Skip to content

Fix Vault token auth bug#2110

Merged
amartinezfayo merged 1 commit intospiffe:masterfrom
hiyosi:fix-vault-token-auth
Feb 25, 2021
Merged

Fix Vault token auth bug#2110
amartinezfayo merged 1 commit intospiffe:masterfrom
hiyosi:fix-vault-token-auth

Conversation

@hiyosi
Copy link
Contributor

@hiyosi hiyosi commented Feb 11, 2021

Signed-off-by: Tomoya Usami tousami@zlab.co.jp

Pull Request check list

  • Commit conforms to CONTRIBUTING.md?
  • Proper tests/regressions included?
  • Documentation updated?

Affected functionality

UpstreamAuthority 'vault' plugin

Description of change

The Vault token will be set correctly in the Token Auth Method.

In v0.12.0, we get an error as below even if the token is given via plugin config or environment variable.

level=error msg="Fatal run error" error="rpc error: code = Unknown desc = failed to prepare authenticated client: token lookup failed: Error making API request.\n\nURL: GET http://<vault_addr>/v1/auth/token/lookup-self\nCode: 400. Errors:\n\n* missing client token"

Which issue this PR fixes

No Issues or PRs.
https://spiffe.slack.com/archives/CBNCC2V17/p1613059475073700

Copy link
Member

@amartinezfayo amartinezfayo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you @hiyosi for this fix and the patience for the review!
I have a small comment about the test. Looking great otherwise.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think that in general I prefer to have an err string here as an expected error that can be used to match with the error obtained. Test cases that don't expect errors would have an empty string. Then you can do something like

			if c.err != "" {
				vcs.Require().Equal(err.Error(), c.err)
			} ...

in the assertions to check for the error. I think that allows us to catch some unexpected behavior if the error thrown is different than what we expect.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for review!
Update: 5e0fd1f

@amartinezfayo amartinezfayo self-requested a review February 19, 2021 19:56
@amartinezfayo amartinezfayo self-assigned this Feb 19, 2021
amartinezfayo
amartinezfayo previously approved these changes Feb 22, 2021
Copy link
Member

@amartinezfayo amartinezfayo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you @hiyosi!
Could you please update the branch so we can merge this?

Signed-off-by: Tomoya Usami <tousami@zlab.co.jp>
@hiyosi
Copy link
Contributor Author

hiyosi commented Feb 22, 2021

@amartinezfayo Done rebasing the branch with master branch. Thanks!

@hiyosi hiyosi requested a review from amartinezfayo February 23, 2021 12:12
@amartinezfayo amartinezfayo merged commit 20b244d into spiffe:master Feb 25, 2021
@azdagron azdagron added this to the 0.12.2 milestone Mar 23, 2021
azdagron pushed a commit to azdagron/spire that referenced this pull request Mar 30, 2021
Signed-off-by: Tomoya Usami <tousami@zlab.co.jp>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants