Repository navigation
Credential fall back #168
Description
I have the following use case:
- I want to run a bash script to execute several cloudmonkey commands.
- These commands should get executed by a specific user.
- I'm passing the APIkey and Secret as parameter to the script.
- These commands will clean up all the resources in this account the user has permission for.
- At the beginning of my script I do set the APIkey and secret which arestored in the .cmk/config file.
- Now the config file has the username and password for my admin account and the APIkey and secret for my regular user account.
Now I see a behavior which will cause issues:
- If I pass now a wrong APIkey and/or Secret to cmk or my script (e.q. typo by mistake) then the username and password (for my admin account) is used automatically.
- In my case I'm in the wrong account and can potentially delete all the resources the admin account has permission and not just the user.
Activity
DaanHoogland commentedon Aug 6, 2025
@ingox , this kind of sounds like a bash scripting issue and not a cmk issue. Can you explain your setup a bit more?
It sounds like you should have two profiles in .cmk/config and call cmk with -p to execute the different commands.
shwstppr commentedon Aug 6, 2025
@ingox I think this can be prevented if you can use different profiles with
set profile, ie, before setting apikey/secrekey, set a new profileingox commentedon Aug 6, 2025
Leave that bash thing out for now. Here are the steps:
That is quite risky from my point of view.
shwstppr commentedon Aug 6, 2025
Thanks @ingox for the clarification. I understand your issue now. I'll check and update
access: prevent login with username-password when using wrong keys
DaanHoogland commentedon Aug 8, 2025
@ingox @shwstppr @weizhouapache , if we start wit (just) -s and -k we cannot ignore the profile as we do not have the url (and maybe domain)?
So if we log in like this and the keys are wrong, we are still going to the url from a profile. Actually to the currently configured as default. A retry with name/password would make sense. In the PR @weizhouapache suggests to forget about the default profile if -s/-k are used. That would make sense, but the url is still needed so not entirely possible. What we could do is set a flag internally when -s/-k is used on the cli to not retry, or to not try anything but the keys.
thoughts?
ingox commentedon Aug 8, 2025
@DaanHoogland I like the approach you're suggesting. Same behavior happen if you logged in to the console with right keys once but stored the wrong information into the config file. Means anytime the key and secret are used either from command line or config file it will happen in the same way.
shwstppr commentedon Aug 12, 2025
Based on the discussion with @DaanHoogland and @ingox the behaviour can be tweaked to the following:
cmk setcommand and the API call with cmk is done without any credentials, then the current behaviour of falling back will remain as it is.cc @weizhouapache @rohityadavcloud
access: prevent login with username-password when command-line creden…
access: prevent login with username-password when command-line creden…