Closed georgeskill closed 5 months ago
@georgeskill Thanks for the bug report. I've added this to our sprint.
@georgeskill FYI, if you can run your Vault server with log at DEBUG level, you will see logs showing which TTL is used: https://github.com/jfrog/vault-plugin-secrets-artifactory/blob/09b183deb2445b1540179b94b1feedf3fb6b9245/path_user_token_create.go#L127 and https://github.com/jfrog/vault-plugin-secrets-artifactory/blob/09b183deb2445b1540179b94b1feedf3fb6b9245/path_user_token_create.go#L130 and https://github.com/jfrog/vault-plugin-secrets-artifactory/blob/09b183deb2445b1540179b94b1feedf3fb6b9245/path_user_token_create.go#L139
@alexhung Thanks for the prompt response. Here are the logs when running these commands:
2024-03-07T22:16:34.963Z [DEBUG] system: pinning plugin version: plugin type=secret plugin name=artifactory_1.3 plugin version=v1.3.0
2024-03-07T22:16:34.963Z [DEBUG] core: spawning a new plugin process: plugin_name=artifactory_1.3 id=UdsiXFXYdB
2024-03-07T22:16:35.010Z [INFO] secrets.artifactory_1.3.artifactory_1.3_9868e52f.artifactory_1.3: configuring client automatic mTLS
2024-03-07T22:16:35.017Z [DEBUG] secrets.artifactory_1.3.artifactory_1.3_9868e52f.artifactory_1.3: starting plugin: path=/home/admin/vault-engine-github-token/vault/plugins/artifactory_1.3 args=["/home/admin/vault-engine-github-token/vault/plugins/artifactory_1.3"]
2024-03-07T22:16:35.017Z [DEBUG] secrets.artifactory_1.3.artifactory_1.3_9868e52f.artifactory_1.3: plugin started: path=/home/admin/vault-engine-github-token/vault/plugins/artifactory_1.3 pid=3079259
2024-03-07T22:16:35.017Z [DEBUG] secrets.artifactory_1.3.artifactory_1.3_9868e52f.artifactory_1.3: waiting for RPC address: plugin=/home/admin/vault-engine-github-token/vault/plugins/artifactory_1.3
2024-03-07T22:16:35.026Z [INFO] secrets.artifactory_1.3.artifactory_1.3_9868e52f.artifactory_1.3.artifactory_1.3: configuring server automatic mTLS: timestamp=2024-03-07T22:16:35.026Z
2024-03-07T22:16:35.039Z [DEBUG] secrets.artifactory_1.3.artifactory_1.3_9868e52f.artifactory_1.3.artifactory_1.3: plugin address: address=/tmp/plugin221858565 network=unix timestamp=2024-03-07T22:16:35.039Z
2024-03-07T22:16:35.039Z [DEBUG] secrets.artifactory_1.3.artifactory_1.3_9868e52f.artifactory_1.3: using plugin: version=5
2024-03-07T22:16:35.061Z [INFO] core: successful mount: namespace="" path=artifactory/ type=artifactory_1.3 version=v1.3.0
2024-03-07T22:16:50.751Z [DEBUG] system: pinning plugin version: plugin type=secret plugin name=artifactory plugin version=v1.2.0
2024-03-07T22:16:50.752Z [ERROR] secrets.system.system_b2f79b80: error occurred during enable mount: path=artifactory/ error="path is already in use at artifactory/"
2024-03-07T22:16:56.520Z [DEBUG] system: pinning plugin version: plugin type=secret plugin name=artifactory_1.3 plugin version=v1.3.0
2024-03-07T22:16:56.520Z [ERROR] secrets.system.system_b2f79b80: error occurred during enable mount: path=artifactory/ error="path is already in use at artifactory/"
2024-03-07T22:17:48.493Z [INFO] secrets.artifactory_1.3.artifactory_1.3_9868e52f.artifactory_1.3.artifactory_1.3: fetching user token configuration: path=config/user_token timestamp=2024-03-07T22:17:48.493Z
2024-03-07T22:17:48.494Z [INFO] secrets.artifactory_1.3.artifactory_1.3_9868e52f.artifactory_1.3.artifactory_1.3: saving user token configuration: path=config/user_token timestamp=2024-03-07T22:17:48.494Z
2024-03-07T22:17:56.381Z [INFO] secrets.artifactory_1.3.artifactory_1.3_9868e52f.artifactory_1.3.artifactory_1.3: fetching user token configuration: path=config/user_token/<user_token> timestamp=2024-03-07T22:17:56.381Z
2024-03-07T22:17:56.382Z [DEBUG] secrets.artifactory_1.3.artifactory_1.3_9868e52f.artifactory_1.3.artifactory_1.3: initialize maxLeaseTTL to system value: maxLeaseTTL="2.7648e+15" timestamp=2024-03-07T22:17:56.382Z
2024-03-07T22:17:56.382Z [DEBUG] secrets.artifactory_1.3.artifactory_1.3_9868e52f.artifactory_1.3.artifactory_1.3: Max lease TTL (sec): maxLeaseTTL="2.7648e+15" timestamp=2024-03-07T22:17:56.382Z
2024-03-07T22:17:56.382Z [DEBUG] secrets.artifactory_1.3.artifactory_1.3_9868e52f.artifactory_1.3.artifactory_1.3: TTL (sec): ttl="2.7648e+15" timestamp=2024-03-07T22:17:56.382Z
Describe the bug The default TTL for tokens is not being applied to user tokens in V1.3. V1.2 applied the correct default TTL to user tokens, but V1.3 has broken my org's TTL policy.
To Reproduce When using the V1.3 plugin, I run these commands:
vault secrets enable -path=artifactory artifactory_1.3
vault write artifactory/config/admin url=<artifactory_instanceurl.com> access_token=<token>
vault write artifactory/config/user_token scope="applied-permissions/user" default_ttl=24h max_ttl=48h default_description="Generated by Vault"
vault read artifactory/user_token/<username>
This is the output of the previous command:
The lease duration is not connected to the default_ttl. Whereas, when I run the exact same commands with version 1.2 of the plugin, my user token's TTL is correct.
Here is my vault config:
I am interacting with an Artifactory instance that is running version EnterpriseX 7.77.5
Requirements for and issue
curl
it at$host/artifactory/api/system/version
Expected behavior The default TTL should be honored for user tokens with V1.3
Desktop (please complete the following information):