Initial commit

Author: jdmuntacb

LICENSE

@@ -0,0 +1,38 @@
+TOOL?=vault-plugin-database-couchbasecapella
+TEST?=$$(go list ./... | grep -v /vendor/ | grep -v teamcity)
+VETARGS?=-asmdecl -atomic -bool -buildtags -copylocks -methods -nilfunc -printf -rangeloops -shift -structtags -unsafeptr
+BUILD_TAGS?=${TOOL}
+GOFMT_FILES?=$$(find . -name '*.go' | grep -v vendor)
+GO_TEST_CMD?=go test -v
+
+# bin generates the releaseable binaries for this plugin
+bin: fmtcheck
+	@CGO_ENABLED=0 BUILD_TAGS='$(BUILD_TAGS)' sh -c "'$(CURDIR)/scripts/build.sh'"
+
+default: dev
+
+# dev starts up `vault` from your $PATH, then builds the couchbasecapella
+# plugin, registers it with vault and enables it.
+# A ./tmp dir is created for configs and binaries, and cleaned up on exit.
+dev: fmtcheck
+	@CGO_ENABLED=0 BUILD_TAGS='$(BUILD_TAGS)' VAULT_DEV_BUILD=1 sh -c "'$(CURDIR)/scripts/build.sh'"
+
+# test runs the unit tests and vets the code
+test: fmtcheck
+	CGO_ENABLED=0 VAULT_TOKEN= ${GO_TEST_CMD} -tags='$(BUILD_TAGS)' $(TEST) $(TESTARGS) -count=1 -timeout=5m -parallel=4
+
+testacc: fmtcheck
+	CGO_ENABLED=0 VAULT_TOKEN= VAULT_ACC=1 ${GO_TEST_CMD} -tags='$(BUILD_TAGS)' $(TEST) $(TESTARGS) -count=1 -timeout=20m
+
+testcompile: fmtcheck
+	@for pkg in $(TEST) ; do \
+		go test -v -c -tags='$(BUILD_TAGS)' $$pkg ; \
+	done
+
+fmtcheck:
+	@sh -c "'$(CURDIR)/scripts/gofmtcheck.sh'"
+
+fmt:
+	gofmt -w $(GOFMT_FILES)
+
+.PHONY: bin default dev test testcompile fmtcheck fmt

Makefile

@@ -0,0 +1,144 @@
+# vault-plugin-database-couchbasecapella
+
+[![CircleCI](https://circleci.com/gh/hashicorp/vault-plugin-database-couchbase.svg?style=svg)](https://circleci.com/gh/hashicorp/vault-plugin-database-couchbasecapella)
+
+A [Vault](https://www.vaultproject.io) plugin for Couchbase Capella
+
+This project uses the database plugin interface introduced in Vault version 0.7.1.
+
+The plugin supports the generation of static and dynamic user roles and root credential rotation.
+
+## Build
+
+To build this package for any platform you will need to clone this repository and cd into the repo directory and `go build -o couchbasecapella-database-plugin ./cmd/couchbasecapella-database-plugin/`. To test `go test` will execute a set of basic tests against against the docker.io/couchbase/server-sandbox:6.5.0 couchbase database image. To test against different sandbox images, for example 5.5.1, set the `COUCHBASE_VERSION=5.5.1` environment variable. If you want to run the tests against a local couchbase installation or an already running couchbase container, set the environment variable `COUCHBASE_HOST` before executing. **Note** you will need to align the Administrator username, password and bucket_name with the pre-set values in the `couchbasecapella_test.go` file. Set VAULT_ACC to execute all of the tests. A subset of tests can be run using the command `go test -run TestDriver/Init` for example.
+
+## Installation
+
+The Vault plugin system is documented on the [Vault documentation site](https://www.vaultproject.io/docs/internals/plugins.html).
+
+You will need to define a plugin directory using the `plugin_directory` configuration directive, then place the
+`vault-plugin-database-couchbasecapella` executable generated above, into the directory.
+
+**Please note:** Versions v0.2.0 onwards of this plugin are incompatible with Vault versions before 1.6.0 due to an update of the database plugin interface.
+
+Sample commands for registering and starting to use the plugin:
+
+```bash
+$ SHA256=$(shasum -a 256 plugins/couchbasecapella-database-plugin | cut -d' ' -f1)
+
+$ vault secrets enable database
+
+$ vault write sys/plugins/catalog/database/couchbasecapella-database-plugin sha256=$SHA256 \
+        command=couchbasecapella-database-plugin
+```
+
+At this stage you are now ready to initialize the plugin to connect to couchbase capella cluster using unencrypted or encrypted communications.
+
+Prior to initializing the plugin, ensure that you have created an administration account. Vault will use the user specified here to create/update/revoke database credentials. That user must have the appropriate permissions to perform actions upon other database users.
+
+### Unencrypted plugin initialization
+
+```bash
+$ vault write database/config/insecure-couchbasecapella plugin_name="couchbasecapella-database-plugin" \
+        hosts="localhost" username="Administrator" password="password" \
+        bucket_name="travel-sample" \ # only needed for pre-6.5.0 clusters
+        allowed_roles="insecure-couchbasecapella-admin-role,insecure-couchbasecapella-*-bucket-role,static-account"
+
+# You should consider rotating the admin password. Note that if you do, the new password will never be made available
+# through Vault, so you should create a vault-specific database admin user for this.
+$ vault write -force database/rotate-root/insecure-couchbasecapella
+
+ ```
+
+Note: If you want to connect the plugin to a couchbase capella cluster prior to version 6.5.0 you will also have to supply an existing bucket (bucket_name="travel-sample") or the command will fail with the error message **"error verifying connection: error in Connection waiting for cluster: unambiguous timeout"**.
+
+### Encrypted plugin initialization
+
+The example here uses the self signed CA certificate that comes with the out of the box couchbase cluster installation and is not suitable for real production use where commercial grade certificates should be obtained.
+
+```bash
+$ BASE64PEM=$(curl -X GET http://Administrator:Admin123@127.0.0.1:8091/pools/default/certificate|base64 -w0)
+
+$ vault write database/config/secure-couchbasecapella plugin_name="couchbasecapella-database-plugin" \
+      hosts="couchbases://localhost" username="Administrator" password="password" \
+      tls=true base64pem=${BASE64PEM} \
+      bucket_name="travel-sample" \ # only needed for pre-6.5.0 clusters
+      allowed_roles="secure-couchbasecapella-admin-role,secure-couchbasecapella-*-bucket-role,static-account"
+
+# You should consider rotating the admin password. Note that if you do, the new password will never be made available
+# through Vault, so you should create a vault-specific database admin user for this.
+$ vault write -force database/rotate-root/secure-couchbasecapella
+```
+
+### Dynamic Role Creation
+
+When you create roles, you need to provide a JSON string containing the Couchbase RBAC roles which are documented [here](https://docs.couchbase.com/server/6.5/learn/security/roles.html). From Couchbase 6.5 groups are supported and the creation statement can contain just roles or just groups or a mixture of the two. **Note** to use a group, it must have been created in the database previously.
+
+```bash
+# if a creation_statement is not provided the user account will default to read only admin, '{"roles":[{"role":"ro_admin"}]}'
+$ vault write database/roles/insecure-couchbasecapella-admin-role db_name=insecure-couchbasecapella \
+        default_ttl="5m" max_ttl="1h" creation_statements='{"roles":[{"role":"admin"}],"groups":["Supervisor"]}'
+
+$ vault write database/roles/insecure-couchbasecapella-travel-sample-bucket-role db_name=insecure-couchbasecapella \
+        default_ttl="5m" max_ttl="1h" creation_statements='{"roles":[{"role":"bucket_full_access","bucket_name":"travel-sample"}]}'
+Success! Data written to: database/roles/insecure-couchbasecapella-travel-sample-bucket-role
+```
+
+If you create a role that uses groups on a pre 6.5 couchbase server it will be successful, but when you try to generate credentials
+you will receive the error **rpc error: code = Unknown desc = {"errors":{"groups":"Unsupported key"}} ...**
+
+To retrieve the credentials for the dynamic accounts
+
+```bash
+
+$ vault read database/creds/insecure-couchbasecapella-admin-role
+Key                Value
+---                -----
+lease_id           database/creds/insecure-couchbasecapella-admin-role/KJ7CTmpFni6U6BCDJ14HcmDm
+lease_duration     5m
+lease_renewable    true
+password           A1a-yCSH5rAh8QAkCzwu
+username           v-token-insecure-couchbasecapella-admin-role-yA2hgb0tfewf
+
+$ vault read database/creds/insecure-couchbasecapella-travel-sample-bucket-role
+Key                Value
+---                -----
+lease_id           database/creds/insecure-couchbasecapella-travel-sample-bucket-role/OzHdfkIZdeY9p8kjdWur512j
+lease_duration     5m
+lease_renewable    true
+password           A1a-0yTIuO4q0dCvphz1
+username           v-token-insecure-couchbasecapella-travel-sample-bucket-role-iN5
+
+```
+
+### Static Role Creation
+
+In order to use static roles, the user must already exist in the Couchbase Capella security settings. The example below assumes that there is an existing user with the name "vault-edu". If the user does not exist you will receive the following error.
+
+```bash
+* 1 error occurred:
+        * error setting credentials: rpc error: code = Unknown desc = user not found | {"unique_id":"74f229fd-b3b3-4036-9673-312adae094bb","endpoint":"http://localhost:8091"}
+```
+
+```bash
+$ vault write database/static-roles/static-account db_name=insecure-couchbasecapella \
+        username="vault-edu" rotation_period="5m"
+Success! Data written to: database/static-roles/static-account
+````
+
+To retrieve the credentials for the vault-edu user
+
+```bash
+$ vault read database/static-creds/static-account
+Key                    Value
+---                    -----
+last_vault_rotation    2020-06-15T14:32:16.682130141-05:00
+password               A1a-09ApRvglZY1Usdjp
+rotation_period        5m
+ttl                    30s
+username               vault-edu
+```
+
+## Developing
+
+You can run `make dev` in the root of the repo to start up a development vault server and automatically register a local build of the plugin. You will need to have a built `vault` binary available in your `$PATH` to do so.

README.md

@@ -0,0 +1,26 @@
+package main
+
+import (
+	"os"
+
+	hclog "github.com/hashicorp/go-hclog"
+	couchbase "github.com/hashicorp/vault-plugin-database-couchbase"
+	dbplugin "github.com/hashicorp/vault/sdk/database/dbplugin/v5"
+)
+
+func main() {
+	err := Run()
+	if err != nil {
+		logger := hclog.New(&hclog.LoggerOptions{})
+
+		logger.Error("plugin shutting down", "error", err)
+		os.Exit(1)
+	}
+}
+
+// Run instantiates a CouchbaseDB object, and runs the RPC server for the plugin
+func Run() error {
+	dbplugin.ServeMultiplex(couchbase.New)
+
+	return nil
+}

cmd/couchbasecapella-database-plugin/main.go

@@ -0,0 +1,184 @@
+package couchbasecapella
+
+import (
+	"context"
+	"crypto/x509"
+	"encoding/base64"
+	"fmt"
+	"strings"
+	"sync"
+
+	"github.com/couchbase/gocb/v2"
+	"github.com/hashicorp/errwrap"
+	"github.com/hashicorp/vault/sdk/database/helper/connutil"
+	"github.com/mitchellh/mapstructure"
+)
+
+type couchbaseCapellaDBConnectionProducer struct {
+	AccessKey   string `json:"access_key"`
+	SecretKey   string `json:"secret_key"`
+	ClusterID   string `json:"cluster_id"`
+	Hosts       string `json:"hosts"`
+	Username    string `json:"username"`
+	Password    string `json:"password"`
+	TLS         bool   `json:"tls"`
+	InsecureTLS bool   `json:"insecure_tls"`
+	Base64Pem   string `json:"base64pem"`
+	BucketName  string `json:"bucket_name"`
+
+	Initialized bool
+	rawConfig   map[string]interface{}
+	Type        string
+	cluster     *gocb.Cluster
+	sync.RWMutex
+}
+
+func (c *couchbaseCapellaDBConnectionProducer) secretValues() map[string]string {
+	return map[string]string{
+		c.Password: "[password]",
+		c.Username: "[username]",
+	}
+}
+
+func (c *couchbaseCapellaDBConnectionProducer) Init(ctx context.Context, initConfig map[string]interface{}, verifyConnection bool) (saveConfig map[string]interface{}, err error) {
+	// Don't let anyone read or write the config while we're using it
+	c.Lock()
+	defer c.Unlock()
+
+	c.rawConfig = initConfig
+
+	decoderConfig := &mapstructure.DecoderConfig{
+		Result:           c,
+		WeaklyTypedInput: true,
+		TagName:          "json",
+	}
+
+	decoder, err := mapstructure.NewDecoder(decoderConfig)
+	if err != nil {
+		return nil, err
+	}
+
+	err = decoder.Decode(initConfig)
+	if err != nil {
+		return nil, err
+	}
+
+	switch {
+	case len(c.Hosts) == 0:
+		return nil, fmt.Errorf("hosts cannot be empty")
+	case len(c.Username) == 0:
+		return nil, fmt.Errorf("username cannot be empty")
+	case len(c.Password) == 0:
+		return nil, fmt.Errorf("password cannot be empty")
+	}
+
+	if c.TLS {
+		if len(c.Base64Pem) == 0 {
+			return nil, fmt.Errorf("base64pem cannot be empty")
+		}
+
+		if !strings.HasPrefix(c.Hosts, "couchbases://") {
+			return nil, fmt.Errorf("hosts list must start with couchbases:// for TLS connection")
+		}
+	}
+
+	c.Initialized = true
+
+	if verifyConnection {
+		if _, err := c.Connection(ctx); err != nil {
+			c.close()
+			return nil, errwrap.Wrapf("error verifying connection: {{err}}", err)
+		}
+	}
+
+	return initConfig, nil
+}
+
+func (c *couchbaseCapellaDBConnectionProducer) Initialize(ctx context.Context, config map[string]interface{}, verifyConnection bool) error {
+	_, err := c.Init(ctx, config, verifyConnection)
+	return err
+}
+
+func (c *couchbaseCapellaDBConnectionProducer) Connection(ctx context.Context) (interface{}, error) {
+	// This is intentionally not grabbing the lock since the calling functions
+	// (e.g. CreateUser) are claiming it.
+
+	if !c.Initialized {
+		return nil, connutil.ErrNotInitialized
+	}
+
+	if c.cluster != nil {
+		return c.cluster, nil
+	}
+	var err error
+	var sec gocb.SecurityConfig
+	var pem []byte
+
+	if c.TLS {
+		pem, err = base64.StdEncoding.DecodeString(c.Base64Pem)
+		if err != nil {
+			return nil, errwrap.Wrapf("error decoding Base64Pem: {{err}}", err)
+		}
+		rootCAs := x509.NewCertPool()
+		ok := rootCAs.AppendCertsFromPEM([]byte(pem))
+		if !ok {
+			return nil, fmt.Errorf("failed to parse root certificate")
+		}
+		sec = gocb.SecurityConfig{
+			TLSRootCAs:    rootCAs,
+			TLSSkipVerify: c.InsecureTLS,
+		}
+	}
+
+	c.cluster, err = gocb.Connect(
+		c.Hosts,
+		gocb.ClusterOptions{
+			Username:       c.Username,
+			Password:       c.Password,
+			SecurityConfig: sec,
+		})
+	if err != nil {
+		return nil, errwrap.Wrapf("error in Connection: {{err}}", err)
+	}
+
+	// For databases 6.0 and earlier, we will need to open a `Bucket instance before connecting to any other
+	// HTTP services such as UserManager.
+
+	if c.BucketName != "" {
+		bucket := c.cluster.Bucket(c.BucketName)
+		// We wait until the bucket is definitely connected and setup.
+		err = bucket.WaitUntilReady(computeTimeout(ctx), nil)
+		if err != nil {
+			return nil, errwrap.Wrapf("error in Connection waiting for bucket: {{err}}", err)
+		}
+	} else {
+		err = c.cluster.WaitUntilReady(computeTimeout(ctx), nil)
+
+		if err != nil {
+			return nil, errwrap.Wrapf("error in Connection waiting for cluster: {{err}}", err)
+		}
+	}
+
+	return c.cluster, nil
+}
+
+// close terminates the database connection without locking
+func (c *couchbaseCapellaDBConnectionProducer) close() error {
+	if c.cluster != nil {
+		if err := c.cluster.Close(&gocb.ClusterCloseOptions{}); err != nil {
+			return err
+		}
+	}
+
+	c.cluster = nil
+	return nil
+}
+
+// Close terminates the database connection with locking
+func (c *couchbaseCapellaDBConnectionProducer) Close() error {
+	// Don't let anyone read or write the config while we're using it
+	c.Lock()
+	defer c.Unlock()
+
+	return c.close()
+}