Closed loicgreffier closed 4 months ago
@loicgreffier Thanks for the report. I've added this to our plan.
@loicgreffier When max-lease-ttl
is not explicitly set, the plugin uses max lease TTL configured in your Vault server by default. (https://github.com/jfrog/vault-plugin-secrets-artifactory/blob/master/path_user_token_create.go#L116) IIRC that's 768 hours: https://developer.hashicorp.com/vault/docs/configuration#max_lease_ttl
Is this an expected behaviour? If yes, is setting the max-lease-ttl when mounting the secret engine the proper way to definitely limit the max_ttl?
@loicgreffier Without diving into the code, I'd say yes. Using max-least-ttl
arg or change your Vault global configuration are the ways to limit the token's max_ttl
.
@alexhung Thanks for the feedback. I guess the issue can be closed as this is the expected behaviour
Describe the bug When configuring a
max_ttl
at the plugin level, the value can be overidden and thus exceeded by a specific request.To Reproduce Steps to reproduce the behavior:
The
max_ttl
is 2 hours. Thedefault_ttl
is 1 hour.max_ttl
and adefault_ttl
that exceed themax_ttl
configured on the plugin➡️ The lease duration is exceeding the
max_ttl
configured at the plugin level.max-lease-ttl
and adefault-lease-ttl
artifactory2
plugin just like theartifactory
plugin, and ask for a token that exceeds themax-lease-ttl
The lease duration is limited to 2 hours no matter the
max_ttl
parameter.Requirements for and issue
Expected behavior
Reading the documentation: https://github.com/jfrog/vault-plugin-secrets-artifactory?tab=readme-ov-file#user-token-path, I was expecting the
max_ttl
to be limited to themax_ttl
configured at plugin level (2 hours in this scenario), no matter if the user is giving amax_ttl
parameter.When setting the
max-lease-ttl
at the secret mount level, themax_ttl
cannot be exceed as expected.Is this an expected behaviour? If yes, is setting the
max-lease-ttl
when mounting the secret engine the proper way to definitely limit themax_ttl
?