Skip to content

SecretServerCloud platform_url is different than base_url #94

Description

@rosswhittarb

Description of the issue

When using secret server cloud the URL used for login and vault broker is different than the url used for API calls.
ensure_vault_url function fails to retrieve vaults at https://{mytenant}.secretservercloud.com/vaultbroker/api/vaults
Correct endpoint is https://{mytenant}.delinea.app/vaultbroker/api/vaults

if https://{mytenant}.delinea.app is supplied as the base_url then ensure_vault_url() will succeed but all secret retrieval will fail.

Expected behavior

When using Secret Server Cloud
Instantiate a SecretServerCloud class with tenant=mytenant and successfully retrieve secrets

Actual behavior

When using Secret Server Cloud
Create authorizer; supplying base_url="https://mytenant.delinea.app". Authorizer succeeds and returns an access_token.
Instantiate a SecretServerCloud class with tenant=mytenant and the authorizer.
SecretServerCloud sets the base_url to https://mytenant.secretservercloud.com
When retrieving a secret or folder, ensure_vault_url() is called,
vaults_endpoint is being set to base_url (https://mytenant.secretservercloud.com) + /vaultbroker/api/vaults
Request fails with error: HTTP 404.

Your environment

Tell us more about your environment; such as, What OS are you running? What version of pluginName are you using? Etc.
Ubuntu 22.04.5 LTS
python3.11
python-tss-sdk 2.0.1

Issue identified originally with nautobot-app-secrets-providers plugin but has been replicated with standalone api calls.

Steps to reproduce

Tell us how to reproduce this issue. Please include code examples as necessary.

from delinea.secrets.server import (
        PasswordGrantAuthorizer,
        SecretServerCloud,
        SecretServerError
    )
import traceback

username = "myuser"
password = "mypassword"
base_url = "https://mytenant.delinea.app"
tenant = "mytenant"

delinea_authorizer = PasswordGrantAuthorizer(base_url=base_url, username=username, password=password)

delinea = SecretServerCloud(tenant=tenant, authorizer=delinea_authorizer)

try:
    folder = delinea.get_folder(123)
except SecretServerError as err:
    print(err.message)
    print(traceback.format_exc())

print(folder['folderPath'])
Failed to fetch vault details: HTTP 404 - 
Traceback (most recent call last):
  File "<stdin>", line 2, in <module>
  File "/home/{user}/delinea-venv/lib/python3.11/site-packages/delinea/secrets/server.py", line 574, in get_folder
    response = self.get_folder_json(
               ^^^^^^^^^^^^^^^^^^^^^
  File "/home/{user}/delinea-venv/lib/python3.11/site-packages/delinea/secrets/server.py", line 493, in get_folder_json
    self.ensure_vault_url()
  File "/home/{user}/delinea-venv/lib/python3.11/site-packages/delinea/secrets/server.py", line 427, in ensure_vault_url
    raise SecretServerError(
delinea.secrets.server.SecretServerError

Issue can be fixed by overriding the platform_url after the SecretServerCloud object is created

delinea = SecretServerCloud(tenant=tenant, authorizer=delinea_authorizer)

delinea.platform_url = "https://mytenant.delinea.app"

try:
    folder = delinea.get_folder(123)
except SecretServerError as err:
    print(err.message)
    print(traceback.format_exc())

print(folder['folderPath'])

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions