Add the static-roles feature for MSSQL

[johnathanschmidt]

• Implement SetCredentials function with proper SQL statement
• Implement prepareMSSQLTestContainer to create test container
• Refactor existing tests to use the container

• Inspired by the PostgreSQL and MySQL plugin implementations

[hashicorp-cla]

All committers have signed the CLA.

[johnathanschmidt]

To resolve #8930

[Valarissa]

Just an FYI, I just merged in a change to add helper/testhelpers/mssql/mssqlhelper.go and a PrepareMSSQLTestContainer as part of that package.Thank you for doing this though!

[pbernal]

Hi @johnathanschmidt - if you would like to continue on seeing this through, could you please sign the CLA? Once you sign the CLA, we will do our best to try to get some 👀 on it for a review.

[johnathanschmidt]

Hi @pbernal , I have signed the CLA, but I think that was the wrong way. I put my company e-mail, not my github account e-mail, it's possible to change after signed ?

[kalafut]

@johnathanschmidt I believe the CLA check passes if the email you created the commit with is in your github settings. If you update Github to include this email (you can have multiple emails), the check will pass without having to repush anything.

[johnathanschmidt]

Hi @kalafut , thanks for the tip!

@pbernal , now it's ok!

[austingebauer]

Hi, @johnathanschmidt. I'm happy to review this PR and help you get this into Vault. Once you've updated your branch by pulling in the latest changes from master, I'll start having a look. Thanks!

[johnathanschmidt]

Hi @austingebauer, I updated my branch with the master branch changes, if there is anything I can do

[austingebauer]

Thanks, @johnathanschmidt. I'm reviewing and testing this out now.

[austingebauer]

Thanks for this contribution, @johnathanschmidt. I just have one comment related to a test case. Otherwise, this PR looks good overall.

I was able to test out the static-roles feature using MSSQL and run the tests. Everything works as I'd expect.

$ vault secrets enable -path=database-mssql database
Success! Enabled the database secrets engine at: database-mssql/

$ vault write database-mssql/config/my-mssql-database \
    plugin_name=mssql-database-plugin \
    connection_url='sqlserver://{{username}}:{{password}}@localhost:1433' \
    allowed_roles="*" \
    username="sa" \
    password='yourStrong(!)Password'

$ docker exec -it mssql /opt/mssql-tools/bin/sqlcmd -S localhost -U sa -P 'yourStrong(!)Password'
1> CREATE LOGIN vault_edu WITH PASSWORD = 'myPassword!'
2> go
1> CREATE USER vault_edu FOR LOGIN vault_edu
2> go
1> exit

$ vault write database-mssql/static-roles/education \
    db_name=my-mssql-database \
    username="vault_edu" \
    rotation_period=30
Success! Data written to: database-mssql/static-roles/education

$ vault read database-mssql/static-creds/education
Key                    Value
---                    -----
last_vault_rotation    2020-06-19T12:19:15.554617-07:00
password               A1a-vcmx8Dv2IpSO9207
rotation_period        30s
ttl                    13s
username               vault_edu

$ vault read database-mssql/static-creds/education
Key                    Value
---                    -----
last_vault_rotation    2020-06-19T12:19:48.969776-07:00
password               A1a-KuMNg31VRgd0Xlvm
rotation_period        30s
ttl                    28s
username               vault_edu

$ vault write -f database-mssql/rotate-role/education
Success! Data written to: database-mssql/rotate-role/education

$ vault read database-mssql/static-creds/education
Key                    Value
---                    -----
last_vault_rotation    2020-06-19T12:20:09.998477-07:00
password               A1a-BRNLqnP3jwstiqRv
rotation_period        30s
ttl                    24s
username               vault_edu

[austingebauer]

LGTM.