-
Notifications
You must be signed in to change notification settings - Fork 59
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
hashi_vault - enable use of tokens without lookup-self #24
hashi_vault - enable use of tokens without lookup-self #24
Conversation
Codecov Report
@@ Coverage Diff @@
## main #24 +/- ##
==========================================
- Coverage 64.73% 63.98% -0.75%
==========================================
Files 1 1
Lines 224 236 +12
Branches 44 42 -2
==========================================
+ Hits 145 151 +6
- Misses 64 71 +7
+ Partials 15 14 -1
Continue to review full report at Codecov.
|
@rasta-rocket could you try out this change? |
da20fd6
to
9a1470e
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Just a little change
Great job 👍 💪👍 💪👍 💪👍 💪
Co-authored-by: Bruno FERNANDO <bruno.fernando@jobteaser.com>
Thanks @rasta-rocket good catch! |
Hey @rasta-rocket looking to get this merged and released, if you have a moment do you mind reviewing once more? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Rest looks fine (didn't look at tests).
Co-authored-by: Felix Fontein <felix@fontein.de>
SUMMARY
Fixes #18
The issue has most of the technical information.
The method we use to determine if a token is valid relies on the token having the ability to lookup itself. By default, all tokens inherit the "default" policy in Vault, and by default the default policy contains that capability.
However when you create a token you may request that it doesn't include the default policy. You may also modify an installation's default policy to remove this capability.
In these cases, it would be impossible to use that (perfectly valid) token with this plugin, because it would fail early attempts to validate it.
This PR adds a new option allowing you to optionally disable that early validation.
When disabled, the token will be used to query a secret without any other checks. This means that if your token is expired or otherwise invalid, you will see the same error message as if your token wasn't granted the right permission.
token_validate
to control whether a token should be validatedISSUE TYPE
COMPONENT NAME
hashi_vault.py
ADDITIONAL INFORMATION