Comments (2)
This problem goes a little deeper than first thought. The real issue is that there needs to be two-way, secure communications between all of the daemons involved -- the CredD, the CredMon, and the OAuthCredMon Flask app. Here's the list of what needs to needs to be sent securely that cannot be done without the Flask app running as root or using an underprivileged directory to store credentials (and other items):
- From CredD to Flask app: OAuth client_secrets (i.e. the "key file")
- From Flask app to CredMon: OAuth tokens
I'm considering writing a full design doc to help elicit feedback, but here's my current thinking:
We can always add more endpoints to the Flask app. For (1), have the CredD send the key file ClassAds over HTTPS. We can use filesystem authentication to prove that requests are coming from a rootly CredD. Similarly, for (2), have the CredD request a token pickup directory to have the CredMon watch* from the Flask app when it is launched. Again, use the filesystem to authenticate that the request is coming from a root-owned process.
*The biggest question remaining is how to have the CredMon watch a directory such that tokens are transferred ASAP to the SEC_CREDENTIAL_DIRECTORY
after being written. First thought is to use inotify or (failing that) frequent polling. However, the python-inotify
RHEL package is from an older implementation that is no longer being maintained (based on the Issues list, it's broken starting with Python 3.5) rather than a more current implementation. Another option would be allow some way for the Flask app to send the CredD or CredMon a command. One way to do this would be to drop the CredMon's euid to whatever the Flask app is running as so that the Flask app can send the CredMon a signal.
from scitokens-credmon.
Working out of https://github.com/jasoncpatton/scitokens-credmon/tree/secure_creddir for this, will set up a PR after some commits.
from scitokens-credmon.
Related Issues (17)
- Create helpful README HOT 3
- Add self-signed credmon
- WSGI/Docker implementation for the OAuth Credmon Webserver HOT 2
- Key file cleanup HOT 1
- Problem when returning from OAuth provider when using custom-named providers
- Don't log secrets
- Report more precise errors if cannot write or read token files HOT 1
- Proper system packaging of credmon HOT 4
- TODO: have condor_credmon properly parse command line arguments
- Make deploy script configurable/universal
- Abandon install script, install commented configs and provide examples HOT 1
- Proper logging of flask app
- Newer versions of HTCondor may store credentials differently HOT 1
- Interoperability between OAuth Credmon and Local Issuer Credmon
- Put main credmon script in sbin HOT 2
- Check aliveness of credmon threads HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from scitokens-credmon.