From 3e2973a09da1e7b5a2cf0a2f36df69169b5bb590 Mon Sep 17 00:00:00 2001 From: Helen Fu <25168806+helenfufu@users.noreply.github.com> Date: Mon, 6 Jan 2025 16:34:19 -0600 Subject: [PATCH 1/7] go get github.com/hashicorp/cap/ldap@main && go mod tidy --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index ec0d650ae010..7cbc70521774 100644 --- a/go.mod +++ b/go.mod @@ -72,7 +72,7 @@ require ( github.com/google/go-github v17.0.0+incompatible github.com/google/go-metrics-stackdriver v0.2.0 github.com/hashicorp/cap v0.7.0 - github.com/hashicorp/cap/ldap v0.0.0-20240403125925-c0418810d10e + github.com/hashicorp/cap/ldap v0.0.0-20250106213447-9047b8b3240f github.com/hashicorp/cli v1.1.6 github.com/hashicorp/consul-template v0.39.1 github.com/hashicorp/consul/api v1.29.1 diff --git a/go.sum b/go.sum index e95bc9ea35bc..03e848e30895 100644 --- a/go.sum +++ b/go.sum @@ -1376,8 +1376,8 @@ github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed h1:5upAirOpQc github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed/go.mod h1:tMWxXQ9wFIaZeTI9F+hmhFiGpFmhOHzyShyFUhRm0H4= github.com/hashicorp/cap v0.7.0 h1:atLIEU5lJslYXo1qsv7RtUL1HrJVVxnfkErIT3uxLp0= github.com/hashicorp/cap v0.7.0/go.mod h1:UynhCoGX3pxL0OfVrfMzPWAyjMYp96bk11BNTf2zt8o= -github.com/hashicorp/cap/ldap v0.0.0-20240403125925-c0418810d10e h1:IakB/NhT0YtMEGqAf2tViMdBABC2cMAZn3O/mVeg2j4= -github.com/hashicorp/cap/ldap v0.0.0-20240403125925-c0418810d10e/go.mod h1:Ofp5fMLl1ImcwjNGu9FtEwNOdxA0LYoWpcWQE2vltuI= +github.com/hashicorp/cap/ldap v0.0.0-20250106213447-9047b8b3240f h1:iixO0KNqHfSMImUgaHnMHTzmu0FVLwk7VzIZf6++wak= +github.com/hashicorp/cap/ldap v0.0.0-20250106213447-9047b8b3240f/go.mod h1:vGqAhHKOR5gadKWjwhoWp3RKto/tmhVOtH8gcD0c8ss= github.com/hashicorp/cli v1.1.6 h1:CMOV+/LJfL1tXCOKrgAX0uRKnzjj/mpmqNXloRSy2K8= github.com/hashicorp/cli v1.1.6/go.mod h1:MPon5QYlgjjo0BSoAiN0ESeT5fRzDjVRp+uioJ0piz4= github.com/hashicorp/consul-template v0.39.1 h1:MfhPoNENzCVSEXtE7CnIm3JkCzM9K0I7rcJYofm1BYY= From 48e24661d7157bb5d843fd35821c951b7f19c4a2 Mon Sep 17 00:00:00 2001 From: Helen Fu <25168806+helenfufu@users.noreply.github.com> Date: Mon, 6 Jan 2025 17:03:05 -0600 Subject: [PATCH 2/7] add 1.19 upgrade note --- website/content/docs/upgrading/upgrade-to-1.19.x.mdx | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/website/content/docs/upgrading/upgrade-to-1.19.x.mdx b/website/content/docs/upgrading/upgrade-to-1.19.x.mdx index 313d4e993ffc..294a00a0a58b 100644 --- a/website/content/docs/upgrading/upgrade-to-1.19.x.mdx +++ b/website/content/docs/upgrading/upgrade-to-1.19.x.mdx @@ -42,6 +42,17 @@ based on the table below. | CE | true | any value other than sha2-512 | An error is returned | Pure Ed25519 | | CE | true | sha2-512 | An error is returned (not supported on CE) | Pure Ed25519 | +### LDAP user DN search with `upndomain` + +The github.com/hashicorp/cap/ldap dependency has been upgraded to include a security improvement +which may be a breaking change for users. The enhancement ensures that user DN searches with +`upndomain` configured will now check that exactly one user is returned and error otherwise. +For more details, see https://github.com/hashicorp/cap/pull/151. + +In previous versions of Vault, multiple users could be returned when searching for the user DN +with `upndomain` configured, and the last user would be selected. As of 1.19.x, such searches will +error if multiple users are returned. + ## Known issues and workarounds @include 'known-issues/duplicate-hsm-key.mdx' From dd408e0ccc4081cc3b0d5e28d24f3a5115a40e4f Mon Sep 17 00:00:00 2001 From: Helen Fu <25168806+helenfufu@users.noreply.github.com> Date: Tue, 7 Jan 2025 10:14:59 -0600 Subject: [PATCH 3/7] changelog --- changelog/29302.txt | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 changelog/29302.txt diff --git a/changelog/29302.txt b/changelog/29302.txt new file mode 100644 index 000000000000..4500585d1bb1 --- /dev/null +++ b/changelog/29302.txt @@ -0,0 +1,3 @@ +```release-note:change +cap/ldap: Upgrade cap/ldap to https://github.com/hashicorp/cap/commit/9047b8b3240fd6503b08a05e5a5455793c64100f. +``` \ No newline at end of file From acbfb9a436b9ffc25251002f675626c82a53032a Mon Sep 17 00:00:00 2001 From: Helen Fu <25168806+helenfufu@users.noreply.github.com> Date: Tue, 7 Jan 2025 10:22:11 -0600 Subject: [PATCH 4/7] cd sdk && go get github.com/hashicorp/cap/ldap@main && go mod tidy --- sdk/go.mod | 12 ++++++------ sdk/go.sum | 24 ++++++++++++------------ 2 files changed, 18 insertions(+), 18 deletions(-) diff --git a/sdk/go.mod b/sdk/go.mod index 8d306d850a4e..c37105c43d88 100644 --- a/sdk/go.mod +++ b/sdk/go.mod @@ -15,7 +15,7 @@ require ( github.com/go-test/deep v1.1.0 github.com/golang/protobuf v1.5.4 github.com/golang/snappy v0.0.4 - github.com/hashicorp/cap/ldap v0.0.0-20240328153749-fcfe271d0227 + github.com/hashicorp/cap/ldap v0.0.0-20250106213447-9047b8b3240f github.com/hashicorp/errwrap v1.1.0 github.com/hashicorp/go-cleanhttp v0.5.2 github.com/hashicorp/go-hclog v1.6.3 @@ -46,9 +46,9 @@ require ( github.com/stretchr/testify v1.9.0 github.com/tink-crypto/tink-go/v2 v2.2.0 go.uber.org/atomic v1.9.0 - golang.org/x/crypto v0.27.0 + golang.org/x/crypto v0.31.0 golang.org/x/net v0.29.0 - golang.org/x/text v0.18.0 + golang.org/x/text v0.21.0 google.golang.org/grpc v1.66.1 google.golang.org/protobuf v1.34.2 ) @@ -70,7 +70,7 @@ require ( github.com/prometheus/procfs v0.8.0 // indirect go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0 // indirect go.opentelemetry.io/proto/otlp v1.0.0 // indirect - golang.org/x/sync v0.8.0 // indirect + golang.org/x/sync v0.10.0 // indirect ) require ( @@ -131,8 +131,8 @@ require ( go.opentelemetry.io/otel/trace v1.30.0 // indirect golang.org/x/mod v0.17.0 // indirect golang.org/x/oauth2 v0.21.0 // indirect - golang.org/x/sys v0.25.0 // indirect - golang.org/x/term v0.24.0 // indirect + golang.org/x/sys v0.28.0 // indirect + golang.org/x/term v0.27.0 // indirect golang.org/x/time v0.5.0 // indirect golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect google.golang.org/api v0.169.0 // indirect diff --git a/sdk/go.sum b/sdk/go.sum index b226fc928814..74a08cb3a6bb 100644 --- a/sdk/go.sum +++ b/sdk/go.sum @@ -227,8 +227,8 @@ github.com/googleapis/gax-go/v2 v2.12.2 h1:mhN09QQW1jEWeMF74zGR81R30z4VJzjZsfkUh github.com/googleapis/gax-go/v2 v2.12.2/go.mod h1:61M8vcyyXR2kqKFxKrfA22jaA8JGF7Dc8App1U3H6jc= github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 h1:YBftPWNWd4WwGqtY2yeZL2ef8rHAxPBD8KFhJpmcqms= github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0/go.mod h1:YN5jB8ie0yfIUg6VvR9Kz84aCaG7AsGZnLjhHbUqwPg= -github.com/hashicorp/cap/ldap v0.0.0-20240328153749-fcfe271d0227 h1:R5CMNyBNZqODw2DcGaSa2X96AgtLotXsH7aOa07zTTI= -github.com/hashicorp/cap/ldap v0.0.0-20240328153749-fcfe271d0227/go.mod h1:Ofp5fMLl1ImcwjNGu9FtEwNOdxA0LYoWpcWQE2vltuI= +github.com/hashicorp/cap/ldap v0.0.0-20250106213447-9047b8b3240f h1:iixO0KNqHfSMImUgaHnMHTzmu0FVLwk7VzIZf6++wak= +github.com/hashicorp/cap/ldap v0.0.0-20250106213447-9047b8b3240f/go.mod h1:vGqAhHKOR5gadKWjwhoWp3RKto/tmhVOtH8gcD0c8ss= github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I= github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= @@ -575,8 +575,8 @@ golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5y golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc= -golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A= -golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70= +golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U= +golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8= @@ -674,8 +674,8 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ= -golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= +golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ= +golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= @@ -732,16 +732,16 @@ golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.25.0 h1:r+8e+loiHxRqhXVl6ML1nO3l1+oFoWbnlu2Ehimmi34= -golang.org/x/sys v0.25.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= +golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA= +golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo= golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU= -golang.org/x/term v0.24.0 h1:Mh5cbb+Zk2hqqXNO7S1iTjEphVL+jb8ZWaqh/g+JWkM= -golang.org/x/term v0.24.0/go.mod h1:lOBK/LVxemqiMij05LGJ0tzNr8xlmwBRJ81PX6wVLH8= +golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q= +golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM= golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= @@ -753,8 +753,8 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= -golang.org/x/text v0.18.0 h1:XvMDiNzPAl0jr17s6W9lcaIhGUfUORdGCNsuLmPG224= -golang.org/x/text v0.18.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY= +golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo= +golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= From d598f22a13b60bd441533270e378ad79ed2138e4 Mon Sep 17 00:00:00 2001 From: Helen Fu <25168806+helenfufu@users.noreply.github.com> Date: Tue, 7 Jan 2025 10:27:50 -0600 Subject: [PATCH 5/7] add more detail in changelog --- changelog/29302.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/changelog/29302.txt b/changelog/29302.txt index 4500585d1bb1..6c25465ae42b 100644 --- a/changelog/29302.txt +++ b/changelog/29302.txt @@ -1,3 +1,3 @@ ```release-note:change -cap/ldap: Upgrade cap/ldap to https://github.com/hashicorp/cap/commit/9047b8b3240fd6503b08a05e5a5455793c64100f. +cap/ldap: Upgrade cap/ldap to https://github.com/hashicorp/cap/commit/9047b8b3240fd6503b08a05e5a5455793c64100f, which includes a security improvement to ensure that user DN searches with `upndomain` configured will check that exactly one user is returned and error otherwise. ``` \ No newline at end of file From a6be6c1e3959646f970eebb32659e140f457d3d3 Mon Sep 17 00:00:00 2001 From: Helen Fu <25168806+helenfufu@users.noreply.github.com> Date: Tue, 7 Jan 2025 10:50:50 -0600 Subject: [PATCH 6/7] update changelog --- changelog/29302.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/changelog/29302.txt b/changelog/29302.txt index 6c25465ae42b..0caf8896c841 100644 --- a/changelog/29302.txt +++ b/changelog/29302.txt @@ -1,3 +1,3 @@ ```release-note:change -cap/ldap: Upgrade cap/ldap to https://github.com/hashicorp/cap/commit/9047b8b3240fd6503b08a05e5a5455793c64100f, which includes a security improvement to ensure that user DN searches with `upndomain` configured will check that exactly one user is returned and error otherwise. -``` \ No newline at end of file +auth/ldap: An error will now be returned on login if the number of entries returned from the user DN LDAP search is more than one. +``` From 599f6f365e66a65358c87e63587d6f6c4f38a9b0 Mon Sep 17 00:00:00 2001 From: Helen Fu <25168806+helenfufu@users.noreply.github.com> Date: Tue, 7 Jan 2025 17:32:29 -0600 Subject: [PATCH 7/7] go mod tidy after resolving merge conflicts --- go.mod | 1 - 1 file changed, 1 deletion(-) diff --git a/go.mod b/go.mod index 76836adcd41a..972575dfc142 100644 --- a/go.mod +++ b/go.mod @@ -388,7 +388,6 @@ require ( github.com/go-ozzo/ozzo-validation v3.6.0+incompatible // indirect github.com/goccy/go-json v0.10.2 // indirect github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2 // indirect - github.com/gofrs/uuid v4.3.0+incompatible // indirect github.com/gogo/protobuf v1.3.2 // indirect github.com/golang-jwt/jwt/v5 v5.2.1 // indirect github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect