chore(status): Ensure that status is properly progogated in the /role path

Signed-off-by: Hayden Roszell <hroszell@gmail.com>

Author: m8rmclaren

CHANGELOG.md

@@ -1,3 +1,15 @@
+# v1.5.0
+## Fixes
+* Patched bug that required the `allow_any_name` or `allowed_domains=[""]` role parameters to issue/sign certificates with no CN.
+
+## Chores
+* Upgrade from Go `v1.21` to `v1.22`.
+* Implement more strict golangci-lint policy.
+
+## Features
+* If upstream EJBCA API call fails, the HTTP status code is propogated to the Vault user via the Vault API status code.
+* Implement OAuth 2.0 "client credentials" token flow as a supported authentication mechanism to EJBCA.
+
 # v1.4.0
 ## Fixes
 * Paths that need to write to the Storage backend now forward the request to the primary node. This is important in Enterprise HA deployments where Performance Standby Nodes are allowed to handle read requests/paths.

backend_test.go

@@ -18,7 +18,6 @@ package ejbca
 
 import (
 	"context"
-	"encoding/json"
 	"os"
 	"testing"
 
@@ -77,28 +76,3 @@ func getTestBackend(tb testing.TB) (*ejbcaBackend, logical.Storage) {
 
 	return b.(*ejbcaBackend), config.StorageView
 }
-
-func logicalResponseIsEjbcaError(resp *logical.Response) bool {
-	if resp == nil {
-		return false
-	}
-	if contentType, ok := resp.Data[logical.HTTPContentType].(string); !ok || contentType != "application/json" {
-		return false
-	}
-	if rawBody, ok := resp.Data[logical.HTTPRawBody].(string); !ok || rawBody == "" {
-		return false
-	}
-	if _, ok := resp.Data[logical.HTTPStatusCode].(int); !ok {
-		return false
-	}
-
-	err := json.Unmarshal([]byte(resp.Data[logical.HTTPRawBody].(string)), &resp.Data)
-	if err != nil {
-		return false
-	}
-	if _, ok := resp.Data["errors"]; !ok {
-		return false
-	}
-
-	return true
-}

ca_utils.go

@@ -71,7 +71,7 @@ func (c *caStorageContext) resolveIssuerReference(caName string) error {
 		}
 	}
 
-	return fmt.Errorf("CA %s not found", caName)
+	return errutil.UserError{Err: fmt.Sprintf("Could not find CA called %s in connected EJBCA - please make sure that it exists and that your credentials have the proper permissions.", caName)}
 }
 
 func (c *caStorageContext) putCaEntry(caName string, entry caEntry) error {
@@ -361,10 +361,12 @@ func (b *caResponseBuilder) Build() (*logical.Response, error) {
 	if err != nil {
 		var userError errutil.UserError
 		if errors.As(err, &userError) {
+			logger.Trace("fetchCaBundle failed as UserError - returning logical ErrorResponse")
 			return logical.ErrorResponse(err.Error()), nil
 		}
 		var ejbcaError ejbcaAPIError
 		if errors.As(err, &ejbcaError) {
+			logger.Trace("fetchCaBundle failed as ejbcaAPIError - returning logical raw response with status", "code", ejbcaError.Code)
 			return ejbcaError.ToLogicalResponse()
 		}
 		// Only return error if path is JSON response.

client.go

@@ -67,6 +67,31 @@ func (e ejbcaAPIError) ToLogicalResponse() (*logical.Response, error) {
 	return response, err
 }
 
+func logicalResponseIsEjbcaError(resp *logical.Response) bool {
+	if resp == nil {
+		return false
+	}
+	if contentType, ok := resp.Data[logical.HTTPContentType].(string); !ok || contentType != "application/json" {
+		return false
+	}
+	if rawBody, ok := resp.Data[logical.HTTPRawBody].(string); !ok || rawBody == "" {
+		return false
+	}
+	if _, ok := resp.Data[logical.HTTPStatusCode].(int); !ok {
+		return false
+	}
+
+	err := json.Unmarshal([]byte(resp.Data[logical.HTTPRawBody].(string)), &resp.Data)
+	if err != nil {
+		return false
+	}
+	if _, ok := resp.Data["errors"]; !ok {
+		return false
+	}
+
+	return true
+}
+
 func (e *ejbcaClient) EjbcaAPIError(b *ejbcaBackend, detail string, err error) error {
 	logger := b.Logger().Named("ejbcaClient.createErrorFromEjbcaErr")
 	if err == nil {

path_role.go

@@ -19,6 +19,7 @@ package ejbca
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"net/http"
 	"strings"
@@ -1098,6 +1099,15 @@ func (b *ejbcaBackend) pathRoleCreate(ctx context.Context, req *logical.Request,
 	logger.Debug("Validating role entry before storing", "entry", entry)
 	resp, err := entry.validate(b.makeStorageContext(ctx, req.Storage))
 	if err != nil {
+		var userError errutil.UserError
+		if errors.As(err, &userError) {
+			return logical.ErrorResponse(err.Error()), nil
+		}
+		var ejbcaError ejbcaAPIError
+		if errors.As(err, &ejbcaError) {
+			return ejbcaError.ToLogicalResponse()
+		}
+
 		return nil, err
 	}
 	if warning != "" {
@@ -1392,6 +1402,8 @@ func (r *roleEntry) validate(sc *storageContext) (*logical.Response, error) {
 		r.EndEntityName = config.DefaultEndEntityName
 	}
 
+	// We expect resolveIssuerReference to return its error as a known type to allow the
+	// caller to properly handle it. IE - blindly return err if it's not nil
 	err = sc.CA().resolveIssuerReference(r.Issuer)
 	if err != nil {
 		return nil, err

storage.go

@@ -274,7 +274,7 @@ func (c *certStorageContext) listRevokedCerts() ([]string, error) {
 
 	list, err := c.storageContext.Storage.List(c.storageContext.Context, revokedPath)
 	if err != nil {
-		return nil, fmt.Errorf("failed listing revoked certs: %w", err)
+		return nil, errutil.InternalError{Err: fmt.Sprintf("failed listing revoked certs: %s", err)}
 	}
 
 	// Normalize serial back to a format people are expecting.