Page MenuHomeDevCentral

Allow Salt policy to create admin-level tokens
ClosedPublic

Authored by dereckson on Jul 7 2024, 13:19.
Tags
None
Referenced Files
F3711599: D3355.diff
Sun, Nov 3, 04:25
Unknown Object (File)
Thu, Oct 31, 14:55
Unknown Object (File)
Thu, Oct 31, 00:25
Unknown Object (File)
Sun, Oct 27, 11:46
Unknown Object (File)
Sun, Oct 27, 11:32
Unknown Object (File)
Sat, Oct 26, 06:44
Unknown Object (File)
Thu, Oct 24, 22:31
Unknown Object (File)
Thu, Oct 24, 11:45
Subscribers
None

Details

Summary

To allow a self-service token generation in Complector, allows the
Salt primary policy to issue tokens for the admin role.

Ref T1975.

Test Plan

Issue an admin token with salt-primary policy

Diff Detail

Repository
rOPS Nasqueron Operations
Lint
Lint Passed
Unit
No Test Coverage
Branch
vault-self-service-token-policy
Build Status
Buildable 5333
Build 5614: arc lint + arc unit

Event Timeline

dereckson created this revision.

This is not the correct paths -> Salt returns a 403 when using this policy.

It works with an overkill path "auth/*".

dereckson retitled this revision from Allow Salt to create admin-level tokens to Allow Salt policy to create admin-level tokens.Jul 7 2024, 13:58

By the way, the token used by Salt has the following properties:

metadata: {'role_name': 'salt_primary'}
policies: ['default', 'salt', 'salt-node-complector']

It means the policies read are salt (stable) and salt-node-complector (depends of the server name).

To be able to use auth/token/create/admin, it needs a role admin, let's add it to the DRP bootstrap script:

vault write auth/token/roles/admin allowed_policies=admin period=30d
This revision is now accepted and ready to land.Aug 5 2024, 19:14