return a Vault token after authenticating a client.
 
 ## Design
 
@@ -19,7 +19,7 @@ If you're unable to use one of the above to authenticate your clients, you can a
 
 ## Installation
 
-Add this line to your Smart Proxy bundler.d/vault.rb gemfile:
+Add this line to your Smart Proxy's `bundler.d/vault.rb` gemfile:
 
 ```ruby
 gem 'smart_proxy_vault'
@@ -58,7 +58,7 @@ Example:
 
 #####:enabled:
 
-Toggles whether or not this plugin is enabled for Smart Proxy.
+Toggles whether or not this plugin is enabled.
 
 #####:auth_backend:
 
@@ -123,7 +123,9 @@ A hash of settings that are used to configure a connection to the Chef server (u
 
 ## Usage
 
-To configure this plugin you can use template from [settings.d/vault.yml.example](settings.d/vault.yml.example). You must place the vault.yml config file in your Smart Proxy's `config/settings.d/` directory.
+To configure this plugin you can use template from [settings.d/vault.yml.example](settings.d/vault.yml.example). You must place the `vault.yml` config file in your Smart Proxy's `config/settings.d/` directory.
+
+The token specified in the [`:vault:`](#vault) section must be a role token so that this plugin can renew it indefinitely.
 
 ### Endpoints
 
@@ -131,14 +133,22 @@ To configure this plugin you can use template from [settings.d/vault.yml.example
 
 ##### Parameters
 
-`ttl=X[d,h,m,s]`
+###### `ttl=X[d,h,m,s]`
 
-Overrides the token TTL specified in the [`:token_options:`](#token_options) section. This value must be **lower** than the default TTL.
+Overrides the token TTL specified in the [`:token_options:`](#token_options) section. However, this value must be **lower** than the Vault server's `max_lease_ttl` value.
 
 Example:
 
 `/vault/token/issue?ttl=60s`
 
+###### `role=foo`
+
+A role to assign the token. Tokens issued under roles are able to be renewed indefinitely. This is useful for applications like Consul Template. The role must be created on the Vault server first.
+
+Example:
+
+`/vault/token/issue?role=foobar`
+
 ### Caveats
 
 In order to use this plugin effectively, the Ruby installation on your Smart Proxy server should be version 2.0.0 or higher, and be compiled against a version of OpenSSL that supports TLS (=>1.0.1). I recommend using [RVM](https://rvm.io/) & [Passenger](https://www.phusionpassenger.com) to run your Smart Proxy server.

data/lib/smart_proxy_vault/api.rb

@@ -25,12 +25,16 @@ module VaultPlugin
           @connection.auth_token.create(options).auth.client_token
         end
 
+        def issue_role_token(role, options)
+          @connection.auth_token.create_with_role(role, options).auth.client_token
+        end
+
         def lookup_self
           @connection.auth_token.lookup_self
         end
 
         def renew_self
-          @connection.auth_token.renew_self(lookup_self[:data][:creation_ttl])
+          @connection.auth_token.renew_self(lookup_self.data[:creation_ttl])
         end
       end
 
@@ -49,9 +53,10 @@ module VaultPlugin
         Client.new
       end
 
-      def issue(ttl)
+      def issue(ttl, role)
         begin
-          vault.issue_token options(ttl)
+          opts = options ttl
+          role.nil? ? vault.issue_token(opts) : vault.issue_role_token(role, opts)
         rescue StandardError => e
           log_halt 500, 'Failed to generate Vault token ' + e.message
         end

data/lib/smart_proxy_vault/endpoint.rb

@@ -20,7 +20,8 @@ module VaultPlugin
 
     get '/token/issue' do
       ttl = params[:ttl]
-      issue(ttl) if valid_ttl? ttl
+      role = params[:role]
+      issue(ttl, role) if valid_ttl? ttl
     end
   end
 end

data/lib/smart_proxy_vault/helpers.rb

@@ -19,7 +19,7 @@ module VaultPlugin
     def to_seconds(string)
       case string.slice(-1)
       when 'd'
-        string.tr('d', '').to_i * 30 * 24
+        string.tr('d', '').to_i * 24 * 3600
       when 'h'
         string.tr('h', '').to_i * 3600
       when 'm'

data/lib/smart_proxy_vault/version.rb

@@ -1,3 +1,3 @@
 module VaultPlugin
-  VERSION = '0.3.0'
+  VERSION = '0.4.0'
 end

data/test/authentication_chef_test.rb

@@ -1,9 +1,9 @@
-require 'test_helper'
+require_relative './test_helper'
 require 'smart_proxy_vault/authentication/chef'
 
-
 class AuthenticationChefTest < Test::Unit::TestCase
   include Rack::Test::Methods
+  include Proxy::Pluggable
 
   ###
   # Classes

data/test/request_test.rb

@@ -1,9 +1,10 @@
-require 'test_helper'
+require_relative './test_helper'
 require 'smart_proxy_vault'
 require 'smart_proxy_vault/endpoint'
 
 class RequestTest < Test::Unit::TestCase
   include Rack::Test::Methods
+  include VaultPlugin::API
 
   ###
   # Helper Methods
@@ -22,21 +23,92 @@ class RequestTest < Test::Unit::TestCase
   end
 
   def token
-    {:lease_id => "",
-     :renewable => false,
-     :lease_duration => 43200,
-     :data => nil,
-     :warnings => nil,
-     :auth => { :client_token => "GUID", :lease_duration => 43200, :renewable => true }}
+    {lease_id: "",
+     renewable: false,
+     lease_duration: 43200,
+     data: nil,
+     warnings: nil,
+     auth: { client_token: "GUID", lease_duration: 43200, renewable: true }}
+  end
+
+  def token_lookup
+    {request_id: "GUID",
+     lease_id: "",
+     renewable: false,
+     lease_duration: 0,
+     data:
+      {accessor: "GUID",
+       creation_time: 1111111111,
+       creation_ttl: 43200,
+       display_name: "token",
+       explicit_max_ttl: 0,
+       id: "GUID",
+       last_renewal_time: 1111111111,
+       meta: nil,
+       num_uses: 0,
+       orphan: false,
+       path: "auth/token/create/foorole",
+       policies: ["default"],
+       renewable: true,
+       role: "foorole",
+       ttl: 84971},
+     wrap_info: nil,
+     warnings: nil,
+     auth: nil}
+  end
+
+  def token_renew
+    {client_token: "GUID",
+     accessor: "GUID",
+     policies: ["default"],
+     metadata: nil,
+     lease_duration: 43200,
+     renewable: true}
   end
 
   def stub_response
     stub_request(:post, "https://vault.example.com/v1/auth/token/create").
-    with(:body => "{\"ttl\":\"12h\"}",
-         :headers => { 'Accept'=>['*/*', 'application/json'], 'Accept-Encoding'=>'gzip;q=1.0,deflate;q=0.6,identity;q=0.3',
-                       'Content-Type'=>'application/json', 'User-Agent'=>['Ruby', 'VaultRuby/0.4.0 (+github.com/hashicorp/vault-ruby)'],
-                       'X-Vault-Token'=>'GUID' }).
-    to_return(:status => 200, :body => token.to_json, :headers => { 'Content-Type'=>'application/json' })
+      with(:body => "{\"ttl\":\"12h\"}",
+           :headers => { 'Accept'=>['*/*', 'application/json'],
+                         'Accept-Encoding'=>'gzip;q=1.0,deflate;q=0.6,identity;q=0.3',
+                         'Content-Type'=>'application/json',
+                         'User-Agent'=>['Ruby', 'VaultRuby/0.7.3 (+github.com/hashicorp/vault-ruby)'],
+                         'X-Vault-Token'=>'GUID'}).
+      to_return(:status => 200, :body => token.to_json, :headers => { 'Content-Type'=>'application/json' })
+  end
+
+  def stub_response_role
+    stub_request(:post, "https://vault.example.com/v1/auth/token/create/foo").
+      with(:body => "{\"ttl\":\"12h\"}",
+           :headers => { 'Accept'=>['*/*', 'application/json'],
+                         'Accept-Encoding'=>'gzip;q=1.0,deflate;q=0.6,identity;q=0.3',
+                         'Content-Type'=>'application/json',
+                         'User-Agent'=>['Ruby', 'VaultRuby/0.7.3 (+github.com/hashicorp/vault-ruby)'],
+                         'X-Vault-Token'=>'GUID'}).
+      to_return(:status => 200, :body => token.to_json, :headers => { 'Content-Type'=>'application/json' })
+  end
+
+  def stub_response_lookup
+    stub_request(:get, "https://vault.example.com/v1/auth/token/lookup-self").
+      with(:headers => { 'Accept'=>['*/*', 'application/json'],
+                         'Accept-Encoding'=>'gzip;q=1.0,deflate;q=0.6,identity;q=0.3',
+                         'Content-Type'=>'application/json',
+                         'User-Agent'=>['Ruby',
+                          'VaultRuby/0.7.3 (+github.com/hashicorp/vault-ruby)'],
+                          'X-Vault-Token'=>'GUID'}).
+      to_return(:status => 200, :body => token_lookup.to_json, :headers => { 'Content-Type'=>'application/json' })
+  end
+
+  def stub_response_renew
+    stub_request(:put, "https://vault.example.com/v1/auth/token/renew-self").
+      with(:body => "{\"increment\":43200}",
+           :headers => { 'Accept'=>['*/*', 'application/json'],
+                         'Accept-Encoding'=>'gzip;q=1.0,deflate;q=0.6,identity;q=0.3',
+                         'Content-Type'=>'application/json',
+                         'User-Agent'=>['Ruby',
+                         'VaultRuby/0.7.3 (+github.com/hashicorp/vault-ruby)'],
+                         'X-Vault-Token'=>'GUID'}).
+      to_return(:status => 200, :body => token_renew.to_json, :headers => { 'Content-Type'=>'application/json' })
   end
 
   ###
@@ -66,8 +138,20 @@ class RequestTest < Test::Unit::TestCase
     assert last_response.ok?
   end
 
+  def test_vault_token_issue_role
+    stub_response_role
+    get '/token/issue', role: 'foo', ttl: '12h'
+    assert last_response.ok?
+  end
+
   def test_bad_ttl_override
     get '/token/issue', ttl: '24h'
     assert last_response.bad_request?
   end
+
+  def test_token_renewal
+    stub_response_lookup
+    stub_response_renew
+    renew
+  end
 end

data/test/test_helper.rb

@@ -1,14 +1,15 @@
-require "codeclimate-test-reporter"
-CodeClimate::TestReporter.start
+require 'simplecov'
+SimpleCov.start
 
 $: << File.join(File.dirname(__FILE__), '..', 'lib')
 
 require 'openssl'
 require 'test/unit'
+require "test/unit/rr"
 require 'webmock/test_unit'
 require 'rack/test'
-require 'rr'
 require 'factory_girl'
+require 'pry'
 FactoryGirl.find_definitions
 
 require 'smart_proxy_for_testing'
@@ -20,4 +21,4 @@ end
 logdir = File.join(File.dirname(__FILE__), '..', 'logs')
 FileUtils.mkdir_p(logdir) unless File.exists?(logdir)
 
-WebMock.disable_net_connect!(:allow => "codeclimate.com")
+WebMock.disable_net_connect!(:allow => 'codeclimate.com')

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: smart_proxy_vault
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Riley
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-05-16 00:00:00.000000000 Z
+date: 2016-11-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -67,6 +67,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2'
+- !ruby/object:Gem::Dependency
+  name: test-unit-rr
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
 - !ruby/object:Gem::Dependency
   name: mocha
   requirement: !ruby/object:Gem::Requirement
@@ -124,19 +138,47 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '4.0'
 - !ruby/object:Gem::Dependency
-  name: rr
+  name: simplecov
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.1'
+        version: '0.12'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.1'
+        version: '0.12'
+- !ruby/object:Gem::Dependency
+  name: codeclimate-test-reporter
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: activesupport
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '4.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '4.0'
 - !ruby/object:Gem::Dependency
   name: chef-api
   requirement: !ruby/object:Gem::Requirement
@@ -157,14 +199,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.4.0
+        version: 0.7.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.4.0
+        version: 0.7.0
 description: Authenticates a client & returns a Vault token
 email: riley.shott@visioncritical.com
 executables: []
@@ -172,7 +214,9 @@ extensions: []
 extra_rdoc_files:
 - README.md
 - LICENSE
+- CHANGELOG.md
 files:
+- CHANGELOG.md
 - LICENSE
 - README.md
 - bundler.d/vault.rb
@@ -192,7 +236,7 @@ files:
 - test/fixtures/authentication/chef/fry.pem
 - test/request_test.rb
 - test/test_helper.rb
-homepage: http://github.com/visioncritical/smart_proxy_vault
+homepage: http://github.com/theforeman/smart_proxy_vault
 licenses:
 - GPLv3
 metadata: {}
@@ -212,7 +256,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.6
+rubygems_version: 2.6.6
 signing_key: 
 specification_version: 4
 summary: Authenticates a client & returns a Vault token