Add a /config/rotate-root path to the ldap auth backend #24099
Conversation
github-actions
bot
added
the
hashicorp-contributed-pr
|
Build Results: |
|
CI Results: |
| // grab our ldap client | ||
| client := ldaputil.Client{ | ||
| Logger: b.Logger(), | ||
| LDAP: ldaputil.NewLDAP(), | ||
| } | ||
|
|
There was a problem hiding this comment.
Can this live on the *backend struct so we can reuse it or does the client need to be created every time?
Also, there's a newer cap/ldap client that we're trying to migrate to. Any reason not to use this one instead?
There was a problem hiding this comment.
+1 on potentially adding a getClient helper on the backend struct. That would also match up with other plugins
There was a problem hiding this comment.
i thought about this - this is the only place this particular is currently used in this (credential/)ldap, and i want to avoid confusion with the other similarly named one (cap/ldap/Client).
Possibly whoever adds the second use of this client can add the helper?
There was a problem hiding this comment.
Not overly concerned with having a helper method, but more so wondering why we can't reuse the same instance of the ldap client. Probably not too concerning though, assuming that root rotation isn't a high-volume endpoint.
There was a problem hiding this comment.
I didn't notice the earlier mention of the cap client the first time around - the issue i encountered was that it wasn't interacting with LDAP at the level I needed to make Modify calls to the server, although maybe there was a way to do it that I missed.
I'm not too worried about multiple instantiations of the ldap client - whatever we're allocating is pretty thin each time, and rotate-root is going to be pretty low volume.
I added a test cribbing from backend_test. As you might imagine, it's based on having an external ldap set up, but i matched the expectations to the one from the backend tests. |
kpcraig
force-pushed
the
VAULT-21415/ldap-auth-rotate-root
branch
from
49ce79f to
1223cab
Compare
This PR adds a rotate-root functionality to the LDAP auth backend.