mirror of
https://github.com/fleetdm/fleet
synced 2026-05-23 00:49:03 +00:00
ab4c505f4b
#13832 For macOS hosts, fleetd now stores and retrieves enroll secret from macOS keychain. - this feature must use the official signed and notarized version of fleetd - for contributors, this feature can disabled with either: - fleetctl package flag: --disable-keystore - fleetd runtime flag: --disable-keystore This feature does not cover the MDM usecase where enroll secret is stored in the MDM profile. This usecase will hopefully be worked on next sprint with the MDM team. For Windows hosts, fleetd now stores and retrieves enroll secret from Windows Credential Manager. # Checklist for submitter If some of the following don't apply, delete the relevant line. <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Changes file added for user-visible changes in `changes/` or `orbit/changes/`. See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information. - [x] Added/updated tests - [x] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [x] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [x] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)).
61 lines
1.3 KiB
Go
61 lines
1.3 KiB
Go
//go:build windows
|
|
|
|
package keystore
|
|
|
|
import (
|
|
"errors"
|
|
"github.com/danieljoos/wincred"
|
|
"strings"
|
|
"sync"
|
|
"syscall"
|
|
)
|
|
|
|
// Using a var instead of const so that it can be overridden in tests.
|
|
var service = "com.fleetdm.fleetd.enroll.secret"
|
|
var mu sync.Mutex
|
|
|
|
func Supported() bool {
|
|
return true
|
|
}
|
|
|
|
func Name() string {
|
|
return "Credential Manager"
|
|
}
|
|
|
|
// AddSecret will add a secret to the Credential Manager. This secret can be retrieved by this user without additional authorization.
|
|
func AddSecret(secret string) error {
|
|
secret = strings.TrimSpace(secret)
|
|
if secret == "" {
|
|
return errors.New("secret cannot be empty")
|
|
}
|
|
|
|
mu.Lock()
|
|
defer mu.Unlock()
|
|
|
|
cred := wincred.NewGenericCredential(service)
|
|
cred.CredentialBlob = []byte(secret)
|
|
err := cred.Write()
|
|
return err
|
|
}
|
|
|
|
// UpdateSecret will update a secret in the Credential Manager.
|
|
func UpdateSecret(secret string) error {
|
|
return AddSecret(secret)
|
|
}
|
|
|
|
// GetSecret will retrieve a secret from the Credential Manager. If secret doesn't exist, it will return "", nil.
|
|
func GetSecret() (string, error) {
|
|
mu.Lock()
|
|
defer mu.Unlock()
|
|
|
|
cred, err := wincred.GetGenericCredential(service)
|
|
if err != nil {
|
|
var errno syscall.Errno
|
|
ok := errors.As(err, &errno)
|
|
if ok && errors.Is(errno, syscall.ERROR_NOT_FOUND) {
|
|
return "", nil
|
|
}
|
|
return "", err
|
|
}
|
|
return string(cred.CredentialBlob), nil
|
|
}
|