Related to
Web-Backend (APIs)
Impact
nice to have for enterprise usage
Missing Feature
When a user's LDAP password changes, the Semaphore login works immediately (live LDAP bind), but the AccessKey stored in the inventory still contains the old password. Every Ansible task fails until someone manually updates it.
With password rotation policies (e.g. every 90 days) and multiple users this becomes a real operational problem. There is currently no way to keep LDAP credentials and Ansible task credentials in sync automatically.
Implementation
An opt-in config option (e.g. ldap_credential_sync) that automatically creates or updates a per-user AccessKey (type login_password) on each successful LDAP login.
On login: after the successful LDAP bind in api/login.go, the password gets stored as an encrypted AccessKey using the existing AES-GCM encryption.
On task execution: the inventory can reference the "user credential" of whoever starts the task, so the current password is always used.
Design
- util/config.go: new config field LdapCredentialSync (default false)
- api/login.go: after successful LDAP bind, create/update per-user AccessKey
- db/AccessKey.go: new owner type for user credentials
- services/tasks/LocalJob.go: resolve user credential at task start
- db/Inventory.go: allow referencing user credentials
The feature is fully opt-in, uses existing encryption, and doesn't change default behavior. No breaking changes.
Happy to work on a PR if the approach makes sense.
Related to
Web-Backend (APIs)
Impact
nice to have for enterprise usage
Missing Feature
When a user's LDAP password changes, the Semaphore login works immediately (live LDAP bind), but the AccessKey stored in the inventory still contains the old password. Every Ansible task fails until someone manually updates it.
With password rotation policies (e.g. every 90 days) and multiple users this becomes a real operational problem. There is currently no way to keep LDAP credentials and Ansible task credentials in sync automatically.
Implementation
An opt-in config option (e.g. ldap_credential_sync) that automatically creates or updates a per-user AccessKey (type login_password) on each successful LDAP login.
On login: after the successful LDAP bind in api/login.go, the password gets stored as an encrypted AccessKey using the existing AES-GCM encryption.
On task execution: the inventory can reference the "user credential" of whoever starts the task, so the current password is always used.
Design
The feature is fully opt-in, uses existing encryption, and doesn't change default behavior. No breaking changes.
Happy to work on a PR if the approach makes sense.