[Question] Using bearer token for login

[Pro]

I was able to successfully configure the vault plugin and get an access token for a Gitlab CI pipeline.

How can I use this token in combination with "conan user" command to log in to a conan remote or also for a docker login command?

The token is a scoped access token, similar to:

vault write artifactory/roles/gitlab \
    scope="applied-permissions/groups:vault-ci " \
    default_ttl=3600 max_ttl=10800

It is unclear to me if I can use the token instead of a password, and which username I have to use during conan login.

Is it possible to use the vault plugin for temporary user & password access to conan (and other package managers such as Docker)?

[alexhung]

@Pro IIRC, once you have the access token, you can use it with docker login where password is.

e.g.

docker login -u gitlab -p <your access token> myservername.jfrog.io

I think it's similar with Conan but I don't know for sure as I don't use it.

[Pro]

Thanks for your answer @alexhung

This only works with a fixed username, i.e., if I know it beforehand.

In our current configuration we have the following setting on the vault side:

vault write artifactory/config/admin username_template="v_{{.DisplayName}}_{{.RoleName}}_{{random 8}}"

With this, every new token will get a random username.

Is there a way to query Vault or Artifactory to get the corresponding username associated with a token?

[Pro]

I found one workaround by decoding the JWT token, and then splitting the sub field, but it is not so ideal, i.e., is it always guaranteed between updates, that the sub part format stays the same?

# Extract the username from the token
# First, decode the token and get the sub entry
# It is in the format:
# jfac@<random>/users/<username>
# Extract the username -> String after "/users/"
TOKEN_USER=$(cut -d. -f2 <<< $JFROG_TOKEN | base64 --decode | jq -r ".sub" | sed "s#^.*/users/##")
echo "User = $TOKEN_USER"

[alexhung]

With this, every new token will get a random username.

When the token is created, the username is also in the output. So in theory, you can store this along with the token for use later.

Is there a way to query Vault or Artifactory to get the corresponding username associated with a token?

No, that's not possible.

is it always guaranteed between updates, that the sub part format stays the same?

I can't make claim for the Artifactory team but my guess is that it will stay the same.