Skip to content

Commit 0922264

Browse files
spbsolublespbsoluble
authored
Merge 40a226b into 6d655d3 
2 parents 6d655d3 + 40a226b commit 0922264

File tree

13 files changed

+373
-104
lines changed

13 files changed

+373
-104
lines changed

‎.github/config/.terraform.lock.hcl‎

Lines changed: 16 additions & 16 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎.github/config/MODULE.MD‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,14 +9,13 @@
99

1010
| Name | Version |
1111
|------|---------|
12-
| <a name="provider_github"></a> [github](#provider\_github) | 6.3.1 |
12+
| <a name="provider_github"></a> [github](#provider\_github) | 6.6.0 |
1313

1414
## Modules
1515

1616
| Name | Source | Version |
1717
|------|--------|---------|
18-
| <a name="module_keyfactor_github_test_environment_12_3_0_kc"></a> [keyfactor\_github\_test\_environment\_12\_3\_0\_kc](#module\_keyfactor\_github\_test\_environment\_12\_3\_0\_kc) | git::ssh://[email protected]/Keyfactor/terraform-module-keyfactor-github-test-environment-ad.git | main |
19-
| <a name="module_keyfactor_github_test_environment_ad_10_5_0"></a> [keyfactor\_github\_test\_environment\_ad\_10\_5\_0](#module\_keyfactor\_github\_test\_environment\_ad\_10\_5\_0) | git::ssh://[email protected]/Keyfactor/terraform-module-keyfactor-github-test-environment-ad.git | main |
18+
| <a name="module_keyfactor_github_test_environment_ses_2441"></a> [keyfactor\_github\_test\_environment\_ses\_2441](#module\_keyfactor\_github\_test\_environment\_ses\_2441) | git::ssh://[email protected]/Keyfactor/terraform-module-keyfactor-github-test-environment-ad.git | main |
2019

2120
## Resources
2221

@@ -28,11 +27,15 @@
2827

2928
| Name | Description | Type | Default | Required |
3029
|------|-------------|------|---------|:--------:|
31-
| <a name="input_keyfactor_auth_token_url_12_3_0_KC"></a> [keyfactor\_auth\_token\_url\_12\_3\_0\_KC](#input\_keyfactor\_auth\_token\_url\_12\_3\_0\_KC) | The hostname of the KeyCloak instance to authenticate to for a Keyfactor Command access token | `string` | `"https://int-oidc-lab.eastus2.cloudapp.azure.com:8444/realms/Keyfactor/protocol/openid-connect/token"` | no |
30+
| <a name="input_keyfactor_auth_token_url_12_3_0_KC"></a> [keyfactor\_auth\_token\_url\_12\_3\_0\_KC](#input\_keyfactor\_auth\_token\_url\_12\_3\_0\_KC) | The hostname of the KeyCloak instance to authenticate to for a Keyfactor Command access token | `string` | `"https://int1230-oauth.eastus2.cloudapp.azure.com:8444/realms/Keyfactor/protocol/openid-connect/token"` | no |
31+
| <a name="input_keyfactor_auth_token_url_ses_2441"></a> [keyfactor\_auth\_token\_url\_ses\_2441](#input\_keyfactor\_auth\_token\_url\_ses\_2441) | The hostname of the KeyCloak instance to authenticate to for a Keyfactor Command access token | `string` | `"https://auth.kftestlab.com/oauth2/token"` | no |
3232
| <a name="input_keyfactor_client_id_12_3_0"></a> [keyfactor\_client\_id\_12\_3\_0](#input\_keyfactor\_client\_id\_12\_3\_0) | The client ID to authenticate with the Keyfactor instance using Keycloak client credentials | `string` | n/a | yes |
33+
| <a name="input_keyfactor_client_id_ses_2441"></a> [keyfactor\_client\_id\_ses\_2441](#input\_keyfactor\_client\_id\_ses\_2441) | The client ID to authenticate with the Keyfactor instance using Keycloak client credentials | `string` | n/a | yes |
3334
| <a name="input_keyfactor_client_secret_12_3_0"></a> [keyfactor\_client\_secret\_12\_3\_0](#input\_keyfactor\_client\_secret\_12\_3\_0) | The client secret to authenticate with the Keyfactor instance using Keycloak client credentials | `string` | n/a | yes |
35+
| <a name="input_keyfactor_client_secret_ses_2441"></a> [keyfactor\_client\_secret\_ses\_2441](#input\_keyfactor\_client\_secret\_ses\_2441) | The client secret to authenticate with the Keyfactor instance using Keycloak client credentials | `string` | n/a | yes |
3436
| <a name="input_keyfactor_hostname_10_5_0"></a> [keyfactor\_hostname\_10\_5\_0](#input\_keyfactor\_hostname\_10\_5\_0) | The hostname of the Keyfactor instance | `string` | `"integrations1050-lab.kfdelivery.com"` | no |
35-
| <a name="input_keyfactor_hostname_12_3_0_KC"></a> [keyfactor\_hostname\_12\_3\_0\_KC](#input\_keyfactor\_hostname\_12\_3\_0\_KC) | The hostname of the Keyfactor instance | `string` | `"int-oidc-lab.eastus2.cloudapp.azure.com"` | no |
37+
| <a name="input_keyfactor_hostname_12_3_0_KC"></a> [keyfactor\_hostname\_12\_3\_0\_KC](#input\_keyfactor\_hostname\_12\_3\_0\_KC) | The hostname of the Keyfactor instance | `string` | `"int1230-oauth.eastus2.cloudapp.azure.com"` | no |
38+
| <a name="input_keyfactor_hostname_ses_2441"></a> [keyfactor\_hostname\_ses\_2441](#input\_keyfactor\_hostname\_ses\_2441) | The hostname of the Keyfactor instance | `string` | `"int2441.kftestlab.com"` | no |
3639
| <a name="input_keyfactor_password_10_5_0"></a> [keyfactor\_password\_10\_5\_0](#input\_keyfactor\_password\_10\_5\_0) | The password to authenticate with the Keyfactor instance | `string` | n/a | yes |
3740
| <a name="input_keyfactor_username_10_5_0"></a> [keyfactor\_username\_10\_5\_0](#input\_keyfactor\_username\_10\_5\_0) | The username to authenticate with the Keyfactor instance | `string` | n/a | yes |
3841

‎.github/config/README.md‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -58,14 +58,13 @@ module "keyfactor_github_test_environment_12_3_0_kc" {
5858

5959
| Name | Version |
6060
|------|---------|
61-
| <a name="provider_github"></a> [github](#provider\_github) | 6.3.1 |
61+
| <a name="provider_github"></a> [github](#provider\_github) | 6.6.0 |
6262

6363
## Modules
6464

6565
| Name | Source | Version |
6666
|------|--------|---------|
67-
| <a name="module_keyfactor_github_test_environment_12_3_0_kc"></a> [keyfactor\_github\_test\_environment\_12\_3\_0\_kc](#module\_keyfactor\_github\_test\_environment\_12\_3\_0\_kc) | git::ssh://[email protected]/Keyfactor/terraform-module-keyfactor-github-test-environment-ad.git | main |
68-
| <a name="module_keyfactor_github_test_environment_ad_10_5_0"></a> [keyfactor\_github\_test\_environment\_ad\_10\_5\_0](#module\_keyfactor\_github\_test\_environment\_ad\_10\_5\_0) | git::ssh://[email protected]/Keyfactor/terraform-module-keyfactor-github-test-environment-ad.git | main |
67+
| <a name="module_keyfactor_github_test_environment_ses_2441"></a> [keyfactor\_github\_test\_environment\_ses\_2441](#module\_keyfactor\_github\_test\_environment\_ses\_2441) | git::ssh://[email protected]/Keyfactor/terraform-module-keyfactor-github-test-environment-ad.git | main |
6968

7069
## Resources
7170

@@ -77,11 +76,15 @@ module "keyfactor_github_test_environment_12_3_0_kc" {
7776

7877
| Name | Description | Type | Default | Required |
7978
|------|-------------|------|---------|:--------:|
80-
| <a name="input_keyfactor_auth_token_url_12_3_0_KC"></a> [keyfactor\_auth\_token\_url\_12\_3\_0\_KC](#input\_keyfactor\_auth\_token\_url\_12\_3\_0\_KC) | The hostname of the KeyCloak instance to authenticate to for a Keyfactor Command access token | `string` | `"https://int-oidc-lab.eastus2.cloudapp.azure.com:8444/realms/Keyfactor/protocol/openid-connect/token"` | no |
79+
| <a name="input_keyfactor_auth_token_url_12_3_0_KC"></a> [keyfactor\_auth\_token\_url\_12\_3\_0\_KC](#input\_keyfactor\_auth\_token\_url\_12\_3\_0\_KC) | The hostname of the KeyCloak instance to authenticate to for a Keyfactor Command access token | `string` | `"https://int1230-oauth.eastus2.cloudapp.azure.com:8444/realms/Keyfactor/protocol/openid-connect/token"` | no |
80+
| <a name="input_keyfactor_auth_token_url_ses_2441"></a> [keyfactor\_auth\_token\_url\_ses\_2441](#input\_keyfactor\_auth\_token\_url\_ses\_2441) | The hostname of the KeyCloak instance to authenticate to for a Keyfactor Command access token | `string` | `"https://auth.kftestlab.com/oauth2/token"` | no |
8181
| <a name="input_keyfactor_client_id_12_3_0"></a> [keyfactor\_client\_id\_12\_3\_0](#input\_keyfactor\_client\_id\_12\_3\_0) | The client ID to authenticate with the Keyfactor instance using Keycloak client credentials | `string` | n/a | yes |
82+
| <a name="input_keyfactor_client_id_ses_2441"></a> [keyfactor\_client\_id\_ses\_2441](#input\_keyfactor\_client\_id\_ses\_2441) | The client ID to authenticate with the Keyfactor instance using Keycloak client credentials | `string` | n/a | yes |
8283
| <a name="input_keyfactor_client_secret_12_3_0"></a> [keyfactor\_client\_secret\_12\_3\_0](#input\_keyfactor\_client\_secret\_12\_3\_0) | The client secret to authenticate with the Keyfactor instance using Keycloak client credentials | `string` | n/a | yes |
84+
| <a name="input_keyfactor_client_secret_ses_2441"></a> [keyfactor\_client\_secret\_ses\_2441](#input\_keyfactor\_client\_secret\_ses\_2441) | The client secret to authenticate with the Keyfactor instance using Keycloak client credentials | `string` | n/a | yes |
8385
| <a name="input_keyfactor_hostname_10_5_0"></a> [keyfactor\_hostname\_10\_5\_0](#input\_keyfactor\_hostname\_10\_5\_0) | The hostname of the Keyfactor instance | `string` | `"integrations1050-lab.kfdelivery.com"` | no |
84-
| <a name="input_keyfactor_hostname_12_3_0_KC"></a> [keyfactor\_hostname\_12\_3\_0\_KC](#input\_keyfactor\_hostname\_12\_3\_0\_KC) | The hostname of the Keyfactor instance | `string` | `"int-oidc-lab.eastus2.cloudapp.azure.com"` | no |
86+
| <a name="input_keyfactor_hostname_12_3_0_KC"></a> [keyfactor\_hostname\_12\_3\_0\_KC](#input\_keyfactor\_hostname\_12\_3\_0\_KC) | The hostname of the Keyfactor instance | `string` | `"int1230-oauth.eastus2.cloudapp.azure.com"` | no |
87+
| <a name="input_keyfactor_hostname_ses_2441"></a> [keyfactor\_hostname\_ses\_2441](#input\_keyfactor\_hostname\_ses\_2441) | The hostname of the Keyfactor instance | `string` | `"int2441.kftestlab.com"` | no |
8588
| <a name="input_keyfactor_password_10_5_0"></a> [keyfactor\_password\_10\_5\_0](#input\_keyfactor\_password\_10\_5\_0) | The password to authenticate with the Keyfactor instance | `string` | n/a | yes |
8689
| <a name="input_keyfactor_username_10_5_0"></a> [keyfactor\_username\_10\_5\_0](#input\_keyfactor\_username\_10\_5\_0) | The username to authenticate with the Keyfactor instance | `string` | n/a | yes |
8790

‎.github/config/environments.tf‎

Lines changed: 31 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
1-
module "keyfactor_github_test_environment_ad_10_5_0" {
2-
source = "git::ssh://[email protected]/Keyfactor/terraform-module-keyfactor-github-test-environment-ad.git?ref=main"
3-
4-
gh_environment_name = "KFC_10_5_0"
5-
gh_repo_name = data.github_repository.repo.name
6-
keyfactor_hostname = var.keyfactor_hostname_10_5_0
7-
keyfactor_username = var.keyfactor_username_10_5_0
8-
keyfactor_password = var.keyfactor_password_10_5_0
9-
keyfactor_config_file = base64encode(file("${path.module}/command_config.json"))
10-
}
1+
# module "keyfactor_github_test_environment_ad_10_5_0" {
2+
# source = "git::ssh://[email protected]/Keyfactor/terraform-module-keyfactor-github-test-environment-ad.git?ref=main"
3+
#
4+
# gh_environment_name = "KFC_10_5_0"
5+
# gh_repo_name = data.github_repository.repo.name
6+
# keyfactor_hostname = var.keyfactor_hostname_10_5_0
7+
# keyfactor_username = var.keyfactor_username_10_5_0
8+
# keyfactor_password = var.keyfactor_password_10_5_0
9+
# keyfactor_config_file = base64encode(file("${path.module}/command_config.json"))
10+
# }
1111

1212
# module "keyfactor_github_test_environment_11_5_0_kc" {
1313
# source = "git::ssh://[email protected]/Keyfactor/terraform-module-keyfactor-github-test-environment-kc.git?ref=main"
@@ -21,15 +21,29 @@ module "keyfactor_github_test_environment_ad_10_5_0" {
2121
# keyfactor_tls_skip_verify = true
2222
# }
2323

24-
module "keyfactor_github_test_environment_12_3_0_kc" {
24+
# module "keyfactor_github_test_environment_12_3_0_kc" {
25+
# source = "git::ssh://[email protected]/Keyfactor/terraform-module-keyfactor-github-test-environment-ad.git?ref=main"
26+
#
27+
# gh_environment_name = "KFC_12_3_0_KC"
28+
# gh_repo_name = data.github_repository.repo.name
29+
# keyfactor_hostname = var.keyfactor_hostname_12_3_0_KC
30+
# keyfactor_auth_token_url = var.keyfactor_auth_token_url_12_3_0_KC
31+
# keyfactor_client_id = var.keyfactor_client_id_12_3_0
32+
# keyfactor_client_secret = var.keyfactor_client_secret_12_3_0
33+
# keyfactor_tls_skip_verify = true
34+
# keyfactor_config_file = base64encode(file("${path.module}/command_config.json"))
35+
# }
36+
37+
module "keyfactor_github_test_environment_ses_2441" {
2538
source = "git::ssh://[email protected]/Keyfactor/terraform-module-keyfactor-github-test-environment-ad.git?ref=main"
2639

27-
gh_environment_name = "KFC_12_3_0_KC"
40+
gh_environment_name = "ses_2441"
2841
gh_repo_name = data.github_repository.repo.name
29-
keyfactor_hostname = var.keyfactor_hostname_12_3_0_KC
30-
keyfactor_auth_token_url = var.keyfactor_auth_token_url_12_3_0_KC
31-
keyfactor_client_id = var.keyfactor_client_id_12_3_0
32-
keyfactor_client_secret = var.keyfactor_client_secret_12_3_0
42+
keyfactor_hostname = var.keyfactor_hostname_ses_2441
43+
keyfactor_auth_token_url = var.keyfactor_auth_token_url_ses_2441
44+
keyfactor_client_id = var.keyfactor_client_id_ses_2441
45+
keyfactor_client_secret = var.keyfactor_client_secret_ses_2441
3346
keyfactor_tls_skip_verify = true
47+
keyfactor_api_path = "/Keyfactor/API"
3448
keyfactor_config_file = base64encode(file("${path.module}/command_config.json"))
35-
}
49+
}

‎.github/config/variables.tf‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,3 +37,25 @@ variable "keyfactor_auth_token_url_12_3_0_KC" {
3737
default = "https://int1230-oauth.eastus2.cloudapp.azure.com:8444/realms/Keyfactor/protocol/openid-connect/token"
3838
}
3939

40+
variable "keyfactor_client_id_ses_2441" {
41+
description = "The client ID to authenticate with the Keyfactor instance using Keycloak client credentials"
42+
type = string
43+
}
44+
45+
variable "keyfactor_client_secret_ses_2441" {
46+
description = "The client secret to authenticate with the Keyfactor instance using Keycloak client credentials"
47+
type = string
48+
}
49+
50+
variable "keyfactor_hostname_ses_2441" {
51+
description = "The hostname of the Keyfactor instance"
52+
type = string
53+
default = "int2441.kftestlab.com"
54+
55+
}
56+
57+
variable "keyfactor_auth_token_url_ses_2441" {
58+
description = "The hostname of the KeyCloak instance to authenticate to for a Keyfactor Command access token"
59+
type = string
60+
default = "https://auth.kftestlab.com/oauth2/token"
61+
}

‎.github/workflows/go_tests.yml‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,8 @@ jobs:
1212
matrix:
1313
environment:
1414
# - "KFC_10_5_0"
15-
- "KFC_12_3_0_KC"
15+
# - "KFC_12_3_0_KC"
16+
- "ses_2441"
1617
environment: ${{ matrix.environment }}
1718
steps:
1819
- name: Check out code
@@ -21,15 +22,11 @@ jobs:
2122
- name: Set up Go
2223
uses: actions/setup-go@v5
2324
with:
24-
go-version: 1.22
25+
go-version: 1.24
2526

2627
- name: Get Public IP
2728
run: curl -s https://api.ipify.org
2829

29-
- name: Validate lab cert is present
30-
run: |
31-
cat lib/certs/int-oidc-lab.eastus2.cloudapp.azure.com.crt
32-
3330
- name: Run tests
3431
run: |
3532
if [ -n "${{ secrets.KEYFACTOR_AUTH_CONFIG_B64 }}" ]; then

‎CHANGELOG.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,15 @@
1+
# v1.3.0
2+
3+
## Features
4+
- Add support for fetching an oauth2 token using the `client_credentials` grant type without connecting to Keyfactor Command.
5+
- Add placeholders for omitted `Authorization` header in the `curl` command string output in trace logging.
6+
7+
## Bug Fixes
8+
- Log `curl` command string at `trace` level after request is sent to include any transport mutations.
9+
10+
## Chores
11+
- Bump Go version to `1.24`.
12+
113
# v1.2.0
214

315
## Features

‎auth_providers/auth_core.go‎

Lines changed: 48 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -501,19 +501,21 @@ func (c *CommandAuthConfig) Authenticate() error {
501501
}
502502

503503
c.HttpClient.Timeout = time.Duration(c.HttpClientTimeout) * time.Second
504-
curlStr, cErr := RequestToCurl(req)
505-
if cErr == nil {
504+
505+
cResp, cErr := c.HttpClient.Do(req)
506+
curlStr, curlErr := RequestToCurl(req)
507+
if curlErr == nil {
506508
log.Printf("[TRACE] curl command: %s", curlStr)
507509
}
508510

509-
cResp, cErr := c.HttpClient.Do(req)
510511
if cErr != nil {
511512
return cErr
512513
} else if cResp == nil {
513514
return fmt.Errorf("failed to authenticate, no response received from Keyfactor Command")
514515
}
515516

516517
defer cResp.Body.Close()
518+
log.Printf("[DEBUG] request to Keyfactor Command API returned status code %d", cResp.StatusCode)
517519

518520
// check if body is empty
519521
if cResp.Body == nil {
@@ -798,19 +800,56 @@ func RequestToCurl(req *http.Request) (string, error) {
798800
// Add headers
799801
for name, values := range req.Header {
800802
for _, value := range values {
803+
// check if is Authorization header and skip it
804+
if strings.EqualFold(name, "Authorization") {
805+
// check if basic auth and skip it
806+
if strings.HasPrefix(value, "Basic ") {
807+
// Remove credentials and put in env variables as placeholder
808+
log.Printf(
809+
"[DEBUG] Found Basic auth in Authorization header, " +
810+
"replacing with env variable references",
811+
)
812+
curlCommand.WriteString(
813+
fmt.Sprintf(
814+
"-H %q ", fmt.Sprintf(
815+
"%s: Basic $(echo -n $\"%s,$%s\" | base64)", name,
816+
EnvKeyfactorUsername, EnvKeyfactorPassword,
817+
),
818+
),
819+
)
820+
continue
821+
} else if strings.HasPrefix(value, "Bearer ") {
822+
// Remove credentials and put in env variables as placeholder
823+
log.Printf("[DEBUG] Found Bearer token in Authorization header, replacing with kfutil command to fetch token")
824+
curlCommand.WriteString(
825+
fmt.Sprintf(
826+
"-H %q ", fmt.Sprintf(
827+
"%s: Bearer $(kfutil auth fetch-oauth-token)", name,
828+
),
829+
),
830+
)
831+
continue
832+
} else {
833+
// Skip other Authorization headers
834+
log.Printf("[ERROR] Skipping unhandled Authorization header: %s", name)
835+
continue
836+
}
837+
}
801838
curlCommand.WriteString(fmt.Sprintf("-H %q ", fmt.Sprintf("%s: %s", name, value)))
802839
}
803840
}
804841

805842
// Add the body if it exists
806843
if req.Method == http.MethodPost || req.Method == http.MethodPut {
807-
body, err := io.ReadAll(req.Body)
808-
if err != nil {
809-
return "", err
810-
}
811-
req.Body = io.NopCloser(bytes.NewBuffer(body)) // Restore the request body
844+
if req.Body != nil {
845+
body, err := io.ReadAll(req.Body)
846+
if err != nil {
847+
return "", err
848+
}
849+
req.Body = io.NopCloser(bytes.NewBuffer(body)) // Restore the request body
812850

813-
curlCommand.WriteString(fmt.Sprintf("--data %q ", string(body)))
851+
curlCommand.WriteString(fmt.Sprintf("--data %q ", string(body)))
852+
}
814853
}
815854

816855
return curlCommand.String(), nil

0 commit comments

Comments
 (0)