upstream/vault
1
0
Fork 0
mirror of https://github.com/hashicorp/vault.git synced 2026-03-27 04:43:25 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 13

Add warning when generate_lease=no_store=true when writing PKI role (#14292)

Browse source 
* Add warning when generate_lease=no_store=true

When no_store=true, the value of generate_lease is ignored completely
(and set to false). This means that when generate_lease=true is
specified by the caller of the API, it is silently swallowed. While
changing the behavior could break callers, setting a warning on the
response (changing from a 204->200 in the process) seems to make the
most sense.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add changelog entry

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
This commit is contained in:
Alexander Scheel 2022-02-28 12:55:12 -06:00 committed by GitHub
parent 130ef5574c
commit 021570e7c1
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 9 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
builtin/logical/pki/path_roles.go
View file

@ -583,6 +583,7 @@ func (b *backend) pathRoleList(ctx context.Context, req *logical.Request, d *fra
func (b *backend) pathRoleCreate(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
var err error
var resp *logical.Response
name := data.Get("name").(string)
entry := &roleEntry{
@ -644,6 +645,10 @@ func (b *backend) pathRoleCreate(ctx context.Context, req *logical.Request, data
// no_store implies generate_lease := false
if entry.NoStore {
*entry.GenerateLease = false
if data.Get("generate_lease").(bool) {
resp = &logical.Response{}
resp.AddWarning("mutually exclusive values no_store=true and generate_lease=true were both specified; no_store=true takes priority")
}
} else {
*entry.GenerateLease = data.Get("generate_lease").(bool)
}
@ -694,7 +699,7 @@ func (b *backend) pathRoleCreate(ctx context.Context, req *logical.Request, data
return nil, err
}
return nil, nil
return resp, nil
}
func parseKeyUsages(input []string) int {

3
changelog/14292.txt Normal file
View file

@ -0,0 +1,3 @@
```release-note:improvement
secrets/pki: Warn when `generate_lease` and `no_store` are both set to `true` on requests.
```