diff --git a/changelog/25646.txt b/changelog/25646.txt new file mode 100644 index 0000000000..d8c659a1dd --- /dev/null +++ b/changelog/25646.txt @@ -0,0 +1,3 @@ +```release-note:improvement +ui: Adds allowed_response_headers, plugin_version and user_lockout_config params to auth method configuration +``` \ No newline at end of file diff --git a/ui/app/components/auth-config-form/options.js b/ui/app/components/auth-config-form/options.js index da9e9b8f33..e665830469 100644 --- a/ui/app/components/auth-config-form/options.js +++ b/ui/app/components/auth-config-form/options.js @@ -30,12 +30,20 @@ export default AuthConfigComponent.extend({ waitFor(function* () { const data = this.model.config.serialize(); data.description = this.model.description; + data.user_lockout_config = {}; // token_type should not be tuneable for the token auth method. if (this.model.methodType === 'token') { delete data.token_type; } + this.model.userLockoutConfig.apiParams.forEach((attr) => { + if (Object.keys(data).includes(attr)) { + data.user_lockout_config[attr] = data[attr]; + delete data[attr]; + } + }); + try { yield this.model.tune(data); } catch (err) { diff --git a/ui/app/models/auth-method.js b/ui/app/models/auth-method.js index 32370df56c..459852ca70 100644 --- a/ui/app/models/auth-method.js +++ b/ui/app/models/auth-method.js @@ -68,6 +68,16 @@ export default class AuthMethodModel extends Model { return this.local ? 'local' : 'replicated'; } + userLockoutConfig = { + modelAttrs: [ + 'config.lockoutThreshold', + 'config.lockoutDuration', + 'config.lockoutCounterReset', + 'config.lockoutDisable', + ], + apiParams: ['lockout_threshold', 'lockout_duration', 'lockout_counter_reset', 'lockout_disable'], + }; + get tuneAttrs() { const { methodType } = this; let tuneAttrs; @@ -75,12 +85,12 @@ export default class AuthMethodModel extends Model { if (methodType === 'token') { tuneAttrs = [ 'description', - 'config.{listingVisibility,defaultLeaseTtl,maxLeaseTtl,auditNonHmacRequestKeys,auditNonHmacResponseKeys,passthroughRequestHeaders}', + 'config.{listingVisibility,defaultLeaseTtl,maxLeaseTtl,auditNonHmacRequestKeys,auditNonHmacResponseKeys,passthroughRequestHeaders,allowedResponseHeaders,pluginVersion,lockoutThreshold,lockoutDuration,lockoutCounterReset,lockoutDisable}', ]; } else { tuneAttrs = [ 'description', - 'config.{listingVisibility,defaultLeaseTtl,maxLeaseTtl,tokenType,auditNonHmacRequestKeys,auditNonHmacResponseKeys,passthroughRequestHeaders}', + 'config.{listingVisibility,defaultLeaseTtl,maxLeaseTtl,tokenType,auditNonHmacRequestKeys,auditNonHmacResponseKeys,passthroughRequestHeaders,allowedResponseHeaders,pluginVersion,lockoutThreshold,lockoutDuration,lockoutCounterReset,lockoutDisable}', ]; } return expandAttributeMeta(this, tuneAttrs); @@ -94,7 +104,7 @@ export default class AuthMethodModel extends Model { 'accessor', 'local', 'sealWrap', - 'config.{listingVisibility,defaultLeaseTtl,maxLeaseTtl,tokenType,auditNonHmacRequestKeys,auditNonHmacResponseKeys,passthroughRequestHeaders}', + 'config.{listingVisibility,defaultLeaseTtl,maxLeaseTtl,tokenType,auditNonHmacRequestKeys,auditNonHmacResponseKeys,passthroughRequestHeaders,allowedResponseHeaders,pluginVersion}', ]; } @@ -107,7 +117,7 @@ export default class AuthMethodModel extends Model { 'config.listingVisibility', 'local', 'sealWrap', - 'config.{defaultLeaseTtl,maxLeaseTtl,tokenType,auditNonHmacRequestKeys,auditNonHmacResponseKeys,passthroughRequestHeaders}', + 'config.{defaultLeaseTtl,maxLeaseTtl,tokenType,auditNonHmacRequestKeys,auditNonHmacResponseKeys,passthroughRequestHeaders,allowedResponseHeaders,pluginVersion}', ], }, ]; diff --git a/ui/app/models/mount-config.js b/ui/app/models/mount-config.js index f8d7d07714..d7b3665a70 100644 --- a/ui/app/models/mount-config.js +++ b/ui/app/models/mount-config.js @@ -54,7 +54,7 @@ export default class MountConfigModel extends Model { allowedResponseHeaders; @attr('string', { - label: 'Token Type', + label: 'Token type', helpText: 'The type of token that should be generated via this role. For `default-service` and `default-batch` service and batch tokens will be issued respectively, unless the auth method explicitly requests a different type.', possibleValues: ['default-service', 'default-batch', 'batch', 'service'], @@ -66,4 +66,42 @@ export default class MountConfigModel extends Model { editType: 'stringArray', }) allowedManagedKeys; + + @attr('string', { + label: 'Plugin version', + subText: + 'Specifies the semantic version of the plugin to use, e.g. "v1.0.0". If unspecified, the server will select any matching un-versioned plugin that may have been registered, the latest versioned plugin registered, or a built-in plugin in that order of precedence.', + }) + pluginVersion; + + // Auth mount userLockoutConfig params, added to user_lockout_config object in saveModel method + @attr('string', { + label: 'Lockout threshold', + subText: 'Specifies the number of failed login attempts after which the user is locked out, e.g. 15.', + }) + lockoutThreshold; + + @attr({ + label: 'Lockout duration', + helperTextEnabled: 'The duration for which a user will be locked out, e.g. "5s" or "30m".', + editType: 'ttl', + helperTextDisabled: 'No lockout duration configured.', + }) + lockoutDuration; + + @attr({ + label: 'Lockout counter reset', + helperTextEnabled: + 'The duration after which the lockout counter is reset with no failed login attempts, e.g. "5s" or "30m".', + editType: 'ttl', + helperTextDisabled: 'No reset duration configured.', + }) + lockoutCounterReset; + + @attr('boolean', { + label: 'Disable lockout for this mount', + subText: 'If checked, disables the user lockout feature for this mount.', + }) + lockoutDisable; + // end of user_lockout_config params } diff --git a/ui/app/templates/components/auth-config-form/options.hbs b/ui/app/templates/components/auth-config-form/options.hbs index eaef6e030d..56cd7cdc9d 100644 --- a/ui/app/templates/components/auth-config-form/options.hbs +++ b/ui/app/templates/components/auth-config-form/options.hbs @@ -7,8 +7,22 @@