Merge pull request #21 from maclennann/master
Cleaning up code. Rubocopping and documenting
This commit is contained in:
227
lib/zanzibar.rb
227
lib/zanzibar.rb
@@ -3,130 +3,65 @@ require 'savon'
|
|||||||
require 'io/console'
|
require 'io/console'
|
||||||
require 'fileutils'
|
require 'fileutils'
|
||||||
require 'yaml'
|
require 'yaml'
|
||||||
|
require 'zanzibar/client'
|
||||||
|
|
||||||
module Zanzibar
|
module Zanzibar
|
||||||
##
|
##
|
||||||
# Class for interacting with Secret Server
|
# High-level operations for downloading things from Secret Server
|
||||||
class Zanzibar
|
class Zanzibar
|
||||||
##
|
##
|
||||||
# @param args{:domain, :wsdl, :pwd, :username, :globals{}}
|
# @param args{:domain, :wsdl, :pwd, :username, :globals{}}
|
||||||
|
|
||||||
def initialize(args = {})
|
def initialize(args = {})
|
||||||
@@username = if args[:username]
|
@username = resolve_username(args)
|
||||||
args[:username]
|
@wsdl = resolve_wsdl(args)
|
||||||
elsif ENV['ZANZIBAR_USER']
|
@password = resolve_password(args)
|
||||||
ENV['ZANZIBAR_USER']
|
@domain = resolve_domain(args)
|
||||||
else
|
|
||||||
ENV['USER']
|
|
||||||
end
|
|
||||||
|
|
||||||
@@wsdl = if args[:wsdl]
|
|
||||||
args[:wsdl]
|
|
||||||
else
|
|
||||||
get_wsdl_location
|
|
||||||
end
|
|
||||||
|
|
||||||
@@password = if args[:pwd]
|
|
||||||
args[:pwd]
|
|
||||||
elsif ENV['ZANZIBAR_PASSWORD']
|
|
||||||
ENV['ZANZIBAR_PASSWORD']
|
|
||||||
else
|
|
||||||
prompt_for_password
|
|
||||||
end
|
|
||||||
|
|
||||||
@@domain = if args[:domain]
|
|
||||||
args[:domain]
|
|
||||||
else
|
|
||||||
prompt_for_domain
|
|
||||||
end
|
|
||||||
args[:globals] = {} unless args[:globals]
|
args[:globals] = {} unless args[:globals]
|
||||||
init_client(args[:globals])
|
@client = Client.new(@username, @password, @domain, @wsdl, args[:globals])
|
||||||
end
|
end
|
||||||
|
|
||||||
def get_client_username
|
##
|
||||||
@@username
|
# Gets the user's password if none is provided in the constructor.
|
||||||
end
|
|
||||||
|
|
||||||
def get_client_password
|
|
||||||
@@password
|
|
||||||
end
|
|
||||||
|
|
||||||
## Initializes the Savon client class variable with the wdsl document location and optional global variables
|
|
||||||
# @param globals{}, optional
|
|
||||||
|
|
||||||
def init_client(globals = {})
|
|
||||||
globals = {} if globals.nil?
|
|
||||||
@@client = Savon.client(globals) do
|
|
||||||
wsdl @@wsdl
|
|
||||||
end
|
|
||||||
end
|
|
||||||
|
|
||||||
## Gets the user's password if none is provided in the constructor.
|
|
||||||
# @return [String] the password for the current user
|
# @return [String] the password for the current user
|
||||||
|
|
||||||
def prompt_for_password
|
def prompt_for_password
|
||||||
puts "Please enter password for #{@@username}:"
|
puts "Please enter password for #{@username}:"
|
||||||
STDIN.noecho(&:gets).chomp.tap do
|
STDIN.noecho(&:gets).chomp.tap do
|
||||||
puts 'Using password to login...'
|
puts 'Using password to login...'
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
## Gets the wsdl document location if none is provided in the constructor
|
##
|
||||||
|
# Gets the wsdl document location if none is provided in the constructor
|
||||||
# @return [String] the location of the WDSL document
|
# @return [String] the location of the WDSL document
|
||||||
|
|
||||||
def prompt_for_wsdl_location
|
def prompt_for_wsdl_location
|
||||||
puts 'Enter the URL of the Secret Server WSDL:'
|
puts 'Enter the URL of the Secret Server WSDL:'
|
||||||
STDIN.gets.chomp
|
STDIN.gets.chomp
|
||||||
end
|
end
|
||||||
|
|
||||||
## Gets the domain of the Secret Server installation if none is provided in the constructor
|
##
|
||||||
|
# Gets the domain of the Secret Server installation if none is provided in the constructor
|
||||||
# @return [String] the domain of the secret server installation
|
# @return [String] the domain of the secret server installation
|
||||||
|
|
||||||
def prompt_for_domain
|
def prompt_for_domain
|
||||||
puts 'Enter the domain of your Secret Server:'
|
puts 'Enter the domain of your Secret Server:'
|
||||||
STDIN.gets.chomp
|
STDIN.gets.chomp
|
||||||
end
|
end
|
||||||
|
|
||||||
## Get an authentication token for interacting with Secret Server. These are only good for about 10 minutes so just get a new one each time.
|
##
|
||||||
# Will raise an error if there is an issue with the authentication.
|
# Retrieve the value from a field label of a secret
|
||||||
# @return the authentication token for the current user.
|
|
||||||
|
|
||||||
def get_token
|
|
||||||
response = @@client.call(:authenticate, message: { username: @@username, password: @@password, organization: '', domain: @@domain })
|
|
||||||
.hash[:envelope][:body][:authenticate_response][:authenticate_result]
|
|
||||||
raise "Error generating the authentication token for user #{@@username}: #{response[:errors][:string]}" if response[:errors]
|
|
||||||
response[:token]
|
|
||||||
rescue Savon::Error => err
|
|
||||||
raise "There was an error generating the authentiaton token for user #{@@username}: #{err}"
|
|
||||||
end
|
|
||||||
|
|
||||||
## Get a secret returned as a hash
|
|
||||||
# Will raise an error if there was an issue getting the secret
|
|
||||||
# @param [Integer] the secret id
|
|
||||||
# @return [Hash] the secret hash retrieved from the wsdl
|
|
||||||
|
|
||||||
def get_secret(scrt_id, token = nil)
|
|
||||||
secret = @@client.call(:get_secret, message: { token: token || get_token, secretId: scrt_id }).hash[:envelope][:body][:get_secret_response][:get_secret_result]
|
|
||||||
raise "There was an error getting secret #{scrt_id}: #{secret[:errors][:string]}" if secret[:errors]
|
|
||||||
return secret
|
|
||||||
rescue Savon::Error => err
|
|
||||||
raise "There was an error getting the secret with id #{scrt_id}: #{err}"
|
|
||||||
end
|
|
||||||
|
|
||||||
## Retrieve the value from a field label of a secret
|
|
||||||
# Will raise an error if there are any issues
|
# Will raise an error if there are any issues
|
||||||
# @param [Integer] the secret id
|
# @param [Integer] the secret id
|
||||||
# @param [String] the field label to get, defaults to Password
|
# @param [String] the field label to get, defaults to Password
|
||||||
# @return [String] the value for the given field label
|
# @return [String] the value for the given field label
|
||||||
def get_fieldlabel_value(scrt_id, fieldlabel = 'Password')
|
def get_fieldlabel_value(scrt_id, fieldlabel = 'Password')
|
||||||
secret = get_secret(scrt_id)
|
secret = @client.get_secret(scrt_id)
|
||||||
secret_items = secret[:secret][:items][:secret_item]
|
secret_items = secret[:secret][:items][:secret_item]
|
||||||
return get_secret_item_by_field_name(secret_items, fieldlabel)[:value]
|
return @client.get_secret_item_by_field_name(secret_items, fieldlabel)[:value]
|
||||||
rescue Savon::Error => err
|
rescue Savon::Error => err
|
||||||
raise "There was an error getting '#{fieldlabel}' for secret #{scrt_id}: #{err}"
|
raise "There was an error getting '#{fieldlabel}' for secret #{scrt_id}: #{err}"
|
||||||
end
|
end
|
||||||
|
|
||||||
## Retrieve a simple password from a secret
|
##
|
||||||
|
# Retrieve a simple password from a secret
|
||||||
# Calls get get_fieldlabel_value()
|
# Calls get get_fieldlabel_value()
|
||||||
# @param [Integer] the secret id
|
# @param [Integer] the secret id
|
||||||
# @return [String] the password for the given secret
|
# @return [String] the password for the given secret
|
||||||
@@ -134,22 +69,18 @@ module Zanzibar
|
|||||||
get_fieldlabel_value(scrt_id)
|
get_fieldlabel_value(scrt_id)
|
||||||
end
|
end
|
||||||
|
|
||||||
## Get the password, save it to a file, and return the path to the file.
|
##
|
||||||
|
# Get the password, save it to a file, and return the path to the file.
|
||||||
def get_username_and_password_and_save(scrt_id, path, name)
|
def get_username_and_password_and_save(scrt_id, path, name)
|
||||||
secret_items = get_secret(scrt_id)[:secret][:items][:secret_item]
|
secret_items = @client.get_secret(scrt_id)[:secret][:items][:secret_item]
|
||||||
password = get_secret_item_by_field_name(secret_items, 'Password')[:value]
|
password = @client.get_secret_item_by_field_name(secret_items, 'Password')[:value]
|
||||||
username = get_secret_item_by_field_name(secret_items, 'Username')[:value]
|
username = @client.get_secret_item_by_field_name(secret_items, 'Username')[:value]
|
||||||
save_username_and_password_to_file(password, username, path, name)
|
save_username_and_password_to_file(password, username, path, name)
|
||||||
File.join(path, name)
|
File.join(path, name)
|
||||||
end
|
end
|
||||||
|
|
||||||
def write_secret_to_file(path, secret_response)
|
##
|
||||||
File.open(File.join(path, secret_response[:file_name]), 'wb') do |file|
|
# Write the password to a file. Intended for use with a Zanzifile
|
||||||
file.puts Base64.decode64(secret_response[:file_attachment])
|
|
||||||
end
|
|
||||||
end
|
|
||||||
|
|
||||||
## Write the password to a file. Intended for use with a Zanzifile
|
|
||||||
def save_username_and_password_to_file(password, username, path, name)
|
def save_username_and_password_to_file(password, username, path, name)
|
||||||
user_pass = { 'username' => username.to_s, 'password' => password.to_s }.to_yaml
|
user_pass = { 'username' => username.to_s, 'password' => password.to_s }.to_yaml
|
||||||
File.open(File.join(path, name), 'wb') do |file|
|
File.open(File.join(path, name), 'wb') do |file|
|
||||||
@@ -157,62 +88,90 @@ module Zanzibar
|
|||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
def get_secret_item_by_field_name(secret_items, field_name)
|
##
|
||||||
secret_items.each do |item|
|
# Downloads a file for a secret and places it where Zanzibar is running, or :path if specified
|
||||||
return item if item[:field_name] == field_name
|
|
||||||
end
|
|
||||||
end
|
|
||||||
|
|
||||||
## Get the secret item id that relates to a key file or attachment.
|
|
||||||
# Will raise on error
|
|
||||||
# @param [Integer] the secret id
|
|
||||||
# @param [String] the type of secret item to get, one of privatekey, publickey, attachment
|
|
||||||
# @return [Integer] the secret item id
|
|
||||||
|
|
||||||
def get_scrt_item_id(scrt_id, type, token)
|
|
||||||
secret = get_secret(scrt_id, token)
|
|
||||||
secret_items = secret[:secret][:items][:secret_item]
|
|
||||||
begin
|
|
||||||
return get_secret_item_by_field_name(secret_items, type)[:id]
|
|
||||||
rescue
|
|
||||||
raise "Unknown type, #{type}."
|
|
||||||
end
|
|
||||||
end
|
|
||||||
|
|
||||||
## Downloads a file for a secret and places it where Zanzibar is running, or :path if specified
|
|
||||||
# Raise on error
|
# Raise on error
|
||||||
# @param [Hash] args, :scrt_id, :type (one of "Private Key", "Public Key", "Attachment"), :scrt_item_id - optional, :path - optional
|
# @param [Hash] args, :scrt_id, :type (one of "Private Key", "Public Key", "Attachment"), :scrt_item_id - optional, :path - optional
|
||||||
|
|
||||||
def download_secret_file(args = {})
|
def download_secret_file(args = {})
|
||||||
token = get_token
|
response = @client.download_file_attachment_by_item_id(args[:scrt_id], args[:scrt_item_id], args[:type])
|
||||||
FileUtils.mkdir_p(args[:path]) if args[:path]
|
raise "There was an error getting the #{args[:type]} for secret #{args[:scrt_id]}: #{response[:errors][:string]}" if response[:errors]
|
||||||
path = args[:path] ? args[:path] : '.' ## The File.join below doesn't handle nils well, so let's take that possibility away.
|
return write_secret_to_file(args[:path], response)
|
||||||
begin
|
rescue Savon::Error => err
|
||||||
response = @@client.call(:download_file_attachment_by_item_id, message:
|
raise "There was an error getting the #{args[:type]} for secret #{args[:scrt_id]}: #{err}"
|
||||||
{ token: token, secretId: args[:scrt_id], secretItemId: args[:scrt_item_id] || get_scrt_item_id(args[:scrt_id], args[:type], token) })
|
|
||||||
.hash[:envelope][:body][:download_file_attachment_by_item_id_response][:download_file_attachment_by_item_id_result]
|
|
||||||
raise "There was an error getting the #{args[:type]} for secret #{args[:scrt_id]}: #{response[:errors][:string]}" if response[:errors]
|
|
||||||
write_secret_to_file(path, response)
|
|
||||||
return File.join(path, response[:file_name])
|
|
||||||
rescue Savon::Error => err
|
|
||||||
raise "There was an error getting the #{args[:type]} for secret #{args[:scrt_id]}: #{err}"
|
|
||||||
end
|
|
||||||
end
|
end
|
||||||
|
|
||||||
## Methods to maintain backwards compatibility
|
##
|
||||||
|
# Download a private key secret
|
||||||
|
# @deprecated
|
||||||
def download_private_key(args = {})
|
def download_private_key(args = {})
|
||||||
args[:type] = 'Private Key'
|
args[:type] = 'Private Key'
|
||||||
download_secret_file(args)
|
download_secret_file(args)
|
||||||
end
|
end
|
||||||
|
|
||||||
|
##
|
||||||
|
# Download a public key secret
|
||||||
|
# @deprecated
|
||||||
def download_public_key(args = {})
|
def download_public_key(args = {})
|
||||||
args[:type] = 'Public Key'
|
args[:type] = 'Public Key'
|
||||||
download_secret_file(args)
|
download_secret_file(args)
|
||||||
end
|
end
|
||||||
|
|
||||||
|
##
|
||||||
|
# Download an arbitrary secret attachment
|
||||||
|
# @deprecated
|
||||||
def download_attachment(args = {})
|
def download_attachment(args = {})
|
||||||
args[:type] = 'Attachment'
|
args[:type] = 'Attachment'
|
||||||
download_secret_file(args)
|
download_secret_file(args)
|
||||||
end
|
end
|
||||||
|
|
||||||
|
private
|
||||||
|
|
||||||
|
def make_or_find_path(path = nil)
|
||||||
|
FileUtils.mkdir_p(path) if path
|
||||||
|
path || '.'
|
||||||
|
end
|
||||||
|
|
||||||
|
def resolve_username(args = {})
|
||||||
|
if args[:username]
|
||||||
|
args[:username]
|
||||||
|
elsif ENV['ZANZIBAR_USER']
|
||||||
|
ENV['ZANZIBAR_USER']
|
||||||
|
else
|
||||||
|
ENV['USER']
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
def resolve_wsdl(args = {})
|
||||||
|
args[:wsdl]
|
||||||
|
end
|
||||||
|
|
||||||
|
def resolve_password(args = {})
|
||||||
|
if args[:pwd]
|
||||||
|
args[:pwd]
|
||||||
|
elsif ENV['ZANZIBAR_PASSWORD']
|
||||||
|
ENV['ZANZIBAR_PASSWORD']
|
||||||
|
else
|
||||||
|
prompt_for_password
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
def resolve_domain(args = {})
|
||||||
|
if args[:domain]
|
||||||
|
args[:domain]
|
||||||
|
else
|
||||||
|
prompt_for_domain
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
def write_secret_to_file(path, secret_response)
|
||||||
|
path = make_or_find_path(path)
|
||||||
|
filepath = File.join(path, secret_response[:file_name])
|
||||||
|
|
||||||
|
File.open(filepath, 'wb') do |file|
|
||||||
|
file.puts Base64.decode64(secret_response[:file_attachment])
|
||||||
|
end
|
||||||
|
|
||||||
|
filepath
|
||||||
|
end
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|||||||
@@ -2,12 +2,18 @@ module Zanzibar
|
|||||||
module Actions
|
module Actions
|
||||||
# Basic plumbing for all actions
|
# Basic plumbing for all actions
|
||||||
class Base
|
class Base
|
||||||
|
##
|
||||||
|
# The options passed in from the Thor action
|
||||||
attr_accessor :options
|
attr_accessor :options
|
||||||
private :options=
|
private :options=
|
||||||
|
|
||||||
|
##
|
||||||
|
# The logger that Thor is using for this run
|
||||||
attr_accessor :logger
|
attr_accessor :logger
|
||||||
private :logger=
|
private :logger=
|
||||||
|
|
||||||
|
##
|
||||||
|
# Initialize the basic components used by all actions
|
||||||
def initialize(logger, options = {})
|
def initialize(logger, options = {})
|
||||||
self.logger = logger
|
self.logger = logger
|
||||||
self.options = options
|
self.options = options
|
||||||
|
|||||||
@@ -6,17 +6,35 @@ module Zanzibar
|
|||||||
module Actions
|
module Actions
|
||||||
# Download or verify the secrets in a Zanzifile
|
# Download or verify the secrets in a Zanzifile
|
||||||
class Bundle < Base
|
class Bundle < Base
|
||||||
|
##
|
||||||
|
# The settings defined in the Zanzifile
|
||||||
attr_accessor :settings
|
attr_accessor :settings
|
||||||
|
|
||||||
|
##
|
||||||
|
# The unresolved secrets from the Zanzifile
|
||||||
attr_accessor :remote_secrets
|
attr_accessor :remote_secrets
|
||||||
|
|
||||||
|
##
|
||||||
|
# The resolved secrets from the Zanzifile.resolved
|
||||||
attr_accessor :local_secrets
|
attr_accessor :local_secrets
|
||||||
|
|
||||||
|
##
|
||||||
|
# Whether to disregard local secrets and re-download regardness
|
||||||
attr_accessor :update
|
attr_accessor :update
|
||||||
|
|
||||||
|
##
|
||||||
|
# Our Zanzibar client
|
||||||
attr_accessor :zanzibar
|
attr_accessor :zanzibar
|
||||||
|
|
||||||
|
##
|
||||||
|
# An action that will fetch secrets defined in a Zanzifile
|
||||||
def initialize(ui, options, args = {})
|
def initialize(ui, options, args = {})
|
||||||
super(ui, options)
|
super(ui, options)
|
||||||
@update = args[:update]
|
@update = args[:update]
|
||||||
end
|
end
|
||||||
|
|
||||||
|
##
|
||||||
|
# Coordinate downloading to secrets (or skipping ones we already have)
|
||||||
def run
|
def run
|
||||||
ensure_zanzifile
|
ensure_zanzifile
|
||||||
load_required_secrets
|
load_required_secrets
|
||||||
@@ -95,11 +113,8 @@ module Zanzibar
|
|||||||
downloaded_secrets = {}
|
downloaded_secrets = {}
|
||||||
remote_secrets.each do |key, secret|
|
remote_secrets.each do |key, secret|
|
||||||
full_path = secret.key?('prefix') ? File.join(@settings['secret_dir'], secret['prefix']) : @settings['secret_dir']
|
full_path = secret.key?('prefix') ? File.join(@settings['secret_dir'], secret['prefix']) : @settings['secret_dir']
|
||||||
downloaded_secrets[key] = download_one_secret(secret['id'],
|
downloaded_secrets[key] = download_one_secret(secret['id'], secret['label'], full_path,
|
||||||
secret['label'],
|
args, secret_filename(secret))
|
||||||
full_path,
|
|
||||||
args,
|
|
||||||
secret['name'] || "#{secret['id']}_password")
|
|
||||||
|
|
||||||
debug { "Downloaded secret: #{key} to #{@settings['secret_dir']}..." }
|
debug { "Downloaded secret: #{key} to #{@settings['secret_dir']}..." }
|
||||||
end
|
end
|
||||||
@@ -134,6 +149,10 @@ module Zanzibar
|
|||||||
domain: @settings['domain'],
|
domain: @settings['domain'],
|
||||||
globals: args)
|
globals: args)
|
||||||
end
|
end
|
||||||
|
|
||||||
|
def secret_filename(secret)
|
||||||
|
secret['name'] || "#{secret['id']}_password"
|
||||||
|
end
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|||||||
@@ -7,15 +7,24 @@ module Zanzibar
|
|||||||
module Actions
|
module Actions
|
||||||
# Fetch a single secret
|
# Fetch a single secret
|
||||||
class Get < Base
|
class Get < Base
|
||||||
|
##
|
||||||
|
# The options to use when initializing our Zanzibar client
|
||||||
attr_accessor :zanibar_options
|
attr_accessor :zanibar_options
|
||||||
|
|
||||||
|
##
|
||||||
|
# The id of the secret to download
|
||||||
attr_accessor :scrt_id
|
attr_accessor :scrt_id
|
||||||
|
|
||||||
|
##
|
||||||
|
# Initialize the action
|
||||||
def initialize(ui, options, scrt_id)
|
def initialize(ui, options, scrt_id)
|
||||||
super(ui, options)
|
super(ui, options)
|
||||||
@scrt_id = scrt_id
|
@scrt_id = scrt_id
|
||||||
@zanzibar_options = {}
|
@zanzibar_options = {}
|
||||||
end
|
end
|
||||||
|
|
||||||
|
##
|
||||||
|
# Ensure we have the options we need and download the secret
|
||||||
def run
|
def run
|
||||||
construct_options
|
construct_options
|
||||||
ensure_options
|
ensure_options
|
||||||
@@ -23,6 +32,8 @@ module Zanzibar
|
|||||||
fetch_secret(@scrt_id)
|
fetch_secret(@scrt_id)
|
||||||
end
|
end
|
||||||
|
|
||||||
|
##
|
||||||
|
# Actually download the secret
|
||||||
def fetch_secret(scrt_id)
|
def fetch_secret(scrt_id)
|
||||||
scrt = ::Zanzibar::Zanzibar.new(@zanzibar_options)
|
scrt = ::Zanzibar::Zanzibar.new(@zanzibar_options)
|
||||||
|
|
||||||
@@ -34,6 +45,8 @@ module Zanzibar
|
|||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
|
##
|
||||||
|
# Coalesce our options and some defaults to ensure we are ready to run
|
||||||
def construct_options
|
def construct_options
|
||||||
@zanzibar_options[:wsdl] = construct_wsdl
|
@zanzibar_options[:wsdl] = construct_wsdl
|
||||||
@zanzibar_options[:globals] = { ssl_verify_mode: :none } if options['ignoressl']
|
@zanzibar_options[:globals] = { ssl_verify_mode: :none } if options['ignoressl']
|
||||||
@@ -44,6 +57,8 @@ module Zanzibar
|
|||||||
@zanzibar_options[:filelabel] = options['filelabel'] if options['filelabel']
|
@zanzibar_options[:filelabel] = options['filelabel'] if options['filelabel']
|
||||||
end
|
end
|
||||||
|
|
||||||
|
##
|
||||||
|
# Construct a WSDL URL from the server hostname if necessary
|
||||||
def construct_wsdl
|
def construct_wsdl
|
||||||
if options['wsdl'].nil? && options['server']
|
if options['wsdl'].nil? && options['server']
|
||||||
DEFAULT_WSDL % options['server']
|
DEFAULT_WSDL % options['server']
|
||||||
@@ -52,6 +67,8 @@ module Zanzibar
|
|||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
|
##
|
||||||
|
# Make sure a proper WSDL was constructed
|
||||||
def ensure_options
|
def ensure_options
|
||||||
return if @zanzibar_options[:wsdl]
|
return if @zanzibar_options[:wsdl]
|
||||||
raise Error, NO_WSDL_ERROR
|
raise Error, NO_WSDL_ERROR
|
||||||
|
|||||||
@@ -8,6 +8,8 @@ module Zanzibar
|
|||||||
module Actions
|
module Actions
|
||||||
# Create a new Zanzifile
|
# Create a new Zanzifile
|
||||||
class Init < Base
|
class Init < Base
|
||||||
|
##
|
||||||
|
# Make sure we don't already have a Zanzifile, then template one
|
||||||
def run
|
def run
|
||||||
check_for_zanzifile
|
check_for_zanzifile
|
||||||
write_template
|
write_template
|
||||||
@@ -28,9 +30,12 @@ module Zanzibar
|
|||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
|
##
|
||||||
# Allows us to easily feed our options hash
|
# Allows us to easily feed our options hash
|
||||||
# to an ERB
|
# to an ERB
|
||||||
class TemplateRenderer < OpenStruct
|
class TemplateRenderer < OpenStruct
|
||||||
|
##
|
||||||
|
# Render an ERB template to a string
|
||||||
def render(template)
|
def render(template)
|
||||||
ERB.new(template).result(binding)
|
ERB.new(template).result(binding)
|
||||||
end
|
end
|
||||||
|
|||||||
@@ -8,12 +8,20 @@ require 'zanzibar/error'
|
|||||||
require 'zanzibar/defaults'
|
require 'zanzibar/defaults'
|
||||||
|
|
||||||
module Zanzibar
|
module Zanzibar
|
||||||
# The `zanzibar` binay/thor application main class
|
|
||||||
|
##
|
||||||
|
# The `zanzibar` binary/thor application main class.
|
||||||
|
# See http://whatisthor.com/ for information on syntax.
|
||||||
|
|
||||||
class Cli < Thor
|
class Cli < Thor
|
||||||
include Thor::Actions
|
include Thor::Actions
|
||||||
|
|
||||||
|
##
|
||||||
|
# The stream to which we are writing messages (usually stdout)
|
||||||
attr_accessor :ui
|
attr_accessor :ui
|
||||||
|
|
||||||
|
##
|
||||||
|
# Initialize the application and set some logging defaults
|
||||||
def initialize(*)
|
def initialize(*)
|
||||||
super
|
super
|
||||||
the_shell = (options['no-color'] ? Thor::Shell::Basic.new : shell)
|
the_shell = (options['no-color'] ? Thor::Shell::Basic.new : shell)
|
||||||
@@ -24,11 +32,15 @@ module Zanzibar
|
|||||||
debug_header
|
debug_header
|
||||||
end
|
end
|
||||||
|
|
||||||
|
##
|
||||||
|
# Print the version of the application
|
||||||
desc 'version', 'Display your Zanzibar verion'
|
desc 'version', 'Display your Zanzibar verion'
|
||||||
def version
|
def version
|
||||||
say "#{APPLICATION_NAME} Version: #{VERSION}"
|
say "#{APPLICATION_NAME} Version: #{VERSION}"
|
||||||
end
|
end
|
||||||
|
|
||||||
|
##
|
||||||
|
# Generate a new blank Zanzifile
|
||||||
desc 'init', "Create an empty #{ZANZIFILE_NAME} in the current directory."
|
desc 'init', "Create an empty #{ZANZIFILE_NAME} in the current directory."
|
||||||
option 'verbose', type: :boolean, default: false, aliases: :v
|
option 'verbose', type: :boolean, default: false, aliases: :v
|
||||||
option 'wsdl', type: :string, aliases: :w,
|
option 'wsdl', type: :string, aliases: :w,
|
||||||
@@ -46,8 +58,12 @@ module Zanzibar
|
|||||||
run_action { init! }
|
run_action { init! }
|
||||||
end
|
end
|
||||||
|
|
||||||
|
##
|
||||||
|
# Fetch secrets declared in a local Zanzifle
|
||||||
|
|
||||||
desc 'bundle', "Fetch secrets declared in your #{ZANZIFILE_NAME}"
|
desc 'bundle', "Fetch secrets declared in your #{ZANZIFILE_NAME}"
|
||||||
option 'verbose', type: :boolean, default: false, aliases: :v
|
option 'verbose', type: :boolean, default: false, aliases: :v
|
||||||
|
|
||||||
def bundle
|
def bundle
|
||||||
run_action { bundle! }
|
run_action { bundle! }
|
||||||
end
|
end
|
||||||
@@ -59,8 +75,12 @@ module Zanzibar
|
|||||||
desc 'install', "Alias to `#{APPLICATION_NAME} bundle`"
|
desc 'install', "Alias to `#{APPLICATION_NAME} bundle`"
|
||||||
alias install bundle
|
alias install bundle
|
||||||
|
|
||||||
|
##
|
||||||
|
# Redownload Zazifile secrets
|
||||||
|
|
||||||
desc 'update', "Redownload all secrets in your #{ZANZIFILE_NAME}"
|
desc 'update', "Redownload all secrets in your #{ZANZIFILE_NAME}"
|
||||||
option 'verbose', type: :boolean, default: false, aliases: :v
|
option 'verbose', type: :boolean, default: false, aliases: :v
|
||||||
|
|
||||||
def update
|
def update
|
||||||
run_action { update! }
|
run_action { update! }
|
||||||
end
|
end
|
||||||
@@ -80,6 +100,8 @@ module Zanzibar
|
|||||||
desc: 'Specify a field (by label) to get'
|
desc: 'Specify a field (by label) to get'
|
||||||
option 'username', type: :string, aliases: :u
|
option 'username', type: :string, aliases: :u
|
||||||
option 'password', type: :string, aliases: :p
|
option 'password', type: :string, aliases: :p
|
||||||
|
##
|
||||||
|
# Fetch a single secret specified on the commandline
|
||||||
def get(scrt_id)
|
def get(scrt_id)
|
||||||
run_action { get! scrt_id }
|
run_action { get! scrt_id }
|
||||||
end
|
end
|
||||||
@@ -93,6 +115,7 @@ module Zanzibar
|
|||||||
@ui.debug { "#{APPLICATION_NAME} Version: #{VERSION}" }
|
@ui.debug { "#{APPLICATION_NAME} Version: #{VERSION}" }
|
||||||
end
|
end
|
||||||
|
|
||||||
|
##
|
||||||
# Run the specified action and rescue errors we
|
# Run the specified action and rescue errors we
|
||||||
# explicitly send back to format them
|
# explicitly send back to format them
|
||||||
def run_action(&_block)
|
def run_action(&_block)
|
||||||
|
|||||||
92
lib/zanzibar/client.rb
Normal file
92
lib/zanzibar/client.rb
Normal file
@@ -0,0 +1,92 @@
|
|||||||
|
require 'zanzibar/version'
|
||||||
|
require 'savon'
|
||||||
|
require 'io/console'
|
||||||
|
require 'fileutils'
|
||||||
|
require 'yaml'
|
||||||
|
|
||||||
|
module Zanzibar
|
||||||
|
##
|
||||||
|
# Class for performing low-level WSDL actions against Secret Server
|
||||||
|
class Client
|
||||||
|
|
||||||
|
##
|
||||||
|
# Initializes the Savon client class variable with the wdsl document location and optional global variables
|
||||||
|
# @param globals{}, optional
|
||||||
|
def initialize(username, password, domain, wsdl, globals = {})
|
||||||
|
@username = username
|
||||||
|
@password = password
|
||||||
|
@domain = domain
|
||||||
|
|
||||||
|
globals = {} if globals.nil?
|
||||||
|
|
||||||
|
wsdl_loc = wsdl
|
||||||
|
@client = Savon.client(globals) do
|
||||||
|
wsdl wsdl_loc
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
##
|
||||||
|
# Get an authentication token for interacting with Secret Server. These are only good for about 10 minutes so just get a new one each time.
|
||||||
|
# Will raise an error if there is an issue with the authentication.
|
||||||
|
# @return the authentication token for the current user.
|
||||||
|
def generate_token
|
||||||
|
response = @client.call(:authenticate, message: { username: @username, password: @password, organization: '', domain: @domain })
|
||||||
|
.hash[:envelope][:body][:authenticate_response][:authenticate_result]
|
||||||
|
raise "Error generating the authentication token for user #{@username}: #{response[:errors][:string]}" if response[:errors]
|
||||||
|
response[:token]
|
||||||
|
rescue Savon::Error => err
|
||||||
|
raise "There was an error generating the authentiaton token for user #{@username}: #{err}"
|
||||||
|
end
|
||||||
|
|
||||||
|
##
|
||||||
|
# Get a secret returned as a hash
|
||||||
|
# Will raise an error if there was an issue getting the secret
|
||||||
|
# @param [Integer] the secret id
|
||||||
|
# @return [Hash] the secret hash retrieved from the wsdl
|
||||||
|
def get_secret(scrt_id, token = nil)
|
||||||
|
secret = @client.call(:get_secret, message: { token: token || generate_token, secretId: scrt_id }).hash[:envelope][:body][:get_secret_response][:get_secret_result]
|
||||||
|
raise "There was an error getting secret #{scrt_id}: #{secret[:errors][:string]}" if secret[:errors]
|
||||||
|
return secret
|
||||||
|
rescue Savon::Error => err
|
||||||
|
raise "There was an error getting the secret with id #{scrt_id}: #{err}"
|
||||||
|
end
|
||||||
|
|
||||||
|
##
|
||||||
|
# Get the secret item id that relates to a key file or attachment.
|
||||||
|
# Will raise on error
|
||||||
|
# @param [Integer] the secret id
|
||||||
|
# @param [String] the type of secret item to get, one of privatekey, publickey, attachment
|
||||||
|
# @return [Integer] the secret item id
|
||||||
|
def get_scrt_item_id(scrt_id, type, token)
|
||||||
|
secret = get_secret(scrt_id, token)
|
||||||
|
secret_items = secret[:secret][:items][:secret_item]
|
||||||
|
begin
|
||||||
|
return get_secret_item_by_field_name(secret_items, type)[:id]
|
||||||
|
rescue => e
|
||||||
|
|
||||||
|
raise "Unknown type, #{type}. #{e}"
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
##
|
||||||
|
# Get an "Attachment"-type file from a secret
|
||||||
|
# @param [Integer] the id of the secret
|
||||||
|
# @param [Integer] the id of the attachment on the secret
|
||||||
|
# @param [String] the type of the item being downloaded
|
||||||
|
# @return [Hash] contents and metadata of the downloaded file
|
||||||
|
def download_file_attachment_by_item_id(scrt_id, secret_item_id, item_type, token = nil)
|
||||||
|
token = generate_token unless token
|
||||||
|
@client.call(:download_file_attachment_by_item_id, message:
|
||||||
|
{ token: token, secretId: scrt_id, secretItemId: secret_item_id || get_scrt_item_id(scrt_id, item_type, token) })
|
||||||
|
.hash[:envelope][:body][:download_file_attachment_by_item_id_response][:download_file_attachment_by_item_id_result]
|
||||||
|
end
|
||||||
|
|
||||||
|
##
|
||||||
|
# Extract an item from a secret based on field name
|
||||||
|
def get_secret_item_by_field_name(secret_items, field_name)
|
||||||
|
secret_items.each do |item|
|
||||||
|
return item if item[:field_name] == field_name
|
||||||
|
end
|
||||||
|
end
|
||||||
|
end
|
||||||
|
end
|
||||||
@@ -2,15 +2,25 @@ require 'pathname'
|
|||||||
|
|
||||||
# Definitions for various strings used throughout the gem
|
# Definitions for various strings used throughout the gem
|
||||||
module Zanzibar
|
module Zanzibar
|
||||||
|
# The name of the binstub that invoked this code
|
||||||
APPLICATION_NAME = Pathname.new($PROGRAM_NAME).basename
|
APPLICATION_NAME = Pathname.new($PROGRAM_NAME).basename
|
||||||
|
# The filename of the Zanzifile
|
||||||
ZANZIFILE_NAME = 'Zanzifile'.freeze
|
ZANZIFILE_NAME = 'Zanzifile'.freeze
|
||||||
|
# The filename of the resolved Zanzifile
|
||||||
RESOLVED_NAME = 'Zanzifile.resolved'.freeze
|
RESOLVED_NAME = 'Zanzifile.resolved'.freeze
|
||||||
|
# The template to use when writing the Zanzifile
|
||||||
TEMPLATE_NAME = 'templates/Zanzifile.erb'.freeze
|
TEMPLATE_NAME = 'templates/Zanzifile.erb'.freeze
|
||||||
|
# The default value of the server when writing the Zanzifile
|
||||||
DEFAULT_SERVER = 'secret.example.com'.freeze
|
DEFAULT_SERVER = 'secret.example.com'.freeze
|
||||||
|
# The default WSDL location for the Zanzifile template
|
||||||
DEFAULT_WSDL = 'https://%s/webservices/sswebservice.asmx?wsdl'.freeze
|
DEFAULT_WSDL = 'https://%s/webservices/sswebservice.asmx?wsdl'.freeze
|
||||||
|
|
||||||
|
# Error thrown when trying to overwrite an existing Zanzifile
|
||||||
ALREADY_EXISTS_ERROR = "#{ZANZIFILE_NAME} already exists! Aborting...".freeze
|
ALREADY_EXISTS_ERROR = "#{ZANZIFILE_NAME} already exists! Aborting...".freeze
|
||||||
|
# Error thrown when unable to construct the WSDL location
|
||||||
NO_WSDL_ERROR = 'Could not construct WSDL URL. Please provide either --server or --wsdl'.freeze
|
NO_WSDL_ERROR = 'Could not construct WSDL URL. Please provide either --server or --wsdl'.freeze
|
||||||
|
# Error thrown when trying to download secrets from a Zanzifile that doesn't exist
|
||||||
NO_ZANZIFILE_ERROR = "You don't have a #{ZANZIFILE_NAME}! Run `#{APPLICATION_NAME} init` first!".freeze
|
NO_ZANZIFILE_ERROR = "You don't have a #{ZANZIFILE_NAME}! Run `#{APPLICATION_NAME} init` first!".freeze
|
||||||
|
# Error thrown when a Zanzifile is missing necessary information
|
||||||
INVALID_ZANZIFILE_ERROR = "Unable to load your #{ZANZIFILE_NAME}. Please ensure it is valid YAML.".freeze
|
INVALID_ZANZIFILE_ERROR = "Unable to load your #{ZANZIFILE_NAME}. Please ensure it is valid YAML.".freeze
|
||||||
end
|
end
|
||||||
|
|||||||
@@ -1,40 +1,59 @@
|
|||||||
require 'rubygems/user_interaction'
|
require 'rubygems/user_interaction'
|
||||||
|
|
||||||
module Zanzibar
|
module Zanzibar
|
||||||
|
##
|
||||||
# Prints messages out to stdout
|
# Prints messages out to stdout
|
||||||
class Shell
|
class Shell
|
||||||
|
##
|
||||||
|
# The stream to write log messages (usually stdout)
|
||||||
attr_writer :shell
|
attr_writer :shell
|
||||||
|
|
||||||
|
##
|
||||||
|
# Logging options and initializing stream
|
||||||
def initialize(shell)
|
def initialize(shell)
|
||||||
@shell = shell
|
@shell = shell
|
||||||
@quiet = false
|
@quiet = false
|
||||||
@debug = ENV['DEBUG']
|
@debug = ENV['DEBUG']
|
||||||
end
|
end
|
||||||
|
|
||||||
|
##
|
||||||
|
# Write a debug message if debug is enabled
|
||||||
def debug(message = nil)
|
def debug(message = nil)
|
||||||
@shell.say(message || yield) if @debug && !@quiet
|
@shell.say(message || yield) if @debug && !@quiet
|
||||||
end
|
end
|
||||||
|
|
||||||
|
##
|
||||||
|
# Write an info message unless we have silenced output
|
||||||
def info(message = nil)
|
def info(message = nil)
|
||||||
@shell.say(message || yield) unless @quiet
|
@shell.say(message || yield) unless @quiet
|
||||||
end
|
end
|
||||||
|
|
||||||
|
##
|
||||||
|
# Ask the user for confirmation unless we have silenced output
|
||||||
def confirm(message = nil)
|
def confirm(message = nil)
|
||||||
@shell.say(message || yield, :green) unless @quiet
|
@shell.say(message || yield, :green) unless @quiet
|
||||||
end
|
end
|
||||||
|
|
||||||
|
##
|
||||||
|
# Print a warning
|
||||||
def warn(message = nil)
|
def warn(message = nil)
|
||||||
@shell.say(message || yield, :yellow)
|
@shell.say(message || yield, :yellow)
|
||||||
end
|
end
|
||||||
|
|
||||||
|
##
|
||||||
|
# Print an error
|
||||||
def error(message = nil)
|
def error(message = nil)
|
||||||
@shell.say(message || yield, :red)
|
@shell.say(message || yield, :red)
|
||||||
end
|
end
|
||||||
|
|
||||||
|
##
|
||||||
|
# Enable silent mode
|
||||||
def be_quiet!
|
def be_quiet!
|
||||||
@quiet = true
|
@quiet = true
|
||||||
end
|
end
|
||||||
|
|
||||||
|
##
|
||||||
|
# Enable debug mode
|
||||||
def debug!
|
def debug!
|
||||||
@debug = true
|
@debug = true
|
||||||
end
|
end
|
||||||
|
|||||||
@@ -1,4 +1,5 @@
|
|||||||
# The version of the gem
|
# The version of the gem
|
||||||
module Zanzibar
|
module Zanzibar
|
||||||
|
# The Version of the application
|
||||||
VERSION = '0.2.0'.freeze
|
VERSION = '0.2.0'.freeze
|
||||||
end
|
end
|
||||||
|
|||||||
@@ -13,7 +13,7 @@ describe 'Zanzibar Test' do
|
|||||||
stub_request(:any, 'https://www.zanzitest.net/webservices/sswebservice.asmx')
|
stub_request(:any, 'https://www.zanzitest.net/webservices/sswebservice.asmx')
|
||||||
.to_return(body: AUTH_XML, status: 200)
|
.to_return(body: AUTH_XML, status: 200)
|
||||||
|
|
||||||
expect(client.get_token).to eq('imatoken')
|
expect(client.instance_variable_get(:@client).generate_token).to eq('imatoken')
|
||||||
end
|
end
|
||||||
|
|
||||||
it 'should get a secret' do
|
it 'should get a secret' do
|
||||||
@@ -21,7 +21,7 @@ describe 'Zanzibar Test' do
|
|||||||
.to_return(body: AUTH_XML, status: 200).then
|
.to_return(body: AUTH_XML, status: 200).then
|
||||||
.to_return(body: SECRET_XML, status: 200)
|
.to_return(body: SECRET_XML, status: 200)
|
||||||
|
|
||||||
expect(client.get_secret(1234)[:secret][:name]).to eq('Zanzi Test Secret')
|
expect(client.instance_variable_get(:@client).get_secret(1234)[:secret][:name]).to eq('Zanzi Test Secret')
|
||||||
end
|
end
|
||||||
|
|
||||||
it 'should get a password' do
|
it 'should get a password' do
|
||||||
@@ -119,8 +119,8 @@ describe 'Zanzibar Test' do
|
|||||||
ENV['ZANZIBAR_USER'] = 'environment_user'
|
ENV['ZANZIBAR_USER'] = 'environment_user'
|
||||||
ENV['ZANZIBAR_PASSWORD'] = 'environment_password'
|
ENV['ZANZIBAR_PASSWORD'] = 'environment_password'
|
||||||
client = Zanzibar::Zanzibar.new(domain: 'zanzitest.net', wsdl: 'spec/scrt.wsdl')
|
client = Zanzibar::Zanzibar.new(domain: 'zanzitest.net', wsdl: 'spec/scrt.wsdl')
|
||||||
expect(client.get_client_username).to eq(ENV['ZANZIBAR_USER'])
|
expect(client.instance_variable_get(:@username)).to eq(ENV['ZANZIBAR_USER'])
|
||||||
expect(client.get_client_password).to eq(ENV['ZANZIBAR_PASSWORD'])
|
expect(client.instance_variable_get(:@password)).to eq(ENV['ZANZIBAR_PASSWORD'])
|
||||||
ENV.delete 'ZANZIBAR_PASSWORD'
|
ENV.delete 'ZANZIBAR_PASSWORD'
|
||||||
ENV.delete 'ZANZIBAR_USER'
|
ENV.delete 'ZANZIBAR_USER'
|
||||||
end
|
end
|
||||||
|
|||||||
Reference in New Issue
Block a user