cryostatio / cryostatio/cryostat
[Request] If multiple matching stored credentials are found, should Cryostat try to use each?
- Dominant language
- Java
- Stars
- 57
- Forks
- 17
- Avg merge
- 15h 39m
- Merged PRs (30d)
- 42
Description
### Describe the feature
Cryostat currently selects the "first" matching credential and uses that to attach credentials to outgoing target connections. If each target has 0 or 1 matching stored credentials then this works as expected.
However, the user(s) may have defined multiple credentials whose matchExpressions are a match for any given target.
If there are multiple matching credentials available, should Cryostat try to use each one until one of them succeeds? If that happens then should Cryostat somehow cache this result? What if there are multiple valid credentials because there are multiple defined JMX users with different roles (readonly vs readwrite) for the target's JMX server?
If the user(s) have defined two credentials for target A, one of which is valid and the other is invalid, then Cryostat might always select the invalid credentials for that target and never be able to establish a connection, even though there are valid credentials defined.
For example, defining a credential like `{ matchExpression: "true", username: "a", password: "b" }` is acceptable, but Cryostat is likely to select this credential for targets which have JMX authentication enabled and have other credentials defined. This credential's existence blocks Cryostat from being able to establish any connections to targets using authentication (assuming `a:b` is not actually what the target expects).
### Anything other information?
_No response_
Contributor guide
Research direction
Start by tracing how Cryostat selects the first matching stored credential for outgoing target connections. The issue does not name files or tests and leaves retry order, result caching, and multiple valid JMX users undecided; done would require an agreed behavior for these cases and corresponding verification.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100