cryostatio / cryostatio/cryostat

[Request] If multiple matching stored credentials are found, should Cryostat try to use each?

Open
#376 0 comments 0 reactions 0 assignees View on GitHub
bug feat question
Dominant language
Java
Stars
57
Forks
17
Avg merge
15h 39m
Merged PRs (30d)
42

Description

### Describe the feature

Cryostat currently selects the "first" matching credential and uses that to attach credentials to outgoing target connections. If each target has 0 or 1 matching stored credentials then this works as expected.

However, the user(s) may have defined multiple credentials whose matchExpressions are a match for any given target.

If there are multiple matching credentials available, should Cryostat try to use each one until one of them succeeds? If that happens then should Cryostat somehow cache this result? What if there are multiple valid credentials because there are multiple defined JMX users with different roles (readonly vs readwrite) for the target's JMX server?

If the user(s) have defined two credentials for target A, one of which is valid and the other is invalid, then Cryostat might always select the invalid credentials for that target and never be able to establish a connection, even though there are valid credentials defined.

For example, defining a credential like `{ matchExpression: "true", username: "a", password: "b" }` is acceptable, but Cryostat is likely to select this credential for targets which have JMX authentication enabled and have other credentials defined. This credential's existence blocks Cryostat from being able to establish any connections to targets using authentication (assuming `a:b` is not actually what the target expects).

### Anything other information?

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by tracing how Cryostat selects the first matching stored credential for outgoing target connections. The issue does not name files or tests and leaves retry order, result caching, and multiple valid JMX users undecided; done would require an agreed behavior for these cases and corresponding verification.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.