Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Subject x500UniqueIdentifier control #4755

Closed
kfox1111 opened this issue Dec 22, 2023 · 1 comment · Fixed by #4862
Closed

Subject x500UniqueIdentifier control #4755

kfox1111 opened this issue Dec 22, 2023 · 1 comment · Fixed by #4862
Assignees
@evan2645
Labels
priority/backlog Issue is approved and in the backlog
Milestone
1.9.0

Comments

@kfox1111
Copy link
Contributor

Trying to hook up spire-server with mysql. Subjects for the client are being generated like:

Subject: C = US, O = SPIRE, CN = mysqlclient.default.svc.cluster.local, x500UniqueIdentifier = a753b06724b81d4a2f14f615d40550ed

But mysql can not pattern match the Subject for authentication so has to be tweaked for every instance rather then being able to set more generically.

Could there please be an option added to the spiffe entry to let the end user modify the subject behavior for that entry to drop the x509UniqueIdentifier?
@amartinezfayo amartinezfayo added the triage/needed Issue is in need of triage label Dec 22, 2023
@MarcosDY MarcosDY added triage/in-progress Issue triage is in progress and removed triage/needed Issue is in need of triage labels Jan 2, 2024
@evan2645 evan2645 mentioned this issue Jan 2, 2024
Closed
@azdagron azdagron assigned azdagron and evan2645 and unassigned azdagron Jan 16, 2024
@azdagron azdagron added this to the 1.9.0 milestone Feb 2, 2024
azdagron added a commit to azdagron/spire that referenced this issue Feb 2, 2024
@azdagron
No longer emit x509UniqueIdentifier in X509-SVIDs
975add9 
Introduced in 1.4.2, this practice has turned out to be problematic.
This change updates SPIRE Server to no long emit attribute in the
X509-SVID subject.

It also introduces a new built-in CredentialComposer to add the
attribute back in for deployments that rely on it. The plugin only
augments workload X509-SVIDs. Server and agent X509-SVIDs are not
modified.

Fixes: spiffe#4755
Fixes: spiffe#3110

Signed-off-by: Andrew Harding <azdagron@gmail.com>
azdagron added a commit to azdagron/spire that referenced this issue Feb 2, 2024
@azdagron
No longer emit x509UniqueIdentifier in X509-SVIDs
c8be116 
Introduced in 1.4.2, this practice has turned out to be problematic.
This change updates SPIRE Server to no long emit attribute in the
X509-SVID subject.

It also introduces a new built-in CredentialComposer to add the
attribute back in for deployments that rely on it. The plugin only
augments workload X509-SVIDs. Server and agent X509-SVIDs are not
modified.

Fixes: spiffe#4755
Fixes: spiffe#3110

Signed-off-by: Andrew Harding <azdagron@gmail.com>
@azdagron azdagron mentioned this issue Feb 2, 2024
Merged
@evan2645
Copy link
Member

evan2645 commented Feb 6, 2024

Hi @kfox1111 - thank you very much for bringing this to our attention. The unique identifier was added in response to #3110. At the time, conformance appeared to be the right thing to do. This issue, along with other feedbacks, have shown the change to present significant UX challenges, and after several discussions we've decided to roll it back.

For users that require this to be set, to satisfy policy or otherwise, we will be shipping a new built-in credential composer plugin (currently named "uniqueid") and there is an open PR to both roll back the change and introduce the new plugin here: #4862

@evan2645 evan2645 added priority/backlog Issue is approved and in the backlog and removed triage/in-progress Issue triage is in progress labels Feb 6, 2024
amartinezfayo pushed a commit that referenced this issue Feb 7, 2024
@azdagron
No longer emit x509UniqueIdentifier in X509-SVIDs (#4862)
ebb1afb 
* No longer emit x509UniqueIdentifier in X509-SVIDs

Introduced in 1.4.2, this practice has turned out to be problematic.
This change updates SPIRE Server to no long emit attribute in the
X509-SVID subject.

It also introduces a new built-in CredentialComposer to add the
attribute back in for deployments that rely on it. The plugin only
augments workload X509-SVIDs. Server and agent X509-SVIDs are not
modified.

Fixes: #4755
Fixes: #3110

Signed-off-by: Andrew Harding <azdagron@gmail.com>
faisal-memon pushed a commit to faisal-memon/spire that referenced this issue Feb 7, 2024
@azdagron @faisal-memon
No longer emit x509UniqueIdentifier in X509-SVIDs (spiffe#4862)
beb7292 
* No longer emit x509UniqueIdentifier in X509-SVIDs

Introduced in 1.4.2, this practice has turned out to be problematic.
This change updates SPIRE Server to no long emit attribute in the
X509-SVID subject.

It also introduces a new built-in CredentialComposer to add the
attribute back in for deployments that rely on it. The plugin only
augments workload X509-SVIDs. Server and agent X509-SVIDs are not
modified.

Fixes: spiffe#4755
Fixes: spiffe#3110

Signed-off-by: Andrew Harding <azdagron@gmail.com>
Signed-off-by: Faisal Memon <fymemon@yahoo.com>
faisal-memon pushed a commit to faisal-memon/spire that referenced this issue Feb 9, 2024
@azdagron @faisal-memon
No longer emit x509UniqueIdentifier in X509-SVIDs (spiffe#4862)
ed1eb07 
* No longer emit x509UniqueIdentifier in X509-SVIDs

Introduced in 1.4.2, this practice has turned out to be problematic.
This change updates SPIRE Server to no long emit attribute in the
X509-SVID subject.

It also introduces a new built-in CredentialComposer to add the
attribute back in for deployments that rely on it. The plugin only
augments workload X509-SVIDs. Server and agent X509-SVIDs are not
modified.

Fixes: spiffe#4755
Fixes: spiffe#3110

Signed-off-by: Andrew Harding <azdagron@gmail.com>
Signed-off-by: Faisal Memon <fymemon@yahoo.com>
sriyer pushed a commit to spire-vault/spire that referenced this issue Feb 23, 2024
@azdagron @sriyer
No longer emit x509UniqueIdentifier in X509-SVIDs (spiffe#4862)
d348882 
* No longer emit x509UniqueIdentifier in X509-SVIDs

Introduced in 1.4.2, this practice has turned out to be problematic.
This change updates SPIRE Server to no long emit attribute in the
X509-SVID subject.

It also introduces a new built-in CredentialComposer to add the
attribute back in for deployments that rely on it. The plugin only
augments workload X509-SVIDs. Server and agent X509-SVIDs are not
modified.

Fixes: spiffe#4755
Fixes: spiffe#3110

Signed-off-by: Andrew Harding <azdagron@gmail.com>
rushi47 pushed a commit to rushi47/spire that referenced this issue Apr 11, 2024
@azdagron @rushi47
No longer emit x509UniqueIdentifier in X509-SVIDs (spiffe#4862)
4b8a692 
* No longer emit x509UniqueIdentifier in X509-SVIDs

Introduced in 1.4.2, this practice has turned out to be problematic.
This change updates SPIRE Server to no long emit attribute in the
X509-SVID subject.

It also introduces a new built-in CredentialComposer to add the
attribute back in for deployments that rely on it. The plugin only
augments workload X509-SVIDs. Server and agent X509-SVIDs are not
modified.

Fixes: spiffe#4755
Fixes: spiffe#3110

Signed-off-by: Andrew Harding <azdagron@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@evan2645 evan2645

Labels
priority/backlog Issue is approved and in the backlog
Projects
None yet
Milestone
1.9.0
Development

Successfully merging a pull request may close this issue.

No longer emit x509UniqueIdentifier in X509-SVIDs azdagron/spire
5 participants
@kfox1111 @evan2645 @MarcosDY @azdagron @amartinezfayo