-
Notifications
You must be signed in to change notification settings - Fork 71
Open
Labels
largeEffort labelEffort labelmultitenancyGetting Parsec to provide isolated key stores for multiple clients based on an identity mechanismGetting Parsec to provide isolated key stores for multiple clients based on an identity mechanism
Description
Currently only one authenticator is allowed to work in Parsec.
The reason is that the OnDiskKeyInfoManager stores the KeyTriple to KeyInfo mappings as a directory structure:
/// mappings_dir_path/
/// |---app1/
/// | |---provider1/
/// | | |---key1
/// | | |---key2
/// | | | ...
/// | | |---keyP
/// | |---provider2/
/// | | ...
/// | |---providerM/
/// |---app2/
/// | ...
/// |---appN/
If we were to add one more layer for AuthType, and then transform the KeyTriple into a KeyFourtuple, old mappings will not be compatible with new ones directly.
That task is about making the necessary changes in Parsec for it to work with multiple authenticators securely. There are changes needed:
- in the
ManageKeyInfotrait and thekey_info_managersmodules - in the
Providetrait and implementations to support passing, along theApplicationName, theAuthTypeas well
One thing that could also be done is implement a new KeyInfo Manager that supports multiple authenticators and that supports it from start! That way the restriction will only apply to the old OnDiskKeyInfoManager.
Metadata
Metadata
Assignees
Labels
largeEffort labelEffort labelmultitenancyGetting Parsec to provide isolated key stores for multiple clients based on an identity mechanismGetting Parsec to provide isolated key stores for multiple clients based on an identity mechanism