Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow configuring max age and expiry notifications for login tokens #28

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Allow configuring max age and expiry notifications for login tokens #28

wants to merge 1 commit into from

Conversation

herglotzmarco
Copy link
Contributor

  • Trying to enforce maximum security, access tokens should not be valid forever.
  • It is possible to implement automatic token rotation by directly accessing the REST service similar to what the UI does.
  • Enabling max token age invalidation (which is optional and off by default for backwards compatibility) means a lot more invalidation happen.
  • To help users troubleshoot 401 errors when contacting nexus, a possibility to notify users via email when their tokens expire was introduced.
  • This is entirely optional and will only work if Nexus has a mail server configured via default Sonatype means.
  • Leveraging OAuth2 Proxys behaviour and correct reverse proxy configuration, this allows to use API tokens like OIDC access tokens with very limited lifespan, where renewing the API token requires full OIDC login, potentially including 2FA, Passkeys or whatever login method is configured.
  • If everything is configured correctly, it is not possible to renew the API token with an existing API token, but only with full OAuth2 Proxy login, further strengthening security

Allow configuring max age and expiry notifications for login tokens
04ec334 
- Trying to enforce maximum security, access tokens should not be valid forever.
- It is possible to implement automatic token rotation by directly accessing the REST service similar to what the UI does.
- Enabling max token age invalidation (which is optional and off by default for backwards compatibility) means a lot more invalidation happen.
- To help users troubleshoot 401 errors when contacting nexus, a possibility to notify users via email when their tokens expire was introduced.
- This is entirely optional and will only work if Nexus has a mail server configured via default Sonatype means.
- Leveraging OAuth2 Proxys behaviour and correct reverse proxy configuration, this allows to use API tokens like OIDC access tokens with very limited lifespan, where renewing the API token requires full OIDC login, potentially including 2FA, Passkeys or whatever login method is configured.
- If everything is configured correctly, it is not possible to renew the API token with an existing API token, but only with full OAuth2 Proxy login, further strengthening security
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@herglotzmarco