feat(ssh): add HashiCorp Vault SSH signer authentication#912
Open
devdanetra wants to merge 1 commit into
Open
Conversation
Add a new "vault" authentication method where users authenticate to HashiCorp Vault via an interactive OIDC flow and Vault's SSH CA issues a short-lived certificate for an ephemeral keypair. No tokens, AppRole secrets, or long-lived private keys are ever stored. - vault_profiles: shareable, secret-free connection settings (Vault address/namespace, OIDC mount+role, SSH signer mount+role, principals, key type) with an admin-gated `shared` flag visible to all users. - vault_tokens: transient per-user cache of the ephemeral key + signed cert, encrypted under the user's DEK, valid only until cert expiry. - Interactive Vault OIDC flow mirroring OPKSSH: auth_url -> browser -> /vault/oidc/callback -> Vault token -> sign ephemeral key -> connect via the existing certificate-auth machinery. - Frontend: vault auth option + profile selector and inline profile manager in the host editor, plus the OIDC popup choreography. - Tests: unit coverage for keygen, certificate expiry parsing, and the Vault HTTP contract (mocked), plus a live-Vault integration test guarded by VAULT_ADDR/VAULT_TOKEN. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add a new "vault" authentication method where users authenticate to HashiCorp Vault via an interactive OIDC flow and Vault's SSH CA issues a short-lived certificate for an ephemeral keypair. No tokens, AppRole secrets, or long-lived private keys are ever stored.
sharedflag visible to all users./vault/oidc/callback -> Vault token -> sign ephemeral key -> connect via the existing certificate-auth machinery.
Overview
Short summary of what this PR does
Changes Made
Detailed explanation of changes (if needed)
Related Issues
Link any issues this PR addresses
Screenshots / Demos
(Optional: add before/after screenshots, GIFs, or console output)
Checklist