@@ -3,19 +3,15 @@ package splunk
33import (
44 "context"
55 "fmt"
6+
67 "github.com/hashicorp/errwrap"
7- "github.com/hashicorp/go-uuid"
8+ uuid "github.com/hashicorp/go-uuid"
89 "github.com/hashicorp/vault/helper/strutil"
910 "github.com/hashicorp/vault/logical"
1011 "github.com/hashicorp/vault/logical/framework"
1112 "github.com/splunk/vault-plugin-splunk/clients/splunk"
1213)
1314
14- const (
15- SEARCHHEAD = "search_head"
16- INDEXER = "indexer"
17- )
18-
1915func (b * backend ) pathCredsCreate () * framework.Path {
2016 return & framework.Path {
2117 Pattern : "creds/" + framework .GenericNameRegex ("name" ),
@@ -84,7 +80,7 @@ func (b *backend) credsReadHandlerStandalone(ctx context.Context, req *logical.R
8480 }
8581
8682 // Generate credentials
87- userUUID , err := uuid . GenerateUUID ( )
83+ userUUID , err := generateUserID ( role )
8884 if err != nil {
8985 return nil , err
9086 }
@@ -93,7 +89,7 @@ func (b *backend) credsReadHandlerStandalone(ctx context.Context, req *logical.R
9389 userPrefix = fmt .Sprintf ("%s_%s" , role .UserPrefix , req .DisplayName )
9490 }
9591 username := fmt .Sprintf ("%s_%s" , userPrefix , userUUID )
96- passwd , err := uuid . GenerateUUID ( )
92+ passwd , err := generateUserPassword ( role )
9793 if err != nil {
9894 return nil , errwrap .Wrapf ("error generating new password {{err}}" , err )
9995 }
@@ -128,20 +124,23 @@ func (b *backend) credsReadHandlerStandalone(ctx context.Context, req *logical.R
128124 return resp , nil
129125}
130126
131- func findNode (nodeFQDN string , hosts []splunk.ServerInfoEntry ) (bool , error ) {
127+ func findNode (nodeFQDN string , hosts []splunk.ServerInfoEntry , roleConfig * roleConfig ) (bool , error ) {
132128 for _ , host := range hosts {
133129 // check if node_fqdn is in either of HostFQDN or Host. User might not always the FQDN on the cli input
134130 if host .Content .HostFQDN == nodeFQDN || host .Content .Host == nodeFQDN {
135- // Return true if the requested node is a search head
131+ // Return true if the requested node type is allowed
132+ if strutil .StrListContains (roleConfig .AllowedNodeTypes , "*" ) {
133+ return true , nil
134+ }
136135 for _ , role := range host .Content .Roles {
137- if role == SEARCHHEAD {
136+ if strutil . StrListContainsGlob ( roleConfig . AllowedNodeTypes , role ) {
138137 return true , nil
139138 }
140139 }
141- return false , fmt .Errorf ("host: %s isn't search head; creating ephemeral creds is only supported for search heads " , nodeFQDN )
140+ return false , fmt .Errorf ("host %q does not have an allowed node type " , nodeFQDN )
142141 }
143142 }
144- return false , fmt .Errorf ("host: %s not found" , nodeFQDN )
143+ return false , fmt .Errorf ("host %q not found" , nodeFQDN )
145144}
146145
147146func (b * backend ) credsReadHandlerMulti (ctx context.Context , req * logical.Request , d * framework.FieldData ) (* logical.Response , error ) {
@@ -180,7 +179,7 @@ func (b *backend) credsReadHandlerMulti(ctx context.Context, req *logical.Reques
180179 b .Logger ().Error ("Error while reading SearchPeers from cluster master" , err )
181180 return nil , errwrap .Wrapf ("unable to read searchpeers from cluster master: {{err}}" , err )
182181 }
183- _ , err = findNode (nodeFQDN , nodes )
182+ _ , err = findNode (nodeFQDN , nodes , role )
184183 if err != nil {
185184 return nil , err
186185 }
@@ -193,7 +192,7 @@ func (b *backend) credsReadHandlerMulti(ctx context.Context, req *logical.Reques
193192 return nil , err
194193 }
195194 // Generate credentials
196- userUUID , err := uuid . GenerateUUID ( )
195+ userUUID , err := generateUserID ( role )
197196 if err != nil {
198197 return nil , err
199198 }
@@ -202,11 +201,10 @@ func (b *backend) credsReadHandlerMulti(ctx context.Context, req *logical.Reques
202201 userPrefix = fmt .Sprintf ("%s_%s" , role .UserPrefix , req .DisplayName )
203202 }
204203 username := fmt .Sprintf ("%s_%s" , userPrefix , userUUID )
205- passwd , err := uuid . GenerateUUID ( )
204+ passwd , err := generateUserPassword ( role )
206205 if err != nil {
207206 return nil , errwrap .Wrapf ("error generating new password: {{err}}" , err )
208207 }
209- conn .Params ().BaseURL = nodeFQDN
210208 opts := splunk.CreateUserOptions {
211209 Name : username ,
212210 Password : passwd ,
@@ -251,6 +249,19 @@ func (b *backend) credsReadHandler(ctx context.Context, req *logical.Request, d
251249 return b .credsReadHandlerStandalone (ctx , req , d )
252250}
253251
252+ func generateUserID (roleConfig * roleConfig ) (string , error ) {
253+ return uuid .GenerateUUID ()
254+ }
255+
256+ func generateUserPassword (roleConfig * roleConfig ) (string , error ) {
257+ passwd , err := GeneratePassword (roleConfig .PasswordSpec )
258+ if err == nil {
259+ return passwd , nil
260+ }
261+ // fallback
262+ return uuid .GenerateUUID ()
263+ }
264+
254265const pathCredsCreateHelpSyn = `
255266Request Splunk credentials for a certain role.
256267`
0 commit comments