Skip to content

Commit b8f4359

Browse files
abedraabedra
committed
AppRole can have multiple mounts. Closes #115 
1 parent dcfec8a commit b8f4359

File tree

8 files changed

+177
-115
lines changed

8 files changed

+177
-115
lines changed

‎CMakeLists.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
cmake_minimum_required(VERSION 3.12)
22
project(
33
vault
4-
VERSION 0.53.0
4+
VERSION 0.54.0
55
DESCRIPTION "Vault library for C++")
66

77
set(CMAKE_CXX_STANDARD 17)

‎README.md‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,6 @@
11
# libvault
22
![CMake](https://github.com/abedra/libvault/workflows/CMake/badge.svg)
3-
<a href="https://lgtm.com/projects/g/abedra/libvault/">
4-
<img src="https://img.shields.io/lgtm/alerts/g/abedra/libvault" alt="Total alerts"/>
5-
</a>
6-
![LGTM Grade](https://img.shields.io/lgtm/grade/cpp/github/abedra/libvault)
7-
[![Version](https://img.shields.io/badge/version-0.53.0-4a8fff)](https://img.shields.io/badge/version-0.53.0-4a8fff)
3+
[![Version](https://img.shields.io/badge/version-0.54.0-4a8fff)](https://img.shields.io/badge/version-0.54.0-4a8fff)
84

95
A C++ library for [Hashicorp Vault](https://www.vaultproject.io/)
106

‎example/authentication/approle/Makefile‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,18 @@
11
default: example
22

33
example.o: example.cpp
4-
g++ -std=c++17 -c ../../../lib/json.hpp example.cpp
4+
g++ -Wall -std=c++17 -I../../../include -c ../../../lib/json.hpp example.cpp
55

66
example: example.o
7-
g++ example.o -o example -lvault -lcurl
7+
g++ -L../../../cmake-build-debug example.o -o example -lvault -lcurl
8+
9+
.PHONY: macos
10+
macos:
11+
install_name_tool -change @rpath/libvault.0.dylib ../../../cmake-build-debug/libvault.0.dylib example
812

913
.PHONY: clean
1014
clean:
1115
rm -f example.o example
1216

1317
vault:
14-
docker run -p 8200:8200 vault
18+
docker run -p 8200:8200 vault

‎example/authentication/approle/example.cpp‎

Lines changed: 13 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,44 @@
1-
#include <iostream>
2-
#include "VaultClient.h"
31
#include "../../shared/shared.h"
2+
#include <iostream>
43

5-
Vault::Client setup(const Vault::Client &rootClient) {
4+
Vault::Client setup(const Vault::Client &rootClient, const Vault::Path &mount) {
65
Vault::Sys::Auth authAdmin{rootClient};
7-
Vault::AppRole appRoleAdmin{rootClient};
6+
Vault::AppRole appRoleAdmin{rootClient, mount};
87

9-
enableAppRole(authAdmin);
8+
enableAppRole(authAdmin, mount);
109
createRole(appRoleAdmin);
1110

1211
Vault::RoleId roleId = getRoleId(appRoleAdmin);
1312
Vault::SecretId secretId = getSecretId(appRoleAdmin);
1413

15-
return getAppRoleClient(roleId, secretId);
14+
return getAppRoleClient(roleId, secretId, mount);
1615
}
1716

18-
void cleanup(const Vault::Client &rootClient) {
17+
void cleanup(const Vault::Client &rootClient, const Vault::Path &mount) {
1918
Vault::Sys::Auth authAdmin = Vault::Sys::Auth{rootClient};
20-
Vault::AppRole appRoleAdmin = Vault::AppRole{rootClient};
19+
Vault::AppRole appRoleAdmin = Vault::AppRole{rootClient, mount};
2120

2221
deleteRole(appRoleAdmin);
23-
disableAppRole(authAdmin);
22+
disableAppRole(authAdmin, mount);
2423
}
2524

2625
int main(void) {
2726
char *rootTokenEnv = std::getenv("VAULT_ROOT_TOKEN");
2827
if (!rootTokenEnv) {
29-
std::cout << "The VAULT_ROOT_TOKEN environment variable must be set" << std::endl;
28+
std::cout << "The VAULT_ROOT_TOKEN environment variable must be set"
29+
<< std::endl;
3030
exit(-1);
3131
}
3232
Vault::Token rootToken{rootTokenEnv};
3333
Vault::Client rootClient = getRootClient(rootToken);
34-
Vault::Client appRoleClient = setup(rootClient);
34+
Vault::Path mount{"approle"};
35+
Vault::Client appRoleClient = setup(rootClient, mount);
3536

3637
if (appRoleClient.is_authenticated()) {
3738
std::cout << "Authenticated: " << appRoleClient.getToken() << std::endl;
3839
} else {
3940
std::cout << "Unable to authenticate" << std::endl;
4041
}
4142

42-
cleanup(rootClient);
43+
cleanup(rootClient, mount);
4344
}

‎example/shared/shared.h‎

Lines changed: 68 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -1,120 +1,144 @@
11
#pragma once
2-
#include <iostream>
32
#include "../../lib/json.hpp"
4-
#include "libvault/VaultClient.h"
3+
#include "VaultClient.h"
4+
#include <iostream>
55

6-
Vault::Client getRootClient(const Vault::Token &rootToken) {
6+
inline Vault::Client getRootClient(const Vault::Token &rootToken) {
77
Vault::TokenStrategy tokenStrategy{rootToken};
8-
Vault::Config config = Vault::ConfigBuilder().withDebug(false).withTlsEnabled(false).build();
8+
Vault::Config config =
9+
Vault::ConfigBuilder().withDebug(false).withTlsEnabled(false).build();
910
Vault::HttpErrorCallback httpErrorCallback = [&](std::string err) {
1011
std::cout << err << std::endl;
1112
};
1213
Vault::ResponseErrorCallback responseCallback = [&](Vault::HttpResponse err) {
13-
std::cout << err.statusCode << " : " << err.url.value() << " : " << err.body.value() << std::endl;
14+
std::cout << err.statusCode << " : " << err.url.value() << " : "
15+
<< err.body.value() << std::endl;
1416
};
15-
return Vault::Client{config, tokenStrategy, httpErrorCallback, responseCallback};
17+
return Vault::Client{config, tokenStrategy, httpErrorCallback,
18+
responseCallback};
1619
}
1720

18-
Vault::Client getAppRoleClient(const Vault::RoleId &roleId, const Vault::SecretId &secretId) {
19-
Vault::AppRoleStrategy authStrategy{roleId, secretId};
21+
inline Vault::Client getAppRoleClient(const Vault::RoleId &roleId,
22+
const Vault::SecretId &secretId,
23+
const Vault::Path &mount) {
24+
Vault::AppRoleStrategy authStrategy{roleId, secretId, mount};
2025
Vault::Config config = Vault::ConfigBuilder().withTlsEnabled(false).build();
2126

2227
return Vault::Client{config, authStrategy};
2328
}
2429

25-
Vault::Client getJwtClient(const Vault::RoleId &role, const Vault::Jwt &jwt) {
30+
inline Vault::Client getJwtClient(const Vault::RoleId &role,
31+
const Vault::Jwt &jwt) {
2632
Vault::JwtStrategy authStrategy{role, jwt};
27-
Vault::Config config = Vault::ConfigBuilder().withDebug(false).withTlsEnabled(false).build();
33+
Vault::Config config =
34+
Vault::ConfigBuilder().withDebug(false).withTlsEnabled(false).build();
2835
Vault::HttpErrorCallback httpErrorCallback = [&](std::string err) {
2936
std::cout << err << std::endl;
3037
};
3138
Vault::ResponseErrorCallback responseCallback = [&](Vault::HttpResponse err) {
32-
std::cout << err.statusCode << " : " << err.url.value() << " : " << err.body.value() << std::endl;
39+
std::cout << err.statusCode << " : " << err.url.value() << " : "
40+
<< err.body.value() << std::endl;
3341
};
3442

35-
return Vault::Client{config, authStrategy, httpErrorCallback, responseCallback};
43+
return Vault::Client{config, authStrategy, httpErrorCallback,
44+
responseCallback};
3645
}
3746

38-
std::optional<std::string> createPolicy(const Vault::Sys::Policy &policyAdmin) {
39-
Vault::Parameters parameters{{
40-
"policy", "path \"secret/*\" {capabilities = [\"read\", \"update\", \"list\", \"delete\", \"create\"]}"
41-
}};
47+
inline std::optional<std::string>
48+
createPolicy(const Vault::Sys::Policy &policyAdmin) {
49+
Vault::Parameters parameters{
50+
{"policy", "path \"secret/*\" {capabilities = [\"read\", \"update\", "
51+
"\"list\", \"delete\", \"create\"]}"}};
4252
return policyAdmin.create(Vault::Path{"example"}, parameters);
4353
}
4454

45-
std::optional<std::string> deletePolicy(const Vault::Sys::Policy &policyAdmin) {
55+
inline std::optional<std::string>
56+
deletePolicy(const Vault::Sys::Policy &policyAdmin) {
4657
return policyAdmin.del(Vault::Path{"example"});
4758
}
4859

49-
std::optional<std::string> enableAppRole(const Vault::Sys::Auth &authAdmin) {
50-
return authAdmin.enable(Vault::Path{"approle"}, Vault::Parameters{{"type", "approle"}});
60+
inline std::optional<std::string>
61+
enableAppRole(const Vault::Sys::Auth &authAdmin, const Vault::Path &mount) {
62+
return authAdmin.enable(mount, Vault::Parameters{{"type", "approle"}});
5163
}
5264

53-
std::optional<std::string> disableAppRole(const Vault::Sys::Auth &authAdmin) {
54-
return authAdmin.disable(Vault::Path{"approle"});
65+
inline std::optional<std::string>
66+
disableAppRole(const Vault::Sys::Auth &authAdmin, const Vault::Path &mount) {
67+
return authAdmin.disable(mount);
5568
}
5669

57-
std::optional<std::string> createRole(const Vault::AppRole &appRoleAdmin) {
70+
inline std::optional<std::string>
71+
createRole(const Vault::AppRole &appRoleAdmin) {
5872
Vault::Parameters parameters{{"token_policies", "example"}};
5973
return appRoleAdmin.create(Vault::Path{"example"}, parameters);
6074
}
6175

62-
std::optional<std::string> createRole(const Vault::JwtOidc &jwtAdmin) {
63-
Vault::Parameters parameters{
64-
{"role_type", "jwt"},
65-
{"user_claim", "example"},
66-
{"bound_audiences", "example"},
67-
{"policies", "example"}
68-
};
76+
inline std::optional<std::string> createRole(const Vault::JwtOidc &jwtAdmin) {
77+
Vault::Parameters parameters{{"role_type", "jwt"},
78+
{"user_claim", "example"},
79+
{"bound_audiences", "example"},
80+
{"policies", "example"}};
6981

7082
return jwtAdmin.createRole(Vault::Path{"example"}, parameters);
7183
}
7284

73-
std::optional<std::string> deleteRole(const Vault::AppRole &appRoleAdmin) {
85+
inline std::optional<std::string>
86+
deleteRole(const Vault::AppRole &appRoleAdmin) {
7487
return appRoleAdmin.del(Vault::Path{"example"});
7588
}
7689

77-
std::optional<std::string> deleteRole(const Vault::JwtOidc &jwtAdmin) {
90+
inline std::optional<std::string> deleteRole(const Vault::JwtOidc &jwtAdmin) {
7891
return jwtAdmin.deleteRole(Vault::Path{"example"});
7992
}
8093

81-
Vault::RoleId getRoleId(const Vault::AppRole &appRoleAdmin) {
94+
inline Vault::RoleId getRoleId(const Vault::AppRole &appRoleAdmin) {
8295
auto response = appRoleAdmin.getRoleId(Vault::Path{"example"});
8396
if (response) {
84-
return Vault::RoleId{nlohmann::json::parse(response.value())["data"]["role_id"]};
97+
return Vault::RoleId{
98+
nlohmann::json::parse(response.value())["data"]["role_id"]};
8599
} else {
86100
std::cout << "Could not get role id" << std::endl;
87101
exit(-1);
88102
}
89103
}
90104

91-
Vault::SecretId getSecretId(const Vault::AppRole &appRoleAdmin) {
92-
auto response = appRoleAdmin.generateSecretId(Vault::Path{"example"}, Vault::Parameters{});
105+
inline Vault::SecretId getSecretId(const Vault::AppRole &appRoleAdmin) {
106+
auto response = appRoleAdmin.generateSecretId(Vault::Path{"example"},
107+
Vault::Parameters{});
93108
if (response) {
94-
return Vault::SecretId{nlohmann::json::parse(response.value())["data"]["secret_id"]};
109+
return Vault::SecretId{
110+
nlohmann::json::parse(response.value())["data"]["secret_id"]};
95111
} else {
96112
std::cout << "Could not get role id" << std::endl;
97113
exit(-1);
98114
}
99115
}
100116

101-
std::optional<std::string> enableKeyValue(const Vault::Sys::Mounts &mountAdmin) {
102-
return mountAdmin.enable(Vault::Path{}, Vault::Parameters{}, Vault::Parameters{}, Vault::Parameters{});
117+
inline std::optional<std::string>
118+
enableKeyValue(const Vault::Sys::Mounts &mountAdmin) {
119+
return mountAdmin.enable(Vault::Path{}, Vault::Parameters{},
120+
Vault::Parameters{}, Vault::Parameters{});
103121
}
104122

105-
std::optional<std::string> disableKeyValue(const Vault::Sys::Mounts &mountAdmin) {
123+
inline std::optional<std::string>
124+
disableKeyValue(const Vault::Sys::Mounts &mountAdmin) {
106125
return mountAdmin.disable(Vault::Path{});
107126
}
108127

109-
std::optional<std::string> enableJwtAuthentication(const Vault::Sys::Auth &authAdmin) {
110-
return authAdmin.enable(Vault::Path{"jwt"}, Vault::Parameters{{"type", "jwt"}});
128+
inline std::optional<std::string>
129+
enableJwtAuthentication(const Vault::Sys::Auth &authAdmin) {
130+
return authAdmin.enable(Vault::Path{"jwt"},
131+
Vault::Parameters{{"type", "jwt"}});
111132
}
112133

113-
std::optional<std::string> disableJwtAuthentication(const Vault::Sys::Auth &authAdmin) {
134+
inline std::optional<std::string>
135+
disableJwtAuthentication(const Vault::Sys::Auth &authAdmin) {
114136
return authAdmin.disable(Vault::Path{"jwt"});
115137
}
116138

117-
std::optional<std::string> configureJwtAuthentication(const Vault::JwtOidc &jwtAdmin, std::string publicKeyString) {
139+
inline std::optional<std::string>
140+
configureJwtAuthentication(const Vault::JwtOidc &jwtAdmin,
141+
std::string publicKeyString) {
118142
Vault::Parameters parameters{{"jwt_validation_pubkeys", publicKeyString}};
119143
return jwtAdmin.configure(parameters);
120-
}
144+
}

‎include/VaultClient.h‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -413,16 +413,22 @@ class TokenStrategy : public AuthenticationStrategy {
413413

414414
class AppRoleStrategy : public AuthenticationStrategy {
415415
public:
416-
AppRoleStrategy(RoleId roleId, SecretId secretId);
416+
explicit AppRoleStrategy(RoleId roleId, SecretId secretId)
417+
: roleId_(std::move(roleId)), secretId_(std::move(secretId)),
418+
mount_(Path{"approle"}) {}
419+
explicit AppRoleStrategy(RoleId roleId, SecretId secretId, Path mount)
420+
: roleId_(std::move(roleId)), secretId_(std::move(secretId)),
421+
mount_(std::move(mount)) {}
417422

418423
std::optional<AuthenticationResponse>
419424
authenticate(const Client &client) override;
420425

421426
private:
422-
static Url getUrl(const Client &vaultClient, const Path &path);
427+
Url getUrl(const Client &vaultClient, const Path &path);
423428

424429
RoleId roleId_;
425430
SecretId secretId_;
431+
Path mount_;
426432
};
427433

428434
class WrappedSecretAppRoleStrategy : public AuthenticationStrategy {
@@ -600,7 +606,10 @@ class Transit {
600606

601607
class AppRole {
602608
public:
603-
explicit AppRole(const Client &client) : client_(client) {}
609+
explicit AppRole(const Client &client)
610+
: client_(client), mount_(Path{"approle"}) {}
611+
explicit AppRole(const Client &client, Path mount)
612+
: client_(client), mount_(std::move(mount)) {}
604613

605614
[[nodiscard]] std::optional<std::string> list() const;
606615
[[nodiscard]] std::optional<std::string>
@@ -642,6 +651,7 @@ class AppRole {
642651
[[nodiscard]] Url getUrl(const Path &path) const;
643652

644653
const Client &client_;
654+
Path mount_;
645655
};
646656

647657
class Sys {

0 commit comments

Comments
 (0)