Enable generated items for more auth methods by madalynrose · Pull Request #7513 · hashicorp/vault

madalynrose · 2019-09-25T19:09:11Z

Enable OpenApi for more Auth Methods

This PR enables OpenApi to fully manage the Userpass, Cert, Okta, and Radius auth methods within the UI.

In addition to enabling, disabling and configuring the auth method, this PR includes CRUD actions for:

QA Scenarios

sensitive field comes through in openApiToAttrs (users' passwords, for example)
editType comes through in openApiToAttrs
test creating and editing userpass users
test creating & editing certs certificates
test creating & editing Okta groups
test creating & editing Okta users
test creating & editing Radius users
test creating & editing LDAP groups
test creating & editing LDAP users

kalafut

The Go changes are fine except for a couple minor items and one odd err change that need review.

johncowen

Hey @noelledaley !

I did an initial code only pass here and there seems to be a lot going on! Most of the things I've noted are just style things for the moment at least. I'm thinking of firing vault up and taking a closer look at this a bit later on, will shout you offline.

John

johncowen · 2019-10-09T09:06:47Z

No biggie, but the style:

paths.paths.filter(path => path.navigation)

was used everywhere else. I think here I personally like the more explicit style (this made me double think when I saw the less explicit style up above), but I think the more important point is to maybe change this so the style is all the same, whichever one you prefer.

…users

… no longer have action on list endpoint

…roup

…ow component

…trs util

… setup yet

…lt, change debugger to console.err in path-help, remove dynamic ui auth methods from tab count test

… into ui-generated-items

andaley · 2019-10-16T01:13:39Z

I've updated this PR to address all of the bugs I initially found. I removed the list of bugs and improvements and included them below for posterity. Should be good to go!

Bugfixes

access/userpass3/item/user is listing the users from v1/auth/userpass-1/users/?list=true until I refresh the page. This happens for LDAP groups and users as well. Appears to be a caching issue.
the tooltip on the certificate field when creating a certificate doesn't appear
links to generated items show page are wrong: http://localhost:4200/v1/auth/generated-user-okta/users/test-user 404 (Not Found)
editing an ldap group doesn't work. they are included in the request payload but aren't saved. instead, when you edit an existing group called "my-group", it creates a new group called "my-ldap/my-group". this happens for users as well.
deleting a nested item only works from the list page, not from the show page
handle the case where user names their group mygroup/foo/bar and tries to edit

Improvements

when you click on an auth method, it should link to the list page of the first generated item (the users or group page)
use new confirm component when disabling an auth method

meirish · 2019-10-16T19:16:02Z

When deleting an item from the show page, the flash message is incorrect - it says "undefined" instead of the item id.

meirish · 2019-10-16T19:19:24Z

We might want design to give this a once over, I'm not sure about the delete button in the header and the create button in the toolbar having a > instead of a +. Other than that minor flash message issue, the functionality looks good!

meirish

@noelledaley Mentioned a couple of small things, but the could easily be addressed later, so I'll let you make the call when to merge. 👍

… into ui-generated-items

joshuaogle

Looks great! This is going to be such a nice start for these auth methods

* master: (41 commits) changelog++ cli: fix json output for namespace list command (#7705) Update CHANGELOG.md Vault Agent Template (#7652) hostutil: disable host info collection on openbsd (#7699) Shamir seals now come in two varieties: legacy and new-style. (#7694) Update Title for AWS Marketplace (#7683) Bump go builder version Fix kv mod import and vendoring Fixing a typo with the sample payload (#7688) Update CHANGELOG.md Enable generated items for more auth methods (#7513) Update OIDC provider doc Update OIDC provider doc (#7693) Create .bundle and set group when running container (#7684) updates vendored api/client.go (#7692) Update circle config logical: remove unneeded error check in handleLogicalInternal (#7691) Update Go version Docs: add examples for when a seal rewrap is useful (#7689) ...

andaley · 2020-07-21T17:39:40Z

 		HelpSynopsis:    pathCertHelpSyn,
 		HelpDescription: pathCertHelpDesc,
+		DisplayAttrs: &framework.DisplayAttributes{
+			Action:   "Create",


this is what allows us dynamically generate the form for creating a "nested item" -- i.e., a certificate nested under the cert auth method.

andaley · 2020-07-21T17:42:29Z

 At least one must exist in the SANs. Supports globbing.`,
+				DisplayAttrs: &framework.DisplayAttributes{
+					Name: "Allowed URI SANs",
+					Group: "Constraints",


the Group specifies which field group the field should belong to. for example:

andaley · 2020-07-21T17:44:04Z

 		HelpSynopsis:    pathCertHelpSyn,
 		HelpDescription: pathCertHelpDesc,
+		DisplayAttrs: &framework.DisplayAttributes{
+			Navigation: true,


this boolean describes whether the item should have a tab in the navigation:

andaley · 2020-07-21T17:47:37Z

+
+	// EditType is the type of form field needed for a property
+	// e.g. "textarea" or "file"
+	EditType string `json:"editType,omitempty"`


these are all of the available keys for the DisplayAttributes map, which tells the UI how to display the "thing" (i.e. certificate) or specific form field. see the full list here:

https://github.com/hashicorp/vault/blob/master/sdk/framework/path.go#L169-L196

andaley · 2020-07-21T21:13:44Z

        }
-        helpUrl = `/v1/${apiPath}${path.slice(1)}?help=true`;
+
+        helpUrl = `/v1/${apiPath}${path.slice(1)}?help=true` || newModel.proto().getHelpUrl(backend);


this is how we construct the URL for making the request to OpenAPI. if the ?help-true suffix ever changes for some reason you'll need to update it here.

andaley mentioned this pull request Sep 27, 2019

add display attributes necessary to create kubernetes roles in the ui hashicorp/vault-plugin-auth-kubernetes#71

Merged

andaley added this to the 1.3 milestone Oct 3, 2019

andaley added the ui label Oct 8, 2019

andaley requested review from a team October 8, 2019 23:07

kalafut self-assigned this Oct 8, 2019

kalafut reviewed Oct 8, 2019

View reviewed changes

Comment thread builtin/credential/userpass/path_users.go Outdated

kalafut reviewed Oct 8, 2019

View reviewed changes

Comment thread sdk/framework/path.go Outdated

kalafut reviewed Oct 8, 2019

View reviewed changes

Comment thread sdk/framework/path.go Outdated

kalafut suggested changes Oct 9, 2019

View reviewed changes

johncowen reviewed Oct 9, 2019

View reviewed changes

Madalyn Parker and others added 19 commits October 9, 2019 16:58

enable auth method item configuration in go code

3b362cf

properly parse and list generated items

c1674de

make sure we only set name on attrs if a label comes from openAPI

a018669

correctly construct paths object for method index route

ff30535

set sensitive property on password for userpass

f6c5d83

remove debugger statements

af7639e

pass method model to list route template to use paths on model for tabs

6fbc18b

update tab generation in generated item list, undo enabling userpass …

69be01c

…users

enable openapi generated itams for certs and userpass, update ldap to…

5078fd8

… no longer have action on list endpoint

add editType to DisplayAttributes, pull tokenutil fields into field g…

200210e

…roup

show sensitive message for sensitive fields displayed in fieldGroupSh…

9e503d0

…ow component

grab sensitive and editType fields from displayAttrs in openapi-to-at…

b80d10e

…trs util

make sure we don't ask for paths for secret backends since that isn't…

54f8568

… setup yet

fix styling of sensitive text for fieldGroupShow component

bbc4824

update openapi-to-attrs util test to no longer include label by defau…

f7caf20

…lt, change debugger to console.err in path-help, remove dynamic ui auth methods from tab count test

properly log errors to the console

c8dbec2

capitalize This value is sensitive...

b1803ed

get rid of extra padding on bottom of fieldgroupshow

1666872

make auth methods clickable and use new confirm ux

3e468e4

andaley and others added 6 commits October 15, 2019 16:01

ensure list pages have page headers

8aee523

Merge branch 'ui-generated-items' of https://github.com/hashicorp/vault…

3a5b559

… into ui-generated-items

standardize using authMethodPath instead of method and remove dead code

8df98e6

i love indentation

8dc6c98

remove more dead code

7374206

Merge branch 'master' into ui-generated-items

84ddaab

Merge branch 'master' into ui-generated-items

75c461e

meirish reviewed Oct 16, 2019

View reviewed changes

Comment thread ui/app/components/generated-item.js Outdated

meirish reviewed Oct 16, 2019

View reviewed changes

Comment thread ui/app/templates/components/generated-item-list.hbs Outdated

meirish previously approved these changes Oct 16, 2019

View reviewed changes

andaley added 2 commits October 16, 2019 16:02

use new Confirm

47b44b9

Merge branch 'ui-generated-items' of https://github.com/hashicorp/vault…

31bcd09

… into ui-generated-items

andaley dismissed meirish’s stale review via 31bcd09 October 16, 2019 23:03

andaley and others added 4 commits October 16, 2019 16:05

show correct flash message when deleting an item

a25301c

update flash message for creating and updating

5797336

use plus icon for creating group/user instead of an arrow

34db27d

Merge branch 'master' into ui-generated-items

d3f797b

joshuaogle self-requested a review October 17, 2019 21:29

joshuaogle approved these changes Oct 17, 2019

View reviewed changes

andaley merged commit 8f4530b into master Oct 17, 2019

andaley deleted the ui-generated-items branch October 17, 2019 23:19

andaley reviewed Jul 21, 2020

View reviewed changes

Conversation

madalynrose commented Sep 25, 2019 • edited by andaley Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Enable OpenApi for more Auth Methods

QA Scenarios

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kalafut left a comment

Choose a reason for hiding this comment

Uh oh!

johncowen left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

johncowen Oct 9, 2019

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

andaley commented Oct 16, 2019

Bugfixes

Improvements

Uh oh!

meirish commented Oct 16, 2019

Uh oh!

meirish commented Oct 16, 2019

Uh oh!

Uh oh!

Uh oh!

meirish left a comment

Choose a reason for hiding this comment

Uh oh!

joshuaogle left a comment

Choose a reason for hiding this comment

Uh oh!

andaley Jul 21, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

andaley Jul 21, 2020

Choose a reason for hiding this comment

Uh oh!

andaley Jul 21, 2020

Choose a reason for hiding this comment

Uh oh!

andaley Jul 21, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

andaley Jul 21, 2020

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

madalynrose commented Sep 25, 2019 •

edited by andaley

Loading

andaley Jul 21, 2020 •

edited

Loading

andaley Jul 21, 2020 •

edited

Loading