Developing an RDS DB2 plugin for Vault

Hi gang -
TLDR: where is the DB version getting set, and how can I get past the checksum error?
Longer:
We’re trying to get a plugin built so we can use Vault to manage database users and groups in RDS DB2. It feels like we’re getting close(ish), but when we try to connect to DB2 using the plugin we’ve built we get this error -

Error writing data to database/config/db2: Error making API request.

URL: PUT http://127.0.0.1:8200/v1/database/config/db2
Code: 400. Errors:

  • error creating database object: invalid database version: 2 errors occurred:
    * checksums did not match
    * checksums did not match

The initialize function looks like this

func (d *db2) Initialize(ctx context.Context, req dbplugin.InitializeRequest) (dbplugin.InitializeResponse, error) {
usernameTemplate, err := strutil.GetString(req.Config, “username_template”)
if err != nil {
return dbplugin.InitializeResponse{}, fmt.Errorf(“failed to retrieve username_template: %w”, err)
}
if usernameTemplate == “” {
usernameTemplate = defaultUserNameTemplate
}
up, err := template.NewTemplate(template.Template(usernameTemplate))
if err != nil {
return dbplugin.InitializeResponse{}, fmt.Errorf(“unable to initialize username template: %w”, err)
}
d.usernameProducer = up

_, err = d.usernameProducer.Generate(dbplugin.UsernameMetadata{})
if err != nil {
return dbplugin.InitializeResponse{}, fmt.Errorf(“Invalid username template: %w”, err)
}

err = d.SQLConnectionProducer.Initialize(ctx, req.Config, req.VerifyConnection)
if err != nil {
return dbplugin.InitializeResponse{}, err
}

resp := dbplugin.InitializeResponse{
Config: req.Config,
}
resp.SetSupportedCredentialTypes(dbplugin.CredentialType{
dbplugin.CredentialTypePassword,
dbplugin.CredentialTypeClientCertificate,
})
return resp, nil
}

Are you disabling and deregistering the secrets engine/plugin and then re-registering and enabling it again after code changes?

When you register a plugin you must calculate the SHA256 sum of the compiled plugin binary. If that SHA256 sum changes, Vault should throw a “checksums did not match” to protect you from malicious actors inserting a new binary.