LDAP/AD Secrets Engine

ui/app/adapters/kubernetes/config.js

@@ -3,41 +3,12 @@
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import ApplicationAdapter from 'vault/adapters/application';
-import { encodePath } from 'vault/utils/path-encoding-helpers';
+import SecretsEnginePathAdapter from 'vault/adapters/secrets-engine-path';
 
-export default class KubernetesConfigAdapter extends ApplicationAdapter {
-  namespace = 'v1';
+export default class KubernetesConfigAdapter extends SecretsEnginePathAdapter {
+  path = 'config';
 
-  getURL(backend, path = 'config') {
-    return `${this.buildURL()}/${encodePath(backend)}/${path}`;
-  }
-  urlForUpdateRecord(name, modelName, snapshot) {
-    return this.getURL(snapshot.attr('backend'));
-  }
-  urlForDeleteRecord(backend) {
-    return this.getURL(backend);
-  }
-
-  queryRecord(store, type, query) {
-    const { backend } = query;
-    return this.ajax(this.getURL(backend), 'GET').then((resp) => {
-      resp.backend = backend;
-      return resp;
-    });
-  }
-  createRecord() {
-    return this._saveRecord(...arguments);
-  }
-  updateRecord() {
-    return this._saveRecord(...arguments);
-  }
-  _saveRecord(store, { modelName }, snapshot) {
-    const data = store.serializerFor(modelName).serialize(snapshot);
-    const url = this.getURL(snapshot.attr('backend'));
-    return this.ajax(url, 'POST', { data }).then(() => data);
-  }
   checkConfigVars(backend) {
-    return this.ajax(`${this.getURL(backend, 'check')}`, 'GET');
+    return this.ajax(`${this._getURL(backend, 'check')}`, 'GET');
   }
 }

ui/app/adapters/ldap/config.js

@@ -0,0 +1,14 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import SecretsEnginePathAdapter from 'vault/adapters/secrets-engine-path';
+
+export default class LdapConfigAdapter extends SecretsEnginePathAdapter {
+  path = 'config';
+
+  async rotateRoot(backend) {
+    return this.ajax(this._getURL(backend, 'rotate-root'), 'POST');
+  }
+}

ui/app/adapters/ldap/library.js

@@ -0,0 +1,67 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import NamedPathAdapter from 'vault/adapters/named-path';
+import { encodePath } from 'vault/utils/path-encoding-helpers';
+
+export default class LdapLibraryAdapter extends NamedPathAdapter {
+  getURL(backend, name) {
+    const base = `${this.buildURL()}/${encodePath(backend)}/library`;
+    return name ? `${base}/${name}` : base;
+  }
+
+  urlForUpdateRecord(name, modelName, snapshot) {
+    return this.getURL(snapshot.attr('backend'), name);
+  }
+  urlForDeleteRecord(name, modelName, snapshot) {
+    return this.getURL(snapshot.attr('backend'), name);
+  }
+
+  query(store, type, query) {
+    const { backend } = query;
+    return this.ajax(this.getURL(backend), 'GET', { data: { list: true } })
+      .then((resp) => {
+        return resp.data.keys.map((name) => ({ name, backend }));
+      })
+      .catch((error) => {
+        if (error.httpStatus === 404) {
+          return [];
+        }
+        throw error;
+      });
+  }
+  queryRecord(store, type, query) {
+    const { backend, name } = query;
+    return this.ajax(this.getURL(backend, name), 'GET').then((resp) => ({ ...resp.data, backend, name }));
+  }
+
+  fetchStatus(backend, name) {
+    const url = `${this.getURL(backend, name)}/status`;
+    return this.ajax(url, 'GET').then((resp) => {
+      const statuses = [];
+      for (const key in resp.data) {
+        const status = {
+          ...resp.data[key],
+          account: key,
+          library: name,
+        };
+        statuses.push(status);
+      }
+      return statuses;
+    });
+  }
+  checkOutAccount(backend, name, ttl) {
+    const url = `${this.getURL(backend, name)}/check-out`;
+    return this.ajax(url, 'POST', { data: { ttl } }).then((resp) => {
+      const { lease_id, lease_duration, renewable } = resp;
+      const { service_account_name: account, password } = resp.data;
+      return { account, password, lease_id, lease_duration, renewable };
+    });
+  }
+  checkInAccount(backend, name, service_account_names) {
+    const url = `${this.getURL(backend, name)}/check-in`;
+    return this.ajax(url, 'POST', { data: { service_account_names } }).then((resp) => resp.data);
+  }
+}

ui/app/adapters/ldap/role.js

@@ -0,0 +1,92 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import NamedPathAdapter from 'vault/adapters/named-path';
+import { encodePath } from 'vault/utils/path-encoding-helpers';
+import { inject as service } from '@ember/service';
+
+export default class LdapRoleAdapter extends NamedPathAdapter {
+  @service flashMessages;
+
+  getURL(backend, path, name) {
+    const base = `${this.buildURL()}/${encodePath(backend)}/${path}`;
+    return name ? `${base}/${name}` : base;
+  }
+  pathForRoleType(type, isCred) {
+    const staticPath = isCred ? 'static-cred' : 'static-role';
+    const dynamicPath = isCred ? 'creds' : 'role';
+    return type === 'static' ? staticPath : dynamicPath;
+  }
+
+  urlForUpdateRecord(name, modelName, snapshot) {
+    const { backend, type } = snapshot.record;
+    return this.getURL(backend, this.pathForRoleType(type), name);
+  }
+  urlForDeleteRecord(name, modelName, snapshot) {
+    const { backend, type } = snapshot.record;
+    return this.getURL(backend, this.pathForRoleType(type), name);
+  }
+
+  async query(store, type, query, recordArray, options) {
+    const { showPartialError } = options.adapterOptions || {};
+    const { backend } = query;
+    const roles = [];
+    const errors = [];
+
+    for (const roleType of ['static', 'dynamic']) {
+      const url = this.getURL(backend, this.pathForRoleType(roleType));
+      try {
+        const models = await this.ajax(url, 'GET', { data: { list: true } }).then((resp) => {
+          return resp.data.keys.map((name) => ({ name, backend, type: roleType }));
+        });
+        roles.addObjects(models);
+      } catch (error) {
+        if (error.httpStatus !== 404) {
+          errors.push(error);
+        }
+      }
+    }
+
+    if (errors.length) {
+      const errorMessages = errors.reduce((errors, e) => {
+        e.errors.forEach((error) => {
+          errors.push(`${e.path}: ${error}`);
+        });
+        return errors;
+      }, []);
+      if (errors.length === 2) {
+        // throw error as normal if both requests fail
+        // ignore status code and concat errors to be displayed in Page::Error component with generic message
+        throw { message: 'Error fetching roles:', errors: errorMessages };
+      } else if (showPartialError) {
+        // if only one request fails, surface the error to the user an info level flash message
+        // this may help for permissions errors where a users policy may be incorrect
+        this.flashMessages.info(`Error fetching roles from ${errorMessages.join(', ')}`);
+      }
+    }
+
+    return roles.sortBy('name');
+  }
+  queryRecord(store, type, query) {
+    const { backend, name, type: roleType } = query;
+    const url = this.getURL(backend, this.pathForRoleType(roleType), name);
+    return this.ajax(url, 'GET').then((resp) => ({ ...resp.data, backend, name, type: roleType }));
+  }
+
+  fetchCredentials(backend, type, name) {
+    const url = this.getURL(backend, this.pathForRoleType(type, true), name);
+    return this.ajax(url, 'GET').then((resp) => {
+      if (type === 'dynamic') {
+        const { lease_id, lease_duration, renewable } = resp;
+        return { ...resp.data, lease_id, lease_duration, renewable, type };
+      }
+      return { ...resp.data, type };
+    });
+  }
+  rotateStaticPassword(backend, name) {
+    const url = this.getURL(backend, 'rotate-role', name);
+    return this.ajax(url, 'POST');
+  }
+}

ui/app/adapters/secrets-engine-path.js

@@ -0,0 +1,48 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+/**
+ * General use adapter to access specified paths on secrets engines
+ * For example /:backend/config is a typical use case for this adapter
+ * These types of records do not have an id and use the backend value of the secrets engine as the primaryKey in the serializer
+ */
+
+import ApplicationAdapter from 'vault/adapters/application';
+import { encodePath } from 'vault/utils/path-encoding-helpers';
+
+export default class SecretsEnginePathAdapter extends ApplicationAdapter {
+  namespace = 'v1';
+
+  // define path value in extending class or pass into method directly
+  _getURL(backend, path) {
+    return `${this.buildURL()}/${encodePath(backend)}/${path || this.path}`;
+  }
+  urlForUpdateRecord(name, modelName, snapshot) {
+    return this._getURL(snapshot.attr('backend'));
+  }
+  // primaryKey must be set to backend in serializer
+  urlForDeleteRecord(backend) {
+    return this._getURL(backend);
+  }
+
+  queryRecord(store, type, query) {
+    const { backend } = query;
+    return this.ajax(this._getURL(backend), 'GET').then((resp) => {
+      resp.backend = backend;
+      return resp;
+    });
+  }
+  createRecord() {
+    return this._saveRecord(...arguments);
+  }
+  updateRecord() {
+    return this._saveRecord(...arguments);
+  }
+  _saveRecord(store, { modelName }, snapshot) {
+    const data = store.serializerFor(modelName).serialize(snapshot);
+    const url = this._getURL(snapshot.attr('backend'));
+    return this.ajax(url, 'POST', { data }).then(() => data);
+  }
+}

ui/app/app.js

@@ -52,6 +52,14 @@ export default class App extends Application {
         },
       },
     },
+    ldap: {
+      dependencies: {
+        services: ['router', 'store', 'secret-mount-path', 'flash-messages', 'auth'],
+        externalRoutes: {
+          secrets: 'vault.cluster.secrets.backends',
+        },
+      },
+    },
     pki: {
       dependencies: {
         services: [

ui/app/helpers/mountable-secret-engines.js

@@ -30,11 +30,6 @@ const ENTERPRISE_SECRET_ENGINES = [
 ];
 
 const MOUNTABLE_SECRET_ENGINES = [
-  {
-    displayName: 'Active Directory',
-    type: 'ad',
-    category: 'cloud',
-  },
   {
     displayName: 'AliCloud',
     type: 'alicloud',
@@ -110,9 +105,15 @@ const MOUNTABLE_SECRET_ENGINES = [
     type: 'totp',
     category: 'generic',
   },
+  {
+    displayName: 'LDAP',
+    type: 'ldap',
+    engineRoute: 'ldap.overview',
+    category: 'generic',
+    glyph: 'folder-users',
+  },
   {
     displayName: 'Kubernetes',
-    value: 'kubernetes',
     type: 'kubernetes',
     engineRoute: 'kubernetes.overview',
     category: 'generic',

ui/app/helpers/supported-secret-backends.js

@@ -18,6 +18,7 @@ const SUPPORTED_SECRET_BACKENDS = [
   'transform',
   'keymgmt',
   'kubernetes',
+  'ldap',
 ];
 
 export function supportedSecretBackends() {