UI: allow navigation to subdirectory #22436

hellobontempo · 2023-08-17T23:33:09Z

This partially fixes the request here #5362 so users can LIST at the secret level in the UI.

Fixes #20563 and #13188 and #20563

The user in the gif has the following policy where they can only LIST at the my-secret/ level. Previously a user had to know the full secret path to view this list of secrets, now they just need the top-level secret path:

path "my-kv/metadata/my-secret/*" { capabilities = ["list", "read"] }
path "my-kv/data/my-secret/*" { capabilities = ["list", "read"] }

If a user can only list metadata at the top level, so with a policy that looks something like:

path "my-kv/data/*" {
  capabilities = ["read", "list", "delete"]
}
path "my-kv/metadata" {
  capabilities = ["list"]
}

The input in the card pre-fills with the path selected from the list view

hellobontempo · 2023-08-17T23:41:10Z

ui/lib/kv/addon/components/page/secret/details.hbs

@@ -49,7 +49,7 @@
  </:toolbarActions>
 </KvPageHeader>

-{{#if (not-eq @secret.state "destroyed")}}
+{{#if (and (not this.emptyState) (not-eq @secret.state "destroyed"))}}


small styling fix I noticed

github-actions · 2023-08-17T23:51:15Z

Build Results:
All builds succeeded! ✅

Monkeychip

Big improvement with a little code. Nice work!

ui/lib/kv/addon/components/page/list.js

* Use Hashicorp docker proxy for CI docker images * Use library/consul as the mirror path instead of hashicorp/consul - Looks like the older 1.4.4 image was not published within the hashicorp/consul space, only newer images are. - Switch to library/consul which seems to have both versions

- The Golang ACME library will retry on failures until the passed in context times out. So if a test is broken it will never end until the context expires. - The timeouts are rather large to avoid some issues with slow CI runners, that have already triggered on a nightly 32 bit run

…ix (#22177)

Signed-off-by: Alexander Scheel <[email protected]>

…21453)

* Add 502 to Vault uninitialized * Update index.mdx * Update index.mdx --------- Co-authored-by: Violet Hynes <[email protected]>

- Allow us to call and apply an issuer's leaf_not_after_behavior to a leaf certificate from various locations.

Fix article usage Co-authored-by: Violet Hynes <[email protected]>

* options => opts * Standardise receiver letter, specify interface

…ne (#22266) * add sink wrapper to take telemetry measures * make use of sinkwrapper

* Refactor sign-intermediate API response - Allow the sign-intermediate response handling code to be shared across different API calls. * Add missing cieps.go

…d Proxy) (#22264) * VAULT-14644 first draft of changes for WIF support * VAULT-14644 Potentially finalize Agent work for WIF support * VAULT-14644 finishing touches * VAULT-14644 finishing touches * VAULT-14644 remove extra log * VAULT-14644 better docs * VAULT-14644 changelog * VAULT-14644 review feedback

Update includes dependency upgrades and WIF support --------- Co-authored-by: hc-github-team-secure-vault-ecosystem <[email protected]>

* Add ADP requirement callout Add a callout to the top of the page to note that this feature requires Vault ENT + ADP * rephrase * Update website/content/docs/enterprise/pkcs11-provider/index.mdx --------- Co-authored-by: Violet Hynes <[email protected]>=

* Major overhaul of `vault operator generate-root` CLI help Resolves #15252 A major overhaul of the `vault operator generate-root` CLI help to surface the fact that it is actually six separate commands in one, rather than requiring users to independently deduce this mental model themselves. In the process of doing so, also standardize some terminology: * Fix places which used the phrase "operational token" instead of "operation token" to be consistent with the prevailing terminology. * Fix places which used the phrase "recovery operation token" instead of "recovery token" to be consistent with the prevailing terminology. This PR currently focusses on the CLI help, but following review and feedback, I assume I'll need to replicate many of the same changes in website/content/docs/commands/operator/generate-root.mdx as well. * Fix some tab characters which should have been spaces * Update command/operator_generate_root.go --------- Co-authored-by: Violet Hynes <[email protected]>

@DaTa

#22160) * replaced each instance of MaskedInput in PKI with CertificateCard * modify tests for pki-generate-csr * add test for pki-issuer-details. modify test for pki-certificate-details * added test for pki-key-details. modified test for pki-sign-intermediate-form * update 2 test helper files and modify test for pki-issuer-rotate-root * update test for certificate-card-test.js, update test for the kubernetes configuration-test.js * modify pki-action-forms-test.js to no longer look for masked input. expand test for pki-issuer-details-test.js to check for all issuer details * change CertificateCard to show different format types (PEM, DER, nothing) depending on the value provided. update 2 test files to account for this. * change CertificateCard arg name from @certficateValue to @DaTa to be more inclusive of different uses of CertificateCard (i.e when used for a private key, not a certificate). add description to certificate-card.js * change naming for attr.options.masked to attr.options.displayCard to reflect the change from MaskedInput to CertificateCard * add changelog * change attribute to isCertificate to better fit the title of the component CertificateCard. edit pki-certificate-details.hbs to get rid of extraneous code

* fluent generation of client count testing data input * godocs * add VerifyInput and complete testing * pr fixes * pr fixes * buf lint

…#21132) * add entry and intent log * test for intent logs

Co-authored-by: Violet Hynes <[email protected]>

* documenting missing option * added comment about setting to zero

- Remove the omitempty flag from issuer_ref, and add it to the warnings and error fields

* Add kv engine to tsconfig paths * Add kv-breadcrumb util to kv engine * remove lib/kv-breadcrumbs and use kv-engine util instead * Fix tests

hellobontempo · 2023-08-18T20:55:10Z

rebase bonk up, closing in favor of #22455

schavis

Will finish reviewing the other content updates on Monday

schavis · 2023-08-18T20:53:49Z

website/content/api-docs/auth/ldap.mdx

+- `password` `(string: <required>)` – The password for the LDAP user.
+When authenticating with the Vault CLI, i.e. `vault login -method=ldap username=mitchellh`


Suggested change

- `password` `(string: <required>)` – The password for the LDAP user.

When authenticating with the Vault CLI, i.e. `vault login -method=ldap username=mitchellh`

- `password` `(string: <required>)` – Password for the LDAP user authenticating with the Vault CLI.

schavis · 2023-08-18T21:04:29Z

website/content/api-docs/secret/pki.mdx

+When a role is not explicitly specified, behavior is specified by the
+`default_directory_policy` in the [ACME configuration](#set-acme-configuration).
+These directories can also be forbidden by setting that policy as `forbid`.  If
+the policy is `sign-verbatim` then _any_ identifier for which the client can
+prove ownership of will be issued for.  This is similar to using the
+[Sign Verbatim](#sign-verbatim) endpoint, but with additional verification
+that the client has proven ownership (within the ACME protocol) of the
+requested certificate identifiers. When `external-policy` is specified as the
+default value, the CIEPS engine <EnterpriseAlert inline="true" /> is used for
+validating and templating the certificate instead of a role; ACME's challenge
+validation is still enforced. An optional policy name can be specified by using
+`external-policy:policy`. Roles are not used when CIEPS is used.


Suggested change

When a role is not explicitly specified, behavior is specified by the

`default_directory_policy` in the [ACME configuration](#set-acme-configuration).

These directories can also be forbidden by setting that policy as `forbid`. If

the policy is `sign-verbatim` then _any_ identifier for which the client can

prove ownership of will be issued for. This is similar to using the

[Sign Verbatim](#sign-verbatim) endpoint, but with additional verification

that the client has proven ownership (within the ACME protocol) of the

requested certificate identifiers. When `external-policy` is specified as the

default value, the CIEPS engine <EnterpriseAlert inline="true" /> is used for

validating and templating the certificate instead of a role; ACME's challenge

validation is still enforced. An optional policy name can be specified by using

`external-policy:policy`. Roles are not used when CIEPS is used.

When a role is not explicitly specified, Vault uses the default policy set by

`default_directory_policy` in the [ACME configuration](#set-acme-configuration):

- `forbid`: denies access to the directory

- `sign-verbatim`: allows access to clients that provide *any* identifier

they can prove ownership for. `sign-verbatim` behaves like the

[Sign Verbatim](#sign-verbatim) endpoint but with the additional verification

that the client can prove ownership within the ACME protocol of the requested

certificate identifiers.

- `external-policy`: <EnterpriseAlert inline="true" /> uses the CIEPS engine to

validate and template the certificate instead of a role with ACME challenge

validation. You can specify an optional policy name with `external-policy:policy`.

Roles are not used when CIEPS is used.

Style correction: write in active voice, make options scannable

schavis · 2023-08-18T21:12:42Z

website/content/api-docs/secret/pki.mdx

+Similar to the [generate certificate and key](#generate-certificate-and-key)
+endpoint, this endpoint generate key material and certificate via an external
+policy engine. The private key material stays local to Vault, with the external
+service getting only an empty CSR. Any parameters passed to this endpoint are
+passed verbatim to the CIEPS engine <EnterpriseAlert inline="true" />. The
+response format is the same between both endpoints.


Suggested change

Similar to the [generate certificate and key](#generate-certificate-and-key)

endpoint, this endpoint generate key material and certificate via an external

policy engine. The private key material stays local to Vault, with the external

service getting only an empty CSR. Any parameters passed to this endpoint are

passed verbatim to the CIEPS engine <EnterpriseAlert inline="true" />. The

response format is the same between both endpoints.

Similar to the [generate certificate and key](#generate-certificate-and-key)

endpoint, this endpoint generate key material and certificate via an external

policy engine. The private key material stays local to Vault, with the external

service getting only an empty CSR. Any parameters passed to this endpoint are

passed verbatim to the CIEPS engine <EnterpriseAlert inline="true" />. The

response format is the same between both endpoints.

``````suggestion

Similar to the [generate certificate and key](#generate-certificate-and-key)

endpoint, the external policy endpoint generates key material and certificate

through an external policy engine. The private key material stays local to

Vault and the external service receives an empty CSR. All parameters passed

to the endpoint are passed, verbatim, to the CIEPS engine <EnterpriseAlert inline="true" />.

The response format is the same between both endpoints.

Style correction: simplify language, write in active voice

schavis · 2023-08-18T21:13:30Z

website/content/api-docs/secret/pki.mdx

+It is suggested to limit access to the path-overridden issue endpoint (on
+`/pki/issuer/:issuer_ref/external-policy/issue/:policy`) and let the CIEPS
+engine override the issuer as necessary.


Suggested change

It is suggested to limit access to the path-overridden issue endpoint (on

`/pki/issuer/:issuer_ref/external-policy/issue/:policy`) and let the CIEPS

engine override the issuer as necessary.

We recommend you limit access to the path-overridden issue endpoint (on

`/pki/issuer/:issuer_ref/external-policy/issue/:policy`) and let the CIEPS

engine override the issuer as necessary.

Style correction: active voice

hellobontempo · 2023-08-18T21:43:33Z

Will finish reviewing the other content updates on Monday

Hi @schavis - sorry you got pinged on this! This was the result of rebase chaos and those commits aren't actually part of my PR. I attempted closing this PR before anyone could start reviewing - but you were too quick! 🙈

hellobontempo added 2 commits August 17, 2023 16:26

small empty state styling fix

bf9ec08

navigate to list or directory

3927433

hellobontempo added the ui label Aug 17, 2023

hellobontempo added this to the 1.15 milestone Aug 17, 2023

github-actions bot added the hashicorp-contributed-pr If the PR is HashiCorp (i.e. not-community) contributed label Aug 17, 2023

hellobontempo commented Aug 17, 2023

View reviewed changes

hellobontempo added 2 commits August 17, 2023 21:30

fix conditional

6cce103

update metadata count now that last updated time renders

03f4d00

Monkeychip approved these changes Aug 18, 2023

View reviewed changes

hellobontempo added 3 commits August 18, 2023 09:57

prefill input search with path

15ab8a7

fix conditional for showing empty state and kev/value header divs

0f626ef

refactor search input

95f0b0f

hashishaw reviewed Aug 18, 2023

View reviewed changes

ui/lib/kv/addon/components/page/list.js Show resolved Hide resolved

stevendpclark and others added 16 commits August 18, 2023 13:42

Refactor ACME for enterprise CIEPS integration (#22188)

06378dd

remove stray slash (#22192)

94165de

Bump go-eventlogger to v0.2.2 (#22215)

951fc5c

Pass consul license in Enos scenarios that have backend in the matr…

6ec94be

…ix (#22177)

add ends in slash validator (#22218)

e03375c

Disaster Recovery Secondary nodes cannot handle API requests (#22217)

334411d

Signed-off-by: Alexander Scheel <[email protected]>

clarify docs in ldap/auth for userfilter (#22210)

8f74622

Send leaf_not_after_behavior as string not an integer - OSS (#22223)

6c13d4a

Docs for Application Default Credentials, links to non-dwdoa setup (#…

478499f

…21453)

Add an anchor link to policy override section (#22225)

a68f41f

Add 501 to Vault uninitialized (#22128)

8628238

* Add 502 to Vault uninitialized * Update index.mdx * Update index.mdx --------- Co-authored-by: Violet Hynes <[email protected]>

Refactor logic on applying leaf_not_after_behavior (#22230)

4d627c3

- Allow us to call and apply an issuer's leaf_not_after_behavior to a leaf certificate from various locations.

Update debug.mdx (#21755)

8d5fb29

Fix article usage Co-authored-by: Violet Hynes <[email protected]>

Audit: small tidy up (#22232)

67ae3c4

* options => opts * Standardise receiver letter, specify interface

Marc Boudreau and others added 17 commits August 18, 2023 13:42

VAULT-18934: Record individual metrics for each Auditing Event Pipeli…

3d27ee5

…ne (#22266) * add sink wrapper to take telemetry measures * make use of sinkwrapper

Refactor sign-intermediate API response (#22269)

c109e61

* Refactor sign-intermediate API response - Allow the sign-intermediate response handling code to be shared across different API calls. * Add missing cieps.go

Update hashicorp/vault-plugin-auth-azure to v0.16.0 (#22277)

7f8dff4

Update includes dependency upgrades and WIF support --------- Co-authored-by: hc-github-team-secure-vault-ecosystem <[email protected]>

Docs: Changelog for MSSQL EKM Provider v0.2.2 (#22272)

b92c2a4

VAULT-15396: Client count testing library (#20774)

2f4a08e

* fluent generation of client count testing data input * godocs * add VerifyInput and complete testing * pr fixes * pr fixes * buf lint

VAULT-17145, VAULT-17146: Write intent logs and event type in testing (…

4076b1f

…#21132) * add entry and intent log * test for intent logs

Share the same mssql container across all four subtests. (#22293)

23fb2d1

Add IBM 3rd Tools and Fix PR link (#11901)

ade5b3b

Co-authored-by: Violet Hynes <[email protected]>

documenting missing option (#22296)

76b8f5a

* documenting missing option * added comment about setting to zero

Improve docs around enable_rate_limit_response_headers (#22302)

a51ea13

Adjust the omitempty json flags within CIEPSResponse (#22305)

65eddbd

- Remove the omitempty flag from issuer_ref, and add it to the warnings and error fields

UI: kv v2 update breadcrumbs (#22440)

3faab41

* Add kv engine to tsconfig paths * Add kv-breadcrumb util to kv engine * remove lib/kv-breadcrumbs and use kv-engine util instead * Fix tests

remove todo, add overview card assertion

8d10694

hellobontempo requested review from a team as code owners August 18, 2023 20:43

hellobontempo closed this Aug 18, 2023

hellobontempo deleted the ui/VAULT-19168/allow-navigation-to-subdirectory branch August 18, 2023 20:57

schavis requested changes Aug 18, 2023

View reviewed changes

hellobontempo removed request for a team August 18, 2023 21:44

hellobontempo mentioned this pull request Aug 21, 2023

UI: allow navigation to subdirectory #22455

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

UI: allow navigation to subdirectory #22436

UI: allow navigation to subdirectory #22436

hellobontempo commented Aug 17, 2023 •

edited

Loading

hellobontempo Aug 17, 2023

github-actions bot commented Aug 17, 2023

Monkeychip left a comment

hellobontempo commented Aug 18, 2023

schavis left a comment

schavis Aug 18, 2023

schavis Aug 18, 2023

schavis Aug 18, 2023

schavis Aug 18, 2023

hellobontempo commented Aug 18, 2023

		- `password` `(string: <required>)` – The password for the LDAP user.
		When authenticating with the Vault CLI, i.e. `vault login -method=ldap username=mitchellh`

	- `password` `(string: <required>)` – The password for the LDAP user.
	When authenticating with the Vault CLI, i.e. `vault login -method=ldap username=mitchellh`
	- `password` `(string: <required>)` – Password for the LDAP user authenticating with the Vault CLI.

UI: allow navigation to subdirectory #22436

UI: allow navigation to subdirectory #22436

Conversation

hellobontempo commented Aug 17, 2023 • edited Loading

hellobontempo Aug 17, 2023

Choose a reason for hiding this comment

github-actions bot commented Aug 17, 2023

Monkeychip left a comment

Choose a reason for hiding this comment

hellobontempo commented Aug 18, 2023

schavis left a comment

Choose a reason for hiding this comment

schavis Aug 18, 2023

Choose a reason for hiding this comment

schavis Aug 18, 2023

Choose a reason for hiding this comment

schavis Aug 18, 2023

Choose a reason for hiding this comment

schavis Aug 18, 2023

Choose a reason for hiding this comment

hellobontempo commented Aug 18, 2023

hellobontempo commented Aug 17, 2023 •

edited

Loading