Merge pull request #359 from aquasecurity/bugfix/api-authentication

bug: Fix API authentication using API key and secret

Author: sarvodayaKumar

aquasec/init_test.go

@@ -68,9 +68,15 @@ func init() {
 
 	var aquaClient *client.Client
 	if useAPIKey {
-		aquaClient = client.NewClientWithAPIKey(aquaURL, apiKey, secretKey, verifyTLS, caCertByte)
+		aquaClient, err = client.NewClientWithAPIKey(aquaURL, apiKey, secretKey, verifyTLS, caCertByte)
+		if err != nil {
+			panic(fmt.Errorf("failed to create client with api key auth, error: %s", err))
+		}
 	} else {
-		aquaClient = client.NewClientWithTokenAuth(aquaURL, username, password, verifyTLS, caCertByte)
+		aquaClient, err = client.NewClientWithTokenAuth(aquaURL, username, password, verifyTLS, caCertByte)
+		if err != nil {
+			panic(fmt.Errorf("failed to create client with token auth, error: %s", err))
+		}
 	}
 	token, url, err := aquaClient.GetAuthToken()
 

aquasec/provider.go

@@ -241,27 +241,24 @@ func providerConfigure(ctx context.Context, d *schema.ResourceData) (interface{}
 	}
 
 	if validate {
-		if apiKey == "" {
-			if username == "" {
-				diags = append(diags, diag.Diagnostic{
-					Severity: diag.Error,
-					Summary:  "Initializing provider, username parameter is missing.",
-				})
-			}
-
-			if password == "" {
-				diags = append(diags, diag.Diagnostic{
-					Severity: diag.Error,
-					Summary:  "Initializing provider, password parameter is missing.",
-				})
-			}
-		}
 		if aquaURL == "" {
 			diags = append(diags, diag.Diagnostic{
 				Severity: diag.Error,
 				Summary:  "Initializing provider, aqua_url parameter is missing.",
 			})
 		}
+		if username == "" {
+			diags = append(diags, diag.Diagnostic{
+				Severity: diag.Error,
+				Summary:  "Initializing provider, username parameter is missing.",
+			})
+		}
+		if password == "" {
+			diags = append(diags, diag.Diagnostic{
+				Severity: diag.Error,
+				Summary:  "Initializing provider, password parameter is missing.",
+			})
+		}
 	}
 
 	var caCertByte []byte
@@ -283,8 +280,24 @@ func providerConfigure(ctx context.Context, d *schema.ResourceData) (interface{}
 	}
 
 	var aquaClient *client.Client
-	if apiKey != "" {
-		aquaClient = client.NewClientWithAPIKey(aquaURL, apiKey, secretkey, verifyTLS, caCertByte)
+	if username != "" && password != "" {
+		aquaClient, err = client.NewClientWithTokenAuth(aquaURL, username, password, verifyTLS, caCertByte)
+		if err != nil {
+			return nil, diag.Diagnostics{diag.Diagnostic{
+				Severity: diag.Error,
+				Summary:  "Error creating Aqua client with token authentication",
+				Detail:   err.Error(),
+			}}
+		}
+	} else if apiKey != "" {
+		aquaClient, err = client.NewClientWithAPIKey(aquaURL, apiKey, secretkey, verifyTLS, caCertByte)
+		if err != nil {
+			return nil, diag.Diagnostics{diag.Diagnostic{
+				Severity: diag.Error,
+				Summary:  "Error creating Aqua client with API key",
+				Detail:   err.Error(),
+			}}
+		}
 		if v, ok := d.GetOk("validity"); ok {
 			aquaClient.Validity = v.(int)
 		}
@@ -295,7 +308,11 @@ func providerConfigure(ctx context.Context, d *schema.ResourceData) (interface{}
 			aquaClient.CSPRoles = convertStringArr(v.([]interface{}))
 		}
 	} else {
-		aquaClient = client.NewClientWithTokenAuth(aquaURL, username, password, verifyTLS, caCertByte)
+		return nil, diag.Diagnostics{diag.Diagnostic{
+			Severity: diag.Error,
+			Summary:  "Missing credentials",
+			Detail:   "Provide username+password or aqua_api_key+aqua_api_secret.",
+		}}
 	}
 
 	if validate {

client/client.go

@@ -48,16 +48,19 @@ const UserAgentBase = "terraform-provider-aquasec"
 
 var version string
 
-func NewClientWithTokenAuth(urlStr, user, password string, verifyTLS bool, caCertByte []byte) *Client {
+func NewClientWithTokenAuth(urlStr, user, password string, verifyTLS bool, caCertByte []byte) (*Client, error) {
 	return NewClient(urlStr, user, password, "", "", false, verifyTLS, caCertByte)
 }
 
-func NewClientWithAPIKey(urlStr, apiKey, secretkey string, verifyTLS bool, caCertByte []byte) *Client {
+func NewClientWithAPIKey(urlStr, apiKey, secretkey string, verifyTLS bool, caCertByte []byte) (*Client, error) {
+	if strings.TrimSpace(apiKey) == "" || strings.TrimSpace(secretkey) == "" {
+		return nil, fmt.Errorf("api key auth requires both aqua_api_key and aqua_api_secret")
+	}
 	return NewClient(urlStr, "", "", apiKey, secretkey, true, verifyTLS, caCertByte)
 }
 
 // NewClient - initialize and return the Client
-func NewClient(url, user, password, apiKey, secretkey string, useAPIKey, verifyTLS bool, caCertByte []byte) *Client {
+func NewClient(url, user, password, apiKey, secretkey string, useAPIKey, verifyTLS bool, caCertByte []byte) (*Client, error) {
 	tlsConfig := &tls.Config{
 		InsecureSkipVerify: !verifyTLS,
 	}
@@ -133,7 +136,7 @@ func NewClient(url, user, password, apiKey, secretkey string, useAPIKey, verifyT
 		break
 	}
 
-	return c
+	return c, nil
 }
 
 func (cli *Client) AuthenticateWithAPIKey() (string, error) {