Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: TOTP dynamic secret provider #2742

Merged
merged 14 commits into from
Nov 21, 2024
Merged

feat: TOTP dynamic secret provider #2742

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
ba1fd8a
feat: totp dynamic secret
sheensantoscapadngan Nov 15, 2024
269c40c
Merge remote-tracking branch 'origin/main' into feat/totp-dynamic-secret
sheensantoscapadngan Nov 18, 2024
e67218f
misc: finalized option setting logic
sheensantoscapadngan Nov 18, 2024
9f7ea3c
doc: added docs for totp dynamic secret
sheensantoscapadngan Nov 18, 2024
3be3d80
misc: added URL string validation
sheensantoscapadngan Nov 18, 2024
6a17763
docs: dynamic secret doc typos addressed
scott-ray-wilson Nov 20, 2024
b5287d9
misc: addressed comments
sheensantoscapadngan Nov 20, 2024
660c09d
Merge branch 'feat/totp-dynamic-secret' of https://github.com/Infisic…
sheensantoscapadngan Nov 20, 2024
0c38944
feat: added support for configuring totp with secret key
sheensantoscapadngan Nov 20, 2024
bce3f3d
misc: addressed review comments
sheensantoscapadngan Nov 20, 2024
00dcadb
misc: added timer
sheensantoscapadngan Nov 20, 2024
662e588
misc: add handling for lease regen
sheensantoscapadngan Nov 20, 2024
9d618b4
minor text revisions/additions and add colors/icons to totp token exp…
scott-ray-wilson Nov 20, 2024
7b3b232
replace loader with spinner
scott-ray-wilson Nov 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion backend/src/ee/services/dynamic-secret/providers/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ import { RabbitMqProvider } from "./rabbit-mq";
import { RedisDatabaseProvider } from "./redis";
import { SapHanaProvider } from "./sap-hana";
import { SqlDatabaseProvider } from "./sql-database";
import { TotpProvider } from "./totp";

export const buildDynamicSecretProviders = () => ({
[DynamicSecretProviders.SqlDatabase]: SqlDatabaseProvider(),
Expand All @@ -27,5 +28,6 @@ export const buildDynamicSecretProviders = () => ({
[DynamicSecretProviders.AzureEntraID]: AzureEntraIDProvider(),
[DynamicSecretProviders.Ldap]: LdapProvider(),
[DynamicSecretProviders.SapHana]: SapHanaProvider(),
[DynamicSecretProviders.Snowflake]: SnowflakeProvider()
[DynamicSecretProviders.Snowflake]: SnowflakeProvider(),
[DynamicSecretProviders.Totp]: TotpProvider()
});
10 changes: 8 additions & 2 deletions backend/src/ee/services/dynamic-secret/providers/models.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -221,6 +221,10 @@ export const LdapSchema = z.union([
})
]);

export const DynamicSecretTotpSchema = z.object({
url: z.string().url().trim().min(1)
});

export enum DynamicSecretProviders {
SqlDatabase = "sql-database",
Cassandra = "cassandra",
Expand All @@ -234,7 +238,8 @@ export enum DynamicSecretProviders {
AzureEntraID = "azure-entra-id",
Ldap = "ldap",
SapHana = "sap-hana",
Snowflake = "snowflake"
Snowflake = "snowflake",
Totp = "totp"
}

export const DynamicSecretProviderSchema = z.discriminatedUnion("type", [
Expand All @@ -250,7 +255,8 @@ export const DynamicSecretProviderSchema = z.discriminatedUnion("type", [
z.object({ type: z.literal(DynamicSecretProviders.RabbitMq), inputs: DynamicSecretRabbitMqSchema }),
z.object({ type: z.literal(DynamicSecretProviders.AzureEntraID), inputs: AzureEntraIDSchema }),
z.object({ type: z.literal(DynamicSecretProviders.Ldap), inputs: LdapSchema }),
z.object({ type: z.literal(DynamicSecretProviders.Snowflake), inputs: DynamicSecretSnowflakeSchema })
z.object({ type: z.literal(DynamicSecretProviders.Snowflake), inputs: DynamicSecretSnowflakeSchema }),
z.object({ type: z.literal(DynamicSecretProviders.Totp), inputs: DynamicSecretTotpSchema })
]);

export type TDynamicProviderFns = {
Expand Down
70 changes: 70 additions & 0 deletions backend/src/ee/services/dynamic-secret/providers/totp.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,70 @@
import { authenticator } from "otplib";
import { HashAlgorithms } from "otplib/core";

import { BadRequestError } from "@app/lib/errors";
import { alphaNumericNanoId } from "@app/lib/nanoid";

import { DynamicSecretTotpSchema, TDynamicProviderFns } from "./models";

export const TotpProvider = (): TDynamicProviderFns => {
const validateProviderInputs = async (inputs: unknown) => {
const providerInputs = await DynamicSecretTotpSchema.parseAsync(inputs);

const urlObj = new URL(providerInputs.url);
const secret = urlObj.searchParams.get("secret");
if (!secret) {
throw new BadRequestError({
message: "TOTP secret is missing from URL"
});
}

return providerInputs;
};

const validateConnection = async () => {
return true;
};

const create = async (inputs: unknown) => {
const providerInputs = await validateProviderInputs(inputs);

const entityId = alphaNumericNanoId(32);
const authenticatorInstance = authenticator.clone();

const urlObj = new URL(providerInputs.url);
const secret = urlObj.searchParams.get("secret") as string;
const periodFromUrl = urlObj.searchParams.get("period");
const digitsFromUrl = urlObj.searchParams.get("digits");
const algorithm = urlObj.searchParams.get("algorithm");

if (digitsFromUrl) {
authenticatorInstance.options = { digits: +digitsFromUrl };
}

if (algorithm) {
authenticatorInstance.options = { algorithm: algorithm.toLowerCase() as HashAlgorithms };
}

if (periodFromUrl) {
authenticatorInstance.options = { step: +periodFromUrl };
}

return { entityId, data: { TOTP: authenticatorInstance.generate(secret) } };
sheensantoscapadngan marked this conversation as resolved.
Show resolved Hide resolved
};

const revoke = async (inputs: unknown, entityId: string) => {
return { entityId };
};

const renew = async (inputs: unknown, entityId: string) => {
return { entityId };
};

return {
validateProviderInputs,
validateConnection,
create,
revoke,
renew
};
};
6 changes: 3 additions & 3 deletions docs/documentation/platform/dynamic-secrets/aws-elasticache.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ The Infisical AWS ElastiCache dynamic secret allows you to generate AWS ElastiCa
</ParamField>

<ParamField path="Default TTL" type="string" required>
Default time-to-live for a generated secret (it is possible to modify this value when a secret is generate)
Default time-to-live for a generated secret (it is possible to modify this value after a secret is generated)
</ParamField>

<ParamField path="Max TTL" type="string" required>
Expand Down Expand Up @@ -131,12 +131,12 @@ The Infisical AWS ElastiCache dynamic secret allows you to generate AWS ElastiCa

## Audit or Revoke Leases
Once you have created one or more leases, you will be able to access them by clicking on the respective dynamic secret item on the dashboard.
This will allow you see the expiration time of the lease or delete a lease before it's set time to live.
This will allow you to see the expiration time of the lease or delete a lease before it's set time to live.

![Provision Lease](/images/platform/dynamic-secrets/lease-data.png)

## Renew Leases
To extend the life of the generated dynamic secret leases past its initial time to live, simply click on the **Renew** as illustrated below.
To extend the life of the generated dynamic secret leases past its initial time to live, simply click on the **Renew** button as illustrated below.
![Provision Lease](/images/platform/dynamic-secrets/dynamic-secret-lease-renew.png)

<Warning>
Expand Down
6 changes: 3 additions & 3 deletions docs/documentation/platform/dynamic-secrets/aws-iam.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@ Replace **\<account id\>** with your AWS account id and **\<aws-scope-path\>** w
</ParamField>

<ParamField path="Default TTL" type="string" required>
Default time-to-live for a generated secret (it is possible to modify this value when a secret is generate)
Default time-to-live for a generated secret (it is possible to modify this value after a secret is generated)
</ParamField>

<ParamField path="Max TTL" type="string" required>
Expand Down Expand Up @@ -138,12 +138,12 @@ Replace **\<account id\>** with your AWS account id and **\<aws-scope-path\>** w

## Audit or Revoke Leases
Once you have created one or more leases, you will be able to access them by clicking on the respective dynamic secret item on the dashboard.
This will allow you see the lease details and delete the lease ahead of its expiration time.
This will allow you to see the lease details and delete the lease ahead of its expiration time.

![Provision Lease](/images/platform/dynamic-secrets/lease-data.png)

## Renew Leases
To extend the life of the generated dynamic secret lease past its initial time to live, simply click on the **Renew** as illustrated below.
To extend the life of the generated dynamic secret lease past its initial time to live, simply click on the **Renew** button as illustrated below.
![Provision Lease](/images/platform/dynamic-secrets/dynamic-secret-lease-renew.png)

<Warning>
Expand Down
6 changes: 3 additions & 3 deletions docs/documentation/platform/dynamic-secrets/azure-entra-id.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,7 +98,7 @@ Click on Add assignments. Search for the application name you created and select
</ParamField>

<ParamField path="Default TTL" type="string" required>
Default time-to-live for a generated secret (it is possible to modify this value when a secret is generate)
Default time-to-live for a generated secret (it is possible to modify this value after a secret is generated)
</ParamField>

<ParamField path="Max TTL" type="string" required>
Expand Down Expand Up @@ -151,12 +151,12 @@ Click on Add assignments. Search for the application name you created and select

## Audit or Revoke Leases
Once you have created one or more leases, you will be able to access them by clicking on the respective dynamic secret item on the dashboard.
This will allow you see the expiration time of the lease or delete a lease before it's set time to live.
This will allow you to see the expiration time of the lease or delete a lease before it's set time to live.

![Provision Lease](/images/platform/dynamic-secrets/lease-data.png)

## Renew Leases
To extend the life of the generated dynamic secret leases past its initial time to live, simply click on the **Renew** as illustrated below.
To extend the life of the generated dynamic secret leases past its initial time to live, simply click on the **Renew** button as illustrated below.
![Provision Lease](/images/platform/dynamic-secrets/dynamic-secret-lease-renew.png)

<Warning>
Expand Down
6 changes: 3 additions & 3 deletions docs/documentation/platform/dynamic-secrets/cassandra.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ The above configuration allows user creation and granting permissions.
</ParamField>

<ParamField path="Default TTL" type="string" required>
Default time-to-live for a generated secret (it is possible to modify this value when a secret is generate)
Default time-to-live for a generated secret (it is possible to modify this value after a secret is generated)
</ParamField>

<ParamField path="Max TTL" type="string" required>
Expand Down Expand Up @@ -116,12 +116,12 @@ The above configuration allows user creation and granting permissions.

## Audit or Revoke Leases
Once you have created one or more leases, you will be able to access them by clicking on the respective dynamic secret item on the dashboard.
This will allow you see the lease details and delete the lease ahead of its expiration time.
This will allow you to see the lease details and delete the lease ahead of its expiration time.

![Provision Lease](/images/platform/dynamic-secrets/lease-data.png)

## Renew Leases
To extend the life of the generated dynamic secret lease past its initial time to live, simply click on the **Renew** as illustrated below.
To extend the life of the generated dynamic secret lease past its initial time to live, simply click on the **Renew** button as illustrated below.
![Provision Lease](/images/platform/dynamic-secrets/dynamic-secret-lease-renew.png)

<Warning>
Expand Down
6 changes: 3 additions & 3 deletions docs/documentation/platform/dynamic-secrets/elastic-search.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ The Infisical Elasticsearch dynamic secret allows you to generate Elasticsearch
</ParamField>

<ParamField path="Default TTL" type="string" required>
Default time-to-live for a generated secret (it is possible to modify this value when a secret is generate)
Default time-to-live for a generated secret (it is possible to modify this value after a secret is generated)
</ParamField>

<ParamField path="Max TTL" type="string" required>
Expand Down Expand Up @@ -114,12 +114,12 @@ The Infisical Elasticsearch dynamic secret allows you to generate Elasticsearch

## Audit or Revoke Leases
Once you have created one or more leases, you will be able to access them by clicking on the respective dynamic secret item on the dashboard.
This will allow you see the expiration time of the lease or delete a lease before it's set time to live.
This will allow you to see the expiration time of the lease or delete a lease before it's set time to live.

![Provision Lease](/images/platform/dynamic-secrets/lease-data.png)

## Renew Leases
To extend the life of the generated dynamic secret leases past its initial time to live, simply click on the **Renew** as illustrated below.
To extend the life of the generated dynamic secret leases past its initial time to live, simply click on the **Renew** button as illustrated below.
![Provision Lease](/images/platform/dynamic-secrets/dynamic-secret-lease-renew.png)

<Warning>
Expand Down
4 changes: 2 additions & 2 deletions docs/documentation/platform/dynamic-secrets/ldap.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ The Infisical LDAP dynamic secret allows you to generate user credentials on dem
</ParamField>

<ParamField path="Default TTL" type="string" required>
Default time-to-live for a generated secret (it is possible to modify this value when a secret is generate)
Default time-to-live for a generated secret (it is possible to modify this value after a secret is generated)
</ParamField>

<ParamField path="Max TTL" type="string" required>
Expand Down Expand Up @@ -171,7 +171,7 @@ The Infisical LDAP dynamic secret allows you to generate user credentials on dem
</ParamField>

<ParamField path="Default TTL" type="string" required>
Default time-to-live for a generated secret (it is possible to modify this value when a secret is generate)
Default time-to-live for a generated secret (it is possible to modify this value after a secret is generated)
</ParamField>

<ParamField path="Max TTL" type="string" required>
Expand Down
6 changes: 3 additions & 3 deletions docs/documentation/platform/dynamic-secrets/mongo-atlas.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ Create a project scopped API Key with the required permission in your Mongo Atla
</ParamField>

<ParamField path="Default TTL" type="string" required>
Default time-to-live for a generated secret (it is possible to modify this value when a secret is generate)
Default time-to-live for a generated secret (it is possible to modify this value after a secret is generated)
</ParamField>

<ParamField path="Max TTL" type="string" required>
Expand Down Expand Up @@ -101,12 +101,12 @@ Create a project scopped API Key with the required permission in your Mongo Atla

## Audit or Revoke Leases
Once you have created one or more leases, you will be able to access them by clicking on the respective dynamic secret item on the dashboard.
This will allow you see the expiration time of the lease or delete a lease before it's set time to live.
This will allow you to see the expiration time of the lease or delete a lease before it's set time to live.

![Provision Lease](/images/platform/dynamic-secrets/lease-data.png)

## Renew Leases
To extend the life of the generated dynamic secret leases past its initial time to live, simply click on the **Renew** as illustrated below.
To extend the life of the generated dynamic secret leases past its initial time to live, simply click on the **Renew** button as illustrated below.
![Provision Lease](/images/platform/dynamic-secrets/dynamic-secret-lease-renew.png)

<Warning>
Expand Down
6 changes: 3 additions & 3 deletions docs/documentation/platform/dynamic-secrets/mongo-db.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ Create a user with the required permission in your MongoDB instance. This user w
</ParamField>

<ParamField path="Default TTL" type="string" required>
Default time-to-live for a generated secret (it is possible to modify this value when a secret is generate)
Default time-to-live for a generated secret (it is possible to modify this value after a secret is generated)
</ParamField>

<ParamField path="Max TTL" type="string" required>
Expand Down Expand Up @@ -103,12 +103,12 @@ Create a user with the required permission in your MongoDB instance. This user w

## Audit or Revoke Leases
Once you have created one or more leases, you will be able to access them by clicking on the respective dynamic secret item on the dashboard.
This will allow you see the expiration time of the lease or delete a lease before it's set time to live.
This will allow you to see the expiration time of the lease or delete a lease before it's set time to live.

![Provision Lease](/images/platform/dynamic-secrets/lease-data.png)

## Renew Leases
To extend the life of the generated dynamic secret leases past its initial time to live, simply click on the **Renew** as illustrated below.
To extend the life of the generated dynamic secret leases past its initial time to live, simply click on the **Renew** button as illustrated below.
![Provision Lease](/images/platform/dynamic-secrets/dynamic-secret-lease-renew.png)

<Warning>
Expand Down
6 changes: 3 additions & 3 deletions docs/documentation/platform/dynamic-secrets/mssql.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ Create a user with the required permission in your SQL instance. This user will
</ParamField>

<ParamField path="Default TTL" type="string" required>
Default time-to-live for a generated secret (it is possible to modify this value when a secret is generate)
Default time-to-live for a generated secret (it is possible to modify this value after a secret is generated)
</ParamField>

<ParamField path="Max TTL" type="string" required>
Expand Down Expand Up @@ -105,12 +105,12 @@ Create a user with the required permission in your SQL instance. This user will

## Audit or Revoke Leases
Once you have created one or more leases, you will be able to access them by clicking on the respective dynamic secret item on the dashboard.
This will allow you see the expiration time of the lease or delete the lease before it's set time to live.
This will allow you to see the expiration time of the lease or delete the lease before it's set time to live.

![Provision Lease](/images/platform/dynamic-secrets/lease-data.png)

## Renew Leases
To extend the life of the generated dynamic secret leases past its initial time to live, simply click on the **Renew** as illustrated below.
To extend the life of the generated dynamic secret leases past its initial time to live, simply click on the **Renew** button as illustrated below.
![Provision Lease](/images/platform/dynamic-secrets/dynamic-secret-lease-renew.png)

<Warning>
Expand Down
6 changes: 3 additions & 3 deletions docs/documentation/platform/dynamic-secrets/mysql.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ Create a user with the required permission in your SQL instance. This user will
</ParamField>

<ParamField path="Default TTL" type="string" required>
Default time-to-live for a generated secret (it is possible to modify this value when a secret is generate)
Default time-to-live for a generated secret (it is possible to modify this value after a secret is generated)
</ParamField>

<ParamField path="Max TTL" type="string" required>
Expand Down Expand Up @@ -102,12 +102,12 @@ Create a user with the required permission in your SQL instance. This user will

## Audit or Revoke Leases
Once you have created one or more leases, you will be able to access them by clicking on the respective dynamic secret item on the dashboard.
This will allow you see the expiration time of the lease or delete a lease before it's set time to live.
This will allow you to see the expiration time of the lease or delete a lease before it's set time to live.

![Provision Lease](/images/platform/dynamic-secrets/lease-data.png)

## Renew Leases
To extend the life of the generated dynamic secret leases past its initial time to live, simply click on the **Renew** as illustrated below.
To extend the life of the generated dynamic secret leases past its initial time to live, simply click on the **Renew** button as illustrated below.
![Provision Lease](/images/platform/dynamic-secrets/dynamic-secret-lease-renew.png)

<Warning>
Expand Down
6 changes: 3 additions & 3 deletions docs/documentation/platform/dynamic-secrets/oracle.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ Create a user with the required permission in your SQL instance. This user will
</ParamField>

<ParamField path="Default TTL" type="string" required>
Default time-to-live for a generated secret (it is possible to modify this value when a secret is generate)
Default time-to-live for a generated secret (it is possible to modify this value after a secret is generated)
</ParamField>

<ParamField path="Max TTL" type="string" required>
Expand Down Expand Up @@ -102,12 +102,12 @@ Create a user with the required permission in your SQL instance. This user will

## Audit or Revoke Leases
Once you have created one or more leases, you will be able to access them by clicking on the respective dynamic secret item on the dashboard.
This will allow you see the expiration time of the lease or delete a lease before it's set time to live.
This will allow you to see the expiration time of the lease or delete a lease before it's set time to live.

![Provision Lease](/images/platform/dynamic-secrets/lease-data.png)

## Renew Leases
To extend the life of the generated dynamic secret leases past its initial time to live, simply click on the **Renew** as illustrated below.
To extend the life of the generated dynamic secret leases past its initial time to live, simply click on the **Renew** button as illustrated below.
![Provision Lease](/images/platform/dynamic-secrets/dynamic-secret-lease-renew.png)

<Warning>
Expand Down
Loading
Loading