hashicorp / hashicorp/consul

Node identities should include `session:write` permissions

Open
#17,854 1 comment 1 reaction 0 assignees View on GitHub
Dominant language
Go
Stars
30.1k
Forks
4.6k
Avg merge
2d 6h
Merged PRs (30d)
43

Description

#### Feature Description

I believe the [Node Identities](https://developer.hashicorp.com/consul/docs/security/acl#node-identities) feature currently has the following template for generated policies:

https://github.com/hashicorp/consul/blob/f16c5d87abc5a0c81e9cfc918e15c0b7b6da5f06/agent/structs/acl_oss.go#L34-L50

I'd like to request that this include the `session:write` permission for the node as well via:

```
session "%[1]s" {
policy = "write"
}
```

I'm happy to submit a quick PR with the above if this is acceptable.

#### Use Case(s)

In https://github.com/hashicorp/consul/issues/5221 and https://github.com/hashicorp/consul/issues/5535, node identities are touted as replacing the need for an ACL templating feature, but as far as I can tell, it is still not yet possible to allow a token to create sessions for its own node. Trying to create a session with a token using a node identity results in the following error:

```
Permission denied: token with AccessorID '' lacks permission 'session:write' on ""
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.