public async Task SettingUndeleteAllowed_ProvidesAbilityToUndeleteSecret()
{
// Setup basics.
(string policyPath, KV2Secret origSecret) = await SetupIndividualTestAsync();
// Setup Policy
(VaultPolicyContainer polContainer, VaultPolicyPathItem vppi) = await SetupPolicy(policyPath);
// Setup the Test Engines, One has a good token and one has a control token.
(KV2SecretEngine engOK, KV2SecretEngine engFail) = await SetupTokenEngines(polContainer.Name);
//**************************************
// Test Setup. Lets save several versions of the secret.
KV2Secret secret2 = await UpdateSecretRandom(origSecret);
secret2 = await UpdateSecretRandom(secret2);
secret2 = await UpdateSecretRandom(secret2);
// Delete the latest version.
int versionNum = secret2.Version;
Assert.True(await _rootEng.DeleteSecretVersion(secret2, secret2.Version), "A10: Expected deletion of specific secret version to succeed..");
// Read it back with the root engine.
Thread.Sleep(200);
KV2Secret delSecret = await _rootEng.ReadSecret(secret2);
Assert.IsNull(delSecret, "A20: Deletion of secret does not appear to have worked.");
// Failure Test
// Lets try to undelete the secret.
VaultForbiddenException eDL1 = Assert.ThrowsAsync <VaultForbiddenException>(async() => await engOK.UndeleteSecretVersion(secret2, secret2.Version), "DL10: Expected VaultForbidden Error to be thrown.");
// Provide Access
vppi.Denied = true;
vppi.ExtKV2_UndeleteSecret = true;
Assert.True(await _vaultSystemBackend.SysPoliciesACLUpdate(polContainer), "A30: Updating the policy object failed.");
// Success Test.
Assert.True(await engOK.UndeleteSecretVersion(secret2, secret2.Version), "A40: Expected Undelete to succeed.");
// Validate - We use the root accessor, since our base token does not have Read Access.
KV2Secret secret3 = null;
secret3 = await _rootEng.ReadSecret(secret2);
Assert.IsNotNull(secret3, "A50: Expected the Secret to be found and successfully read. We did not find a secret object. Something is wrong with permissions.");
Assert.AreEqual(secret2.Attributes.Count, secret3.Attributes.Count, "A60: Undeleted version of secret is not same as deleted version.");
}
public async Task TestTemplatedPolicies()
{
string appBE = _uniqueKeys.GetKey("appTE");
string kv2BE = _uniqueKeys.GetKey("kv2TE");
// 1A - Setup backends needed for testing.
// We need to setup a KV2 Secrets engine and also an AppRole Backend.
// Create an Authentication method of App Role. - This only needs to be done when the Auth method is created.
AuthMethod am = new AuthMethod(appBE, EnumAuthMethods.AppRole);
await _vaultSystemBackend.AuthEnable(am);
// Create a KV2 Secret Mount if it does not exist.
VaultSystemBackend vaultSystemBackend = new VaultSystemBackend(_vaultAgentAPI.TokenID, _vaultAgentAPI);
await vaultSystemBackend.SysMountCreate(kv2BE, "ClientTest KeyValue 2 Secrets", EnumSecretBackendTypes.KeyValueV2);
// 1B. Now we can connect to the backends.
VaultAgentAPI vault = await VaultServerRef.ConnectVault("PolicyBECapa");
//new VaultAgentAPI("capability", _vaultAgentAPI.IP, _vaultAgentAPI.Port, _vaultAgentAPI.TokenID);
AppRoleAuthEngine authEngine = (AppRoleAuthEngine)vault.ConnectAuthenticationBackend(EnumBackendTypes.A_AppRole, appBE, appBE);
KV2SecretEngine secretEngine =
(KV2SecretEngine)vault.ConnectToSecretBackend(EnumSecretBackendTypes.KeyValueV2, "KV2 Secrets", kv2BE);
IdentitySecretEngine idEngine = (IdentitySecretEngine)_vaultAgentAPI.ConnectToSecretBackend(EnumSecretBackendTypes.Identity);
// 1C - Write out some values.
TestContext.WriteLine("App Role Auth Backend: {0}", authEngine.Name);
TestContext.WriteLine("KV2 Secret Backend: {0}", secretEngine.Name);
// 2. Setup the policy to provide the permissions to test against.
VaultPolicyContainer policyContainer = new VaultPolicyContainer("capa");
// 3. Now create an App Role & Secret ID. The app role in this case has no policies - it will get them from the Entity.
string roleName = _uniqueKeys.GetKey("role");
AppRole appRole = new AppRole(roleName);
appRole = await authEngine.SaveRoleAndReturnRoleObject(appRole);
AppRoleSecret secretID = await authEngine.CreateSecretID(appRole.Name);
// 4. Create an Entity and Entity Alias.
// 4A. Get Authentication backend accessor.
Dictionary <string, AuthMethod> authMethods = await vaultSystemBackend.AuthListAll();
AuthMethod authMethod = authMethods[authEngine.Name + "/"];
Assert.IsNotNull(authMethod, "B10: Expected to find the authentication backend. But did not.");
string mountAccessor = authMethod.Accessor;
// 4B. Create an entity for the app role.
string name = _uniqueKeys.GetKey("EAR");
Entity entity = new Entity(roleName);
entity.Policies.Add(policyContainer.Name);
// 4C. Now save entity
entity = await idEngine.SaveEntity(entity);
Assert.IsNotNull(entity, "B20: Expected to receive an Entity object");
// 4D. Write out some values
TestContext.WriteLine("Entity Name: {0}", entity.Name);
TestContext.WriteLine("Entity ID: {0}", entity.Id);
// 5. Create an alias that ties the Entity we just created to the AppRole in the authentication backend.
Guid roleID = new Guid(appRole.RoleID);
Guid aliasGuid = await idEngine.SaveAlias(entity.Id, mountAccessor, appRole.RoleID);
Assert.AreNotEqual(aliasGuid.ToString(), Guid.Empty.ToString());
// 5B. Re-read the entity - it should now contain the alias.
Entity fullEntity = await idEngine.ReadEntity(entity.Id);
Assert.AreEqual(1, fullEntity.Aliases.Count, "B30: Expected the full entity to now contain the alias ID.");
// 6. Now define the policy and save to Vault.
policyContainer.PolicyPaths.Clear();
string appPath1 = "app/{{identity.entity.aliases." + mountAccessor + ".name}}/*";
VaultPolicyPathItem vppi1 = new VaultPolicyPathItem(kv2BE, "data/" + appPath1);
VaultPolicyPathItem vppi2 = new VaultPolicyPathItem(kv2BE, "data/app/appA/subItem/*");
VaultPolicyPathItem vppi3 = new VaultPolicyPathItem(kv2BE, "data/shared/common/*");
VaultPolicyPathItem vppi4 = new VaultPolicyPathItem(kv2BE, "data/shared/info/*");
vppi1.FullControl = true;
vppi2.FullControl = true;
vppi3.CRUDAllowed = true;
vppi4.ReadAllowed = true;
policyContainer.AddPolicyPathObject(vppi1);
policyContainer.AddPolicyPathObject(vppi2);
policyContainer.AddPolicyPathObject(vppi3);
policyContainer.AddPolicyPathObject(vppi4);
await _vaultSystemBackend.SysPoliciesACLCreate(policyContainer);
// 7. Now we can login to get a token.. Validate the entity policy has been set on token.
Token token = await authEngine.Login(appRole.RoleID, secretID.ID);
Assert.IsNotNull("B40: A valid token was not received.");
CollectionAssert.Contains(token.IdentityPolicies, policyContainer.Name, "B100: Did not find the policy that should have been applied from the entity.");
// 8. Now we can finally test the capabilities of that token.
List <string> paths = new List <string>();
string pathBase = kv2BE + "/data/app/" + fullEntity.Aliases[0].Name + "/config";
string metaBase = kv2BE + "/metadata/app" + fullEntity.Aliases[0].Name + "/config";
string path1 = pathBase;
string path2 = pathBase + "/subItem";
string path3 = kv2BE + "/data/shared/common/testEntry";
paths.Add(path1);
paths.Add(path2);
paths.Add(path3);
Dictionary <string, List <string> > permissions;
permissions = await _vaultSystemBackend.GetTokenCapabilityOnPaths(token.ID, paths);
// 9. Validate the permission results.
Assert.AreEqual(3, permissions.Count, "B130: Expected to receive 3 permission objects back.");
Assert.AreEqual(6, permissions[path1].Count, "B140: Expected the item: " + path1 + " to contain 6 permissions.");
Assert.AreEqual(6, permissions[path2].Count, "B150: Expected the item: " + path2 + " to contain 6 permissions.");
Assert.AreEqual(4, permissions[path3].Count, "B160: Expected the item: " + path3 + " to contain 3 permissions.");
CollectionAssert.Contains(permissions[path3], "create", "B170: Expected the permission to be create for path: " + path3);
CollectionAssert.Contains(permissions[path3], "read", "B171: Expected the permission to be read for path: " + path3);
CollectionAssert.Contains(permissions[path3], "update", "B172: Expected the permission to be update for path: " + path3);
CollectionAssert.Contains(permissions[path3], "delete", "B173: Expected the permission to be read for path: " + path3);
// 10. Try to create a secret at path 1
string secName1 = _uniqueKeys.GetKey("sec1");
KV2Secret secret1 = new KV2Secret("config", "app/" + fullEntity.Aliases[0].Name);
secret1.Attributes.Add("version", "v12.2");
Assert.True(await secretEngine.SaveSecret(secret1, KV2EnumSecretSaveOptions.AlwaysAllow), "B200: Save of secret did not work. Check permissions.");
// 11. Create and delete a secret at path3.
KV2Secret secret2 = new KV2Secret("options", "shared/common/testEntry");
secret2.Attributes.Add("color", "blue");
secret2.Attributes.Add("size", "Large");
Assert.True(await secretEngine.SaveSecret(secret2, KV2EnumSecretSaveOptions.AlwaysAllow), "B210: Save of secret2 failed.");
// Now delete it.
Assert.True(await secretEngine.DeleteSecretVersion(secret2));
}