Add a /config/rotate-root path to the ldap auth backend

builtin/credential/ldap/backend.go

@@ -7,6 +7,7 @@ import (
 	"context"
 	"fmt"
 	"strings"
+	"sync"
 
 	"github.com/hashicorp/cap/ldap"
 	"github.com/hashicorp/go-secure-stdlib/strutil"
@@ -17,8 +18,9 @@ import (
 )
 
 const (
-	operationPrefixLDAP = "ldap"
-	errUserBindFailed   = "ldap operation failed: failed to bind as user"
+	operationPrefixLDAP   = "ldap"
+	errUserBindFailed     = "ldap operation failed: failed to bind as user"
+	defaultPasswordLength = 64 // length to use for configured root password on rotations by default
 )
 
 func Factory(ctx context.Context, conf *logical.BackendConfig) (logical.Backend, error) {
@@ -51,6 +53,7 @@ func Backend() *backend {
 			pathUsers(&b),
 			pathUsersList(&b),
 			pathLogin(&b),
+			pathConfigRotateRoot(&b),
 		},
 
 		AuthRenew:   b.pathLoginRenew,
@@ -62,6 +65,8 @@ func Backend() *backend {
 
 type backend struct {
 	*framework.Backend
+
+	mu sync.RWMutex
 }
 
 func (b *backend) Login(ctx context.Context, req *logical.Request, username string, password string, usernameAsAlias bool) (string, []string, *logical.Response, []string, error) {

builtin/credential/ldap/path_config.go

@@ -48,6 +48,12 @@ func pathConfig(b *backend) *framework.Path {
 
 	tokenutil.AddTokenFields(p.Fields)
 	p.Fields["token_policies"].Description += ". This will apply to all tokens generated by this auth method, in addition to any configured for specific users/groups."
+
+	p.Fields["password_policy"] = &framework.FieldSchema{
+		Type:        framework.TypeString,
+		Description: "Password policy to use to rotate the root password",
+	}
+
 	return p
 }
 
@@ -194,6 +200,10 @@ func (b *backend) pathConfigWrite(ctx context.Context, req *logical.Request, d *
 		return logical.ErrorResponse(err.Error()), logical.ErrInvalidRequest
 	}
 
+	if passwordPolicy, ok := d.GetOk("password_policy"); ok {
+		cfg.PasswordPolicy = passwordPolicy.(string)
+	}
+
 	entry, err := logical.StorageEntryJSON("config", cfg)
 	if err != nil {
 		return nil, err
@@ -234,6 +244,8 @@ func (b *backend) getConfigFieldData() (*framework.FieldData, error) {
 type ldapConfigEntry struct {
 	tokenutil.TokenParams
 	*ldaputil.ConfigEntry
+
+	PasswordPolicy string `json:"password_policy"`
 }
 
 const pathConfigHelpSyn = `

builtin/credential/ldap/path_config_rotate_root.go

@@ -0,0 +1,99 @@
+package ldap
+
+import (
+	"context"
+
+	"github.com/go-ldap/ldap/v3"
+
+	"github.com/hashicorp/vault/sdk/helper/base62"
+	"github.com/hashicorp/vault/sdk/helper/ldaputil"
+
+	"github.com/hashicorp/vault/sdk/framework"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+func pathConfigRotateRoot(b *backend) *framework.Path {
+	return &framework.Path{
+		Pattern: "config/rotate-root",
+
+		DisplayAttrs: &framework.DisplayAttributes{
+			OperationPrefix: operationPrefixLDAP,
+			OperationVerb:   "rotate",
+			OperationSuffix: "root-credentials",
+		},
+
+		Operations: map[logical.Operation]framework.OperationHandler{
+			logical.UpdateOperation: &framework.PathOperation{
+				Callback: b.pathConfigRotateRootUpdate,
+			},
+		},
+
+		HelpSynopsis:    pathConfigRotateRootHelpSyn,
+		HelpDescription: pathConfigRotateRootHelpDesc,
+	}
+}
+
+func (b *backend) pathConfigRotateRootUpdate(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+	// TODO: What do we need to mutex here
+	cfg, err := b.Config(ctx, req)
+	if err != nil {
+		return nil, err
+	}
+	if cfg == nil {
+		return nil, nil
+	}
+
+	u, p := cfg.BindDN, cfg.BindPassword
+	if u == "" || p == "" {
+		return logical.ErrorResponse("auth is not using authenticated search, no root to rotate"), nil
+	}
+
+	// grab our ldap client
+	client := ldaputil.Client{
+		Logger: b.Logger(),
+		LDAP:   ldaputil.NewLDAP(),
+	}
+
+	conn, err := client.DialLDAP(cfg.ConfigEntry)
+	if err != nil {
+		return nil, err
+	}
+
+	err = conn.Bind(u, p)
+	if err != nil {
+		return nil, err
+	}
+
+	lreq := &ldap.ModifyRequest{
+		DN: cfg.BindDN,
+	}
+
+	var newPassword string
+	if cfg.PasswordPolicy != "" {
+		b.Logger().Info("cfg", "password policy", cfg.PasswordPolicy)
+		newPassword, err = b.System().GeneratePasswordFromPolicy(ctx, cfg.PasswordPolicy)
+	} else {
+		newPassword, err = base62.Random(defaultPasswordLength)
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	b.Logger().Info("new", "password", newPassword) // TODO: REMOVE PLX
+	lreq.Replace("userPassword", []string{newPassword})
+
+	err = conn.Modify(lreq)
+	if err != nil {
+		return nil, err
+	}
+
+	return nil, nil
+}
+
+const pathConfigRotateRootHelpSyn = `
+Request to rotate the LDAP credentials used by Vault
+`
+
+const pathConfigRotateRootHelpDesc = `
+This path attempts to rotate the LDAP bindpass used by Vault for this mount.
+`

changelog/24099.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+auth/ldap: added rotate-root path to ldap auth backend
+```