72 lines
3.1 KiB
Shell
Executable file
72 lines
3.1 KiB
Shell
Executable file
#!/usr/bin/env bash
|
|
# The stub `bao` for ./granter-login.nix and ./lib/bootstrap-auth-list.nix. `FAKE_BAO_LOGIN` picks the login's
|
|
# answer, in openbao's wording: `ok`, `standby` (500, a node that is not active
|
|
# yet), `no-role` (400, no trusted chain), `no-chain-match` (400, a chain that
|
|
# no role accepts), `sealed` (503). `FAKE_BAO_STATUS_RC` is `status`'s exit
|
|
# status. `FAKE_BAO_LOGIN_FIRST`, when set, answers the first login with it and
|
|
# later ones with `FAKE_BAO_LOGIN`; `FAKE_BAO_COUNT` is the file counting them.
|
|
# `auth list` is answered per the `auth)` arm below.
|
|
echo "$*" >>"$FAKE_BAO_LOG"
|
|
case "$1" in
|
|
login)
|
|
n=$(($(cat "$FAKE_BAO_COUNT" 2>/dev/null || echo 0) + 1))
|
|
echo "$n" >"$FAKE_BAO_COUNT"
|
|
answer=$FAKE_BAO_LOGIN
|
|
if [ "$n" = 1 ] && [ -n "${FAKE_BAO_LOGIN_FIRST-}" ]; then answer=$FAKE_BAO_LOGIN_FIRST; fi
|
|
url='URL: PUT https://bao.t.local:8200/v1/auth/cert/login'
|
|
case "$answer" in
|
|
ok) printf 's.fake' ;;
|
|
standby)
|
|
printf 'Error authenticating: Error making API request.\n\n%s\nCode: 500. Errors:\n\n* local node not active but active cluster node not found\n' "$url" >&2
|
|
exit 2
|
|
;;
|
|
no-role)
|
|
printf 'Error authenticating: Error making API request.\n\n%s\nCode: 400. Errors:\n\n* invalid certificate or no client certificate supplied\n' "$url" >&2
|
|
exit 2
|
|
;;
|
|
no-chain-match)
|
|
printf 'Error authenticating: Error making API request.\n\n%s\nCode: 400. Errors:\n\n* no chain matching all constraints could be found for this login certificate\n' "$url" >&2
|
|
exit 2
|
|
;;
|
|
sealed)
|
|
printf 'Error authenticating: Error making API request.\n\n%s\nCode: 503. Errors:\n\n* Vault is sealed\n' "$url" >&2
|
|
exit 2
|
|
;;
|
|
esac
|
|
;;
|
|
auth)
|
|
# `FAKE_BAO_LIST` picks `auth list`'s answer: `ok`, `standby` (500),
|
|
# `denied` (403, a token the store refuses), `sealed` (503).
|
|
# `FAKE_BAO_LIST_FIRST` answers only the first one with it.
|
|
n=$(($(cat "$FAKE_BAO_LIST_COUNT" 2>/dev/null || echo 0) + 1))
|
|
echo "$n" >"$FAKE_BAO_LIST_COUNT"
|
|
answer=${FAKE_BAO_LIST-ok}
|
|
if [ "$n" = 1 ] && [ -n "${FAKE_BAO_LIST_FIRST-}" ]; then answer=$FAKE_BAO_LIST_FIRST; fi
|
|
url='URL: GET https://bao.t.local:8200/v1/sys/auth'
|
|
case "$answer" in
|
|
ok) printf '{"cert/":{},"oidc/":{}}' ;;
|
|
standby)
|
|
printf 'Error listing enabled authentications: Error making API request.\n\n%s\nCode: 500. Errors:\n\n* local node not active but active cluster node not found\n' "$url" >&2
|
|
exit 2
|
|
;;
|
|
denied)
|
|
printf 'Error listing enabled authentications: Error making API request.\n\n%s\nCode: 403. Errors:\n\n* permission denied\n' "$url" >&2
|
|
exit 2
|
|
;;
|
|
sealed)
|
|
printf 'Error listing enabled authentications: Error making API request.\n\n%s\nCode: 503. Errors:\n\n* Vault is sealed\n' "$url" >&2
|
|
exit 2
|
|
;;
|
|
esac
|
|
;;
|
|
status)
|
|
[ "${FAKE_BAO_STATUS_RC-0}" = 0 ] || {
|
|
echo "fake bao: status: Vault is sealed" >&2
|
|
exit 2
|
|
}
|
|
;;
|
|
*)
|
|
echo "fake bao: unexpected call: $*" >&2
|
|
exit 98
|
|
;;
|
|
esac
|