BUSINESS PROBLEM
Allow the Venafi vault monitor to self-manage its access to Trust Protection Platform via token authentication where initialization begins with either username/password, client certificate, or refresh token.
PROPOSED SOLUTIONvenafi_credential Resource
Arguments (input):
username
password (sensitive)
refresh_token (sensitive)
Attributes (output):
access_token (sensitive, intended to be fed into venafi_certificate resource)
expiration (date/time)
refresh_token (sensitive)
On issue/{role}:
if expiration is set
if expiration > now - refresh_window and
refresh_token is set, then get new token(s) by calling POST /vedauth/authorize/token
username & password are set, then get new token(s) by calling POST /vedauth/authorize
else do nothing
else (expiration is not set) and
username & password are set, then get new token(s) by calling POST /vedauth/authorize
refresh_token is set, then get new token(s) by calling POST /vedauth/authorize/token
if POST /vedauth/authorize/token fails above and
username & password are set, then get new token(s) by calling POST /vedauth/authorize
CURRENT ALTERNATIVES
Use VCert CLI getcred or direct REST API /vedauth calls to get an access_token which can then be used directly by the venafi_policy resource.
BUSINESS PROBLEM Allow the Venafi vault monitor to self-manage its access to Trust Protection Platform via token authentication where initialization begins with either username/password, client certificate, or refresh token.
PROPOSED SOLUTION
venafi_credential
ResourceArguments (input):
username
password
(sensitive)refresh_token
(sensitive)Attributes (output):
access_token
(sensitive, intended to be fed intovenafi_certificate
resource)expiration
(date/time)refresh_token
(sensitive)On issue/{role}:
expiration
is setexpiration
> now -refresh_window
andrefresh_token
is set, then get new token(s) by calling POST /vedauth/authorize/tokenusername
&password
are set, then get new token(s) by calling POST /vedauth/authorizeexpiration
is not set) andusername
&password
are set, then get new token(s) by calling POST /vedauth/authorizerefresh_token
is set, then get new token(s) by calling POST /vedauth/authorize/tokenusername
&password
are set, then get new token(s) by calling POST /vedauth/authorizeCURRENT ALTERNATIVES Use VCert CLI
getcred
or direct REST API /vedauth calls to get anaccess_token
which can then be used directly by thevenafi_policy
resource.