Skip to content

SecretServerCloud platform_url is different than base_url #94

@rosswhittarb

Description

@rosswhittarb

Description of the issue

When using secret server cloud the URL used for login and vault broker is different than the url used for API calls.
ensure_vault_url function fails to retrieve vaults at https://{mytenant}.secretservercloud.com/vaultbroker/api/vaults
Correct endpoint is https://{mytenant}.delinea.app/vaultbroker/api/vaults

if https://{mytenant}.delinea.app is supplied as the base_url then ensure_vault_url() will succeed but all secret retrieval will fail.

Expected behavior

When using Secret Server Cloud
Instantiate a SecretServerCloud class with tenant=mytenant and successfully retrieve secrets

Actual behavior

When using Secret Server Cloud
Create authorizer; supplying base_url="https://mytenant.delinea.app". Authorizer succeeds and returns an access_token.
Instantiate a SecretServerCloud class with tenant=mytenant and the authorizer.
SecretServerCloud sets the base_url to https://mytenant.secretservercloud.com
When retrieving a secret or folder, ensure_vault_url() is called,
vaults_endpoint is being set to base_url (https://mytenant.secretservercloud.com) + /vaultbroker/api/vaults
Request fails with error: HTTP 404.

Your environment

Tell us more about your environment; such as, What OS are you running? What version of pluginName are you using? Etc.
Ubuntu 22.04.5 LTS
python3.11
python-tss-sdk 2.0.1

Issue identified originally with nautobot-app-secrets-providers plugin but has been replicated with standalone api calls.

Steps to reproduce

Tell us how to reproduce this issue. Please include code examples as necessary.

from delinea.secrets.server import (
        PasswordGrantAuthorizer,
        SecretServerCloud,
        SecretServerError
    )
import traceback

username = "myuser"
password = "mypassword"
base_url = "https://mytenant.delinea.app"
tenant = "mytenant"

delinea_authorizer = PasswordGrantAuthorizer(base_url=base_url, username=username, password=password)

delinea = SecretServerCloud(tenant=tenant, authorizer=delinea_authorizer)

try:
    folder = delinea.get_folder(123)
except SecretServerError as err:
    print(err.message)
    print(traceback.format_exc())

print(folder['folderPath'])
Failed to fetch vault details: HTTP 404 - 
Traceback (most recent call last):
  File "<stdin>", line 2, in <module>
  File "/home/{user}/delinea-venv/lib/python3.11/site-packages/delinea/secrets/server.py", line 574, in get_folder
    response = self.get_folder_json(
               ^^^^^^^^^^^^^^^^^^^^^
  File "/home/{user}/delinea-venv/lib/python3.11/site-packages/delinea/secrets/server.py", line 493, in get_folder_json
    self.ensure_vault_url()
  File "/home/{user}/delinea-venv/lib/python3.11/site-packages/delinea/secrets/server.py", line 427, in ensure_vault_url
    raise SecretServerError(
delinea.secrets.server.SecretServerError

Issue can be fixed by overriding the platform_url after the SecretServerCloud object is created

delinea = SecretServerCloud(tenant=tenant, authorizer=delinea_authorizer)

delinea.platform_url = "https://mytenant.delinea.app"

try:
    folder = delinea.get_folder(123)
except SecretServerError as err:
    print(err.message)
    print(traceback.format_exc())

print(folder['folderPath'])

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions