Node identities should include `session:write` permissions
- Dominant language
- Go
- Stars
- 30.1k
- Forks
- 4.6k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 43
Description
#### Feature Description
I believe the [Node Identities](https://developer.hashicorp.com/consul/docs/security/acl#node-identities) feature currently has the following template for generated policies:
https://github.com/hashicorp/consul/blob/f16c5d87abc5a0c81e9cfc918e15c0b7b6da5f06/agent/structs/acl_oss.go#L34-L50
I'd like to request that this include the `session:write` permission for the node as well via:
```
session "%[1]s" {
policy = "write"
}
```
I'm happy to submit a quick PR with the above if this is acceptable.
#### Use Case(s)
In https://github.com/hashicorp/consul/issues/5221 and https://github.com/hashicorp/consul/issues/5535, node identities are touted as replacing the need for an ACL templating feature, but as far as I can tell, it is still not yet possible to allow a token to create sessions for its own node. Trying to create a session with a token using a node identity results in the following error:
```
Permission denied: token with AccessorID '' lacks permission 'session:write' on ""
```
Contributor guide
Assessment
This issue has not been assessed yet.