secret/database: ensure plugins are closed if they cannot be initialized

builtin/logical/database/dbplugin/client.go

@@ -1,6 +1,7 @@
 package dbplugin
 
 import (
+	"context"
 	"errors"
 	"sync"
 
@@ -18,13 +19,25 @@ type DatabasePluginClient struct {
 	Database
 }
 
+// This wraps the Close call and ensures we both close the database connection
+// and kill the plugin.
 func (dc *DatabasePluginClient) Close() error {
 	err := dc.Database.Close()
 	dc.client.Kill()
 
 	return err
 }
 
+// This wraps the Initialize call and ensures we close the plugin on error.
+func (dc *DatabasePluginClient) Initialize(ctx context.Context, config map[string]interface{}, verifyConnection bool) error {
+	err := dc.Database.Initialize(ctx, config, verifyConnection)
+	if err != nil {
+		dc.Close()
+	}
+
+	return err
+}
+
 // newPluginClient returns a databaseRPCClient with a connection to a running
 // plugin. The client is wrapped in a DatabasePluginClient object to ensure the
 // plugin is killed on call of Close().

builtin/logical/database/path_config_connection.go

@@ -233,7 +233,6 @@ func (b *databaseBackend) connectionWriteHandler() framework.OperationFunc {
 
 		err = db.Initialize(ctx, config.ConnectionDetails, verifyConnection)
 		if err != nil {
-			db.Close()
 			return logical.ErrorResponse(fmt.Sprintf("error creating database object: %s", err)), nil
 		}