Re: [PATCH cluster/access-control/manager/docs/proxmox 0/9] fix #7805: add a datacenter-wide API token policy

[Thomas Lamprecht <t.lamprecht@proxmox.com>]

Hi, and thanks for your comments - appreciated!

Am 10.11.26 um 16:05 schrieb Shannon Sterz:
> one high level question: If I didn't miss anything, adding a token
> policy would break compatibility with PDM to an extend, since its wizard
> doesn't currently set any expiry. This is mostly relevant when using
> PDM's wizard for adding remotes and manually adding a token as a
> workaround should still work, but an expiry policy makes this
> cumbersome.
> 
> A nice follow up here might be adding an option that automatically set
> the current max token lifetime as the expiry. PDM could also be taught
> to rotate token secrets automatically somewhat analogously to my TLS
> certificate rotation series. For that an option to allow expiry
> extension on secret rotation only would be useful.

Yeah, that seems sensible, then the backend can abstract support for
this away and we do not need to differentiate in the frontend.

> IMO, the security impact of allowing an extension when the secret is
> regenerated is essentially 0 as creating a new token with a long expiry
> as is left for the old token is always possible. It would also encourage
> setting less broad permissions as they don't have to be re-added every
> time the token expires.
> 
> What do you think?

Agree fully, would be a sensible approach. I'll see if I can prepate this
for the v2 already, probably as dedicated series that builds upon this
here.