Skip to content

Removed check for roleName in template parameters. #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
joevanwanzeeleKF wants to merge 2 commits into
base: release-1.0
Choose a base branch
from
Open

Removed check for roleName in template parameters. #5

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4f05381
Removed check for client cert as client cert auth has not been implem…
joevanwanzeeleKF Mar 10, 2025
3987b0f
Removing validation for RoleName to be defined in the template; unnec…
joevanwanzeeleKF Mar 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 42 additions & 12 deletions hashicorp-vault-cagateway/HashicorpVaultCAConnector.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@
private readonly ILogger logger;
private HashicorpVaultCAConfig _caConfig { get; set; }
private HashicorpVaultClient _client { get; set; }
private ICertificateDataReader _certificateDataReader;

Check warning on line 29 in hashicorp-vault-cagateway/HashicorpVaultCAConnector.cs

View workflow job for this annotation

GitHub Actions / call-starter-workflow / call-dotnet-build-and-release-workflow / dotnet-build-and-release 

Field 'HashicorpVaultCAConnector._certificateDataReader' is never assigned to, and will always have its default value null
private JsonSerializerOptions _serializerOptions;

public HashicorpVaultCAConnector()
Expand Down Expand Up @@ -352,18 +352,22 @@

// make sure an authentication mechanism is defined (either certificate or token)
var token = connectionInfo[Constants.CAConfig.TOKEN] as string;
var cert = connectionInfo[Constants.CAConfig.CLIENTCERT] as string;

if (string.IsNullOrEmpty(token) && string.IsNullOrEmpty(cert))
{
errors.Add("Either an authentication token or client certificate must be defined for authentication into Vault.");
}
if (!string.IsNullOrEmpty(token) && !string.IsNullOrEmpty(cert))
{
logger.LogWarning("Both an authentication token and client certificate are defined. Using the token for authentication.");
}
/// REMOVING CERT VALIDATION UNTIL CLIENT CERT AUTH IS IMPLEMENTED

//var cert = connectionInfo[Constants.CAConfig.CLIENTCERT] as string;

//if (string.IsNullOrEmpty(token) && string.IsNullOrEmpty(cert))
//{
// errors.Add("Either an authentication token or client certificate must be defined for authentication into Vault.");
//}
//if (!string.IsNullOrEmpty(token) && !string.IsNullOrEmpty(cert))
//{
// logger.LogWarning("Both an authentication token and client certificate are defined. Using the token for authentication.");
//}

// if any errors, throw

if (errors.Any())
{
var allErrors = string.Join("\n", errors);
Expand Down Expand Up @@ -439,10 +443,15 @@
logger.LogError(LogHandler.FlattenException(ex));
throw;
}
// make sure Role Name is present in the template config
if (string.IsNullOrEmpty(productInfo.ProductParameters[Constants.TemplateConfig.ROLENAME] as string))
// make sure product ID is a valid RoleName
if (string.IsNullOrEmpty(productInfo.ProductID))
{
errors.Add($"The '{Constants.TemplateConfig.ROLENAME}' is required.");
errors.Add($"The productID is required.");
}

if (!ProductIdIsValid(productInfo.ProductID, caConfig).Result)
{
errors.Add($"The productID {productInfo.ProductID} does not match any of the role names defined in Vault.");
}

// if any errors, throw
Expand All @@ -456,6 +465,27 @@
return Task.CompletedTask;
}

private async Task<bool> ProductIdIsValid(string productID, HashicorpVaultCAConfig config)
{

_client = new HashicorpVaultClient(config);

// attempt an authenticated request to retreive role names
try
{
logger.LogTrace("making an authenticated request to the Vault server to verify credentials (listing role names)..");
var roleNames = await _client.GetRoleNamesAsync();
logger.LogTrace($"successfule request: received a response containing {roleNames.Count} role names");
return roleNames.Any(rn => rn == productID);
}
catch (Exception ex)
{
logger.LogError($"Authenticated request failed. {ex.Message}");
throw;
}
finally { logger.MethodExit(); }
}

/// <summary>
/// Gets annotations for the CA connector properties.
/// </summary>
Expand Down