rustguac

mirror of https://github.com/sol1/rustguac.git synced 2026-10-25 13:09:56 +00:00

Files

T

Dave Kempe 8df2f254eb vault: JWT token_command, JWT login in the CLI tools, checked settings

On top of the workload JWT login from #285:

- token_command: a program and its arguments (run directly, never
  through a shell) that prints the JWT, run again at every login, with a
  timeout. For issuers that hand out a token on request, such as a cloud
  metadata service. Its output never reaches an error or the log.
- import-guacamole and vault-migrate log in with jwt_auth too; they
  insisted on VAULT_SECRET_ID. One helper, VaultConfig::login_secret,
  now decides the secret for the server and both commands.
- jwt_auth is checked before any login: the mount goes into the login
  URL, so plain path segments only, and exactly one of path and
  token_command.
- Docs: the jwt_auth keys, and setting it up with Nomad workload
  identity, SPIRE (spiffe-helper), and cloud VM identity tokens, with a
  note on when JWT login really removes the stored secret.

2026-10-18 13:23:14 +11:00

api.md

recordings: download as MP4, converted on request with guacenc (#241 )

2026-10-18 13:23:14 +11:00

configuration.md

vault: JWT token_command, JWT login in the CLI tools, checked settings

2026-10-18 13:23:14 +11:00

credential-variables.md

folder defaults: stop at folders shared with anyone extra

2026-10-17 09:53:48 +11:00

deployment-guide.md

docs: CLI group mapping, CLI audit log, and two stale OIDC docs