Skip to main content

Public

Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.

    •  
      story #11239 generate dynamic credentials from HashiCorp Vault into a Tuleap instance
    Actions
    Summary
    Empty
    generate dynamic credentials from HashiCorp Vault into a Tuleap instance
    I can temporarily connect as a site administrator to a Tuleap instance to help users
    •  Feature is available through a dedicated Tuleap plugin and a HashiCorp Vault plugin
    • Two REST routes are added in the Tuleap side:
      • POST (username, password, expiration, signature)
      • DELETE (username, signature)
    • All requests made to the REST routes are authenticated with public-key signatures
      • Private key is generated and stored directly and only in HashiCorp Vault
      • Public key is set in the configuration file of the plugin
      • Cryptography rely upon libsodium (Ed25519 signatures)
    • When the account expires or is revoked, the user is immediately logs out
    • It is not possible to recreate a user account that has been revoked (a call to the DELETE route) with the same username until it has reached the expiration date to avoid replay attacks
    • The HashiCorp Vault plugin only accepts to query a Tuleap instance over HTTPS
    • Tuleap plugin is not designed to handle queries from multiple HashiCorp Vault instances. If it happens credential creation request might fail.
    By Thomas Gerbet (tgerbet)
    (39 kB)
    sequence_vault_tuleap.png
    Empty
    Status
    Empty
    Done
    Development
    • [ ] Does it involves User Interface? 
    • [ ] Are there any mockups?
    • [ ] Are permissions checked?
    • [ ] Does it need Javascript development?
    • [ ] Does it need a forge upgrade bucket?
    • [ ] Does it need to execute things in system events?
    • [ ] Does it impact project creation (templates)?
    • [ ] Is it exploratory?
    Empty
    Details
    #11239
    Thomas Gerbet (tgerbet)
    2018-03-28 09:47
    2018-03-05 15:05
    11569

    References
    Artifact links
    Empty
    Referencing story #11239

    Artifact Tracker v5

    rel #10994 9.19

    Git commit

    tuleap/tuleap/stable

    Introduce the dynamic credentials plugin 5b1de3822c
    User avatar Thomas Gerbet (tgerbet) , 2018-03-06 17:43
    A set of credentials can be created dynamically from the REST route 9284ecf6cf
    User avatar Thomas Gerbet (tgerbet) , 2018-03-07 18:06
    Authenticate requests made the dynamic credentials REST API 8ebd589caa
    User avatar Thomas Gerbet (tgerbet) , 2018-03-08 13:10
    empty.php should stay empty 02e3a03f0d
    User avatar Nicolas Terray (nterray) , 2018-03-08 15:57
    A set of credential managed by the dynamic credentials plugin can be revoked 26c2710e90
    User avatar Thomas Gerbet (tgerbet) , 2018-03-09 15:38
    empty.php should stay empty (again) d495a98f0d
    Nicolas Terray , 2018-03-12 10:39
    Add access control headers on every routes of the dynamic credentials plugin 0b081076f2
    User avatar Thomas Gerbet (tgerbet) , 2018-03-19 09:53
    Potential fatal error when signature is wrong on dynamic credentials REST routes c5ffa8cb61
    User avatar Thomas Gerbet (tgerbet) , 2018-03-19 10:50
    Dynamic credential can be used to login on the instance a363342f02
    User avatar Thomas Gerbet (tgerbet) , 2018-03-20 16:59
    "Jamais deux sans trois" 3d08274604
    User avatar Nicolas Terray (nterray) , 2018-03-21 08:51
    Realname of the dynamic user can be configured 8d39151500
    User avatar Thomas Gerbet (tgerbet) , 2018-03-21 09:41
    Daily cleanup of the expired credentials from the database fc43e2cbd0
    User avatar Thomas Gerbet (tgerbet) , 2018-03-21 12:38
    Fatal error when revoking a credential before the expiration date 41a1f9b952
    User avatar Thomas Gerbet (tgerbet) , 2018-03-23 15:21
    Package the dynamic credentials plugin 933f6b28fc
    User avatar Thomas Gerbet (tgerbet) , 2018-03-26 10:54
    Fix unresolvable dependency of the dynamic credentials plugin c3bbb108b5
    User avatar Thomas Gerbet (tgerbet) , 2018-03-28 00:02
    Display settings

    Follow-ups

    User avatar
    Thomas Gerbet (tgerbet)2018-03-26 14:54
    Using 443/TCP is not mandatory, Vault plugin is capable to handle host on different port. HTTPS is still mandatory though.
    • Acceptance criteria
      Something went wrong, the follow up content couldn't be loaded
      Only formatting have been changed, you should switch to markup to see the changes
    User avatar
    Thomas Gerbet (tgerbet)2018-03-07 15:10
    • Acceptance criteria
      Something went wrong, the follow up content couldn't be loaded
      Only formatting have been changed, you should switch to markup to see the changes
    User avatar
    Thomas Gerbet (tgerbet)2018-03-06 16:16
    • Acceptance criteria
      Something went wrong, the follow up content couldn't be loaded
      Only formatting have been changed, you should switch to markup to see the changes