Re: [PATCH cluster 1/9] datacenter config: add token-policy option

[Thomas Lamprecht <t.lamprecht@proxmox.com>]

Am 10.11.26 um 16:05 schrieb Shannon Sterz:
>> +    'disallow-expiry-changes' => {
>> +        type => 'boolean',
>> +        optional => 1,
>> +        default => 0,
>> +        description => "Disallow changing the expiration date of existing API tokens, so that"
>> +            . " 'max-lifetime' cannot be circumvented by extending tokens repeatedly. Such"
>> +            . " tokens can still be deleted and recreated.",
> currently this also seems to disallow setting an expiry for old tokens
> or shortening the lifetime of an existing token with a pre-existing
> expiry. while this may be intentional, id argue this makes compliance
> less convenient to achieve.
> 
> auditors may want an admin to set an expiry asap on a token without one.
> this option would allow only removing the old token and creating a new
> one as an option. creating a new token with specific permissions may be
> cumbersome.
> 
> since there is no downside to shortening a token lifetime, im not sure
> what the value here is. especially if we do decide to allow lifetime
> extensions by secret regeneration.
> 
> the rational here also only talks about avoid lifetime extension, so at
> the very least it should maybe also mention why lifetime shortening is
> also disallowed.

Yeah allowing shortening of live-time would be fine.

Not directly related, but wondering about a general flags for
"allow new token creation" and "allow token usage" as sort of emergency
stop for containment. But if, then something for its own series.