You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@cloudstack.apache.org by "ingox (via GitHub)" <gi...@apache.org> on 2025/08/05 13:00:04 UTC
[I] Credential fall back [cloudstack-cloudmonkey]
ingox opened a new issue, #168:
URL: https://github.com/apache/cloudstack-cloudmonkey/issues/168
I have the following use case:
- I want to run a bash script to execute several cloudmonkey commands.
- These commands should get executed by a specific user.
- I'm passing the APIkey and Secret as parameter to the script.
- These commands will clean up all the resources in this account the user has permission for.
- At the beginning of my script I do set the APIkey and secret which arestored in the .cmk/config file.
- Now the config file has the username and password for my admin account and the APIkey and secret for my regular user account.
Now I see a behavior which will cause issues:
- If I pass now a wrong APIkey and/or Secret to cmk or my script (e.q. typo by mistake) then the username and password (for my admin account) is used automatically.
- In my case I'm in the wrong account and can potentially delete all the resources the admin account has permission and not just the user.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cloudstack.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Credential fall back [cloudstack-cloudmonkey]
Posted by "ingox (via GitHub)" <gi...@apache.org>.
ingox commented on issue #168:
URL: https://github.com/apache/cloudstack-cloudmonkey/issues/168#issuecomment-3160131808
Leave that bash thing out for now. Here are the steps:
- I have a single profile in my config file with username (admin) and password.
- Once I login to cmk (command: "cmk") I do a "list users" to check who I am. It is admin now.
- I logout again.
- Now I login again by using the APIkey and Secret of a specific user "cmk -s <secret> -k <apikey>
- List users will show that I'm ACSUser now (example).
- Now I logout again and remove just one character from the key or secret (potential mistake).
- I would expect an error now. But there is no error. I'm logged in into cmk again.
- List users shows me that I'm admin.
That is quite risky from my point of view.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Credential fall back [cloudstack-cloudmonkey]
Posted by "shwstppr (via GitHub)" <gi...@apache.org>.
shwstppr commented on issue #168:
URL: https://github.com/apache/cloudstack-cloudmonkey/issues/168#issuecomment-3179090489
Based on the discussion with @DaanHoogland and @ingox the behaviour can be tweaked to the following:
- When credentials are passed as command-line parameters, then only those credentials will be used for the API call, and there won't be any fallback.
- When credentials are set in the cmk shell or with `cmk set` command and the API call with cmk is done without any credentials, then the current behaviour of falling back will remain as it is.
cc @weizhouapache @rohityadavcloud
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Credential fall back [cloudstack-cloudmonkey]
Posted by "ingox (via GitHub)" <gi...@apache.org>.
ingox commented on issue #168:
URL: https://github.com/apache/cloudstack-cloudmonkey/issues/168#issuecomment-3167780961
@DaanHoogland I like the approach you're suggesting. Same behavior happen if you logged in to the console with right keys once but stored the wrong information into the config file. Means anytime the key and secret are used either from command line or config file it will happen in the same way.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Credential fall back [cloudstack-cloudmonkey]
Posted by "shwstppr (via GitHub)" <gi...@apache.org>.
shwstppr closed issue #168: Credential fall back
URL: https://github.com/apache/cloudstack-cloudmonkey/issues/168
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Credential fall back [cloudstack-cloudmonkey]
Posted by "shwstppr (via GitHub)" <gi...@apache.org>.
shwstppr commented on issue #168:
URL: https://github.com/apache/cloudstack-cloudmonkey/issues/168#issuecomment-3159907563
@ingox I think this can be prevented if you can use different profiles with `set profile`, ie, before setting apikey/secrekey, set a new profile
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Credential fall back [cloudstack-cloudmonkey]
Posted by "shwstppr (via GitHub)" <gi...@apache.org>.
shwstppr commented on issue #168:
URL: https://github.com/apache/cloudstack-cloudmonkey/issues/168#issuecomment-3160160128
Thanks @ingox for the clarification. I understand your issue now. I'll check and update
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Credential fall back [cloudstack-cloudmonkey]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on issue #168:
URL: https://github.com/apache/cloudstack-cloudmonkey/issues/168#issuecomment-3159882038
@ingox , this kind of sounds like a bash scripting issue and not a cmk issue. Can you explain your setup a bit more?
It sounds like you should have two profiles in .cmk/config and call cmk with -p <profile name> to execute the different commands.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Credential fall back [cloudstack-cloudmonkey]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on issue #168:
URL: https://github.com/apache/cloudstack-cloudmonkey/issues/168#issuecomment-3167064236
@ingox @shwstppr @weizhouapache , if we start wit (just) -s and -k we cannot ignore the profile as we do not have the url (and maybe domain)?
So if we log in like this and the keys are wrong, we are still going to the url from a profile. Actually to the currently configured as default. A retry with name/password would make sense. In the PR @weizhouapache suggests to forget about the default profile if -s/-k are used. That would make sense, but the url is still needed so not entirely possible. What we could do is set a flag internally when -s/-k is used on the cli to not retry, or to not try anything but the keys.
thoughts?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org