ATT mechid feature

builtin/logical/database/path_creds_create.go

@@ -139,6 +139,7 @@ func (b *databaseBackend) pathCredsCreateRead() framework.OperationFunc {
 			UsernameConfig: v5.UsernameMetadata{
 				DisplayName: req.DisplayName,
 				RoleName:    name,
+				UsernameTemplateMetadata: role.UsernameTemplateMetadata,
 			},
 			Statements: v5.Statements{
 				Commands: role.Statements.Creation,

builtin/logical/database/path_roles.go

@@ -159,6 +159,10 @@ func dynamicFields() map[string]*framework.FieldSchema {
 			Type:        framework.TypeDurationSecond,
 			Description: "Maximum time a credential is valid for",
 		},
+		"username_template_metadata": {
+			Type: framework.TypeString,
+			Description: `Meta data to be used to generate username.`,
+		},
 		"creation_statements": {
 			Type: framework.TypeStringSlice,
 			Description: `Specifies the database statements executed to
@@ -369,6 +373,7 @@ func (b *databaseBackend) pathRoleRead(ctx context.Context, req *logical.Request
 
 	data := map[string]interface{}{
 		"db_name":               role.DBName,
+		"username_template_metadata": role.UsernameTemplateMetadata,
 		"creation_statements":   role.Statements.Creation,
 		"revocation_statements": role.Statements.Revocation,
 		"rollback_statements":   role.Statements.Rollback,
@@ -450,6 +455,12 @@ func (b *databaseBackend) pathRoleCreateUpdate(ctx context.Context, req *logical
 			return logical.ErrorResponse("database name is required"), nil
 		}
 
+		if usernameTemplateMetadataRaw, ok := data.GetOk("username_template_metadata"); ok {
+			role.UsernameTemplateMetadata = usernameTemplateMetadataRaw.(string)
+		} else if createOperation {
+			role.UsernameTemplateMetadata = data.Get("username_template_metadata").(string)
+		}
+
 		if credentialTypeRaw, ok := data.GetOk("credential_type"); ok {
 			credentialType = credentialTypeRaw.(string)
 			if err := role.setCredentialType(credentialType); err != nil {
@@ -851,6 +862,7 @@ func (b *databaseBackend) pathStaticRoleCreateUpdate(ctx context.Context, req *l
 type roleEntry struct {
 	Name             string                 `json:"name"`
 	DBName           string                 `json:"db_name"`
+	UsernameTemplateMetadata string                 `json:"username_template_metadata"`
 	Statements       v4.Statements          `json:"statements"`
 	DefaultTTL       time.Duration          `json:"default_ttl"`
 	MaxTTL           time.Duration          `json:"max_ttl"`

sdk/database/dbplugin/v5/database.go

@@ -135,6 +135,7 @@ type NewUserRequest struct {
 type UsernameMetadata struct {
 	DisplayName string
 	RoleName    string
+	UsernameTemplateMetadata string
 }
 
 // NewUserResponse returns any information Vault needs to know after creating a new user.

sdk/database/dbplugin/v5/grpc_client.go

@@ -126,8 +126,9 @@ func newUserReqToProto(req NewUserRequest) (*proto.NewUserRequest, error) {
 
 	rpcReq := &proto.NewUserRequest{
 		UsernameConfig: &proto.UsernameConfig{
-			DisplayName: req.UsernameConfig.DisplayName,
-			RoleName:    req.UsernameConfig.RoleName,
+			DisplayName:              req.UsernameConfig.DisplayName,
+			RoleName:                 req.UsernameConfig.RoleName,
+			UsernameTemplateMetadata: req.UsernameConfig.UsernameTemplateMetadata,
 		},
 		CredentialType: int32(req.CredentialType),
 		Password:       req.Password,

sdk/database/dbplugin/v5/grpc_server.go

@@ -132,6 +132,7 @@ func (g *gRPCServer) NewUser(ctx context.Context, req *proto.NewUserRequest) (*p
 		UsernameConfig: UsernameMetadata{
 			DisplayName: req.GetUsernameConfig().GetDisplayName(),
 			RoleName:    req.GetUsernameConfig().GetRoleName(),
+			UsernameTemplateMetadata: req.GetUsernameConfig().GetUsernameTemplateMetadata(),
 		},
 		CredentialType:     CredentialType(req.GetCredentialType()),
 		Password:           req.GetPassword(),