awx
awx copied to clipboard
ansible
Source control authentication with GitHub App instead of PAT
Please confirm the following
- [X] I agree to follow this project's code of conduct.
- [X] I have checked the current issues for duplicates.
- [X] I understand that AWX is open source software provided for free and that I might not receive a timely response.
Feature type
Enhancement to Existing Feature
Feature Summary
Currently the authentication against a GitHub repository is done through a personal access token (PAT). This token is always associated to a specific user account which is not that great in an enterpise environment.
For server to server communication GitHub recommends GItHub App which uses token exchange for short lived tokens. It would be great to have this as an alternative to PAT.
https://docs.github.com/en/get-started/quickstart/github-glossary#server-to-server-request https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/authenticating-as-a-github-app-installation
Select the relevant components
- [ ] UI
- [ ] API
- [ ] Docs
- [ ] Collection
- [ ] CLI
- [ ] Other
Steps to reproduce
Add a GitHub repro credential. There's only the option for a PAT.
Current results
a PAT is used which is associated to a specific user
Sugested feature result
Decouple GitHub access from a user account. This allows also to change permission on GitHub to different repos without generating a new PAT for every change.
Additional information
No response
Hello,
We are also interested GItHub App compatibility as well, as the usage of PAT does not align well with some of our security compliance requirements.
+1 Also interested, Personals Access Token are not the recommended way for production usage.
I also would like something more native in AWX, but with AWX features I could solve the issue.
First, develop a credential plugin as documented in https://github.com/ansible/awx-custom-credential-plugin-example/tree/master
In AWX there are more examples of Plugins https://github.com/ansible/awx/tree/devel/awx/main/credential_plugins
To build the plugin, Example: Using Python to generate a JWT
Using an installation access token to authenticate as an app installation
In the end, this credential plugin, just return a token, like a PAT.
Second, it is necessary to link the password of the a "Source Control" Credential with the result of the previous plugin, as explained in HashiCorp Vault SSH Secrets Engine
Different secrets, but same concept.
I don't have an AWX solution for you all (regrettably). but I put together this quick Golang app that may help in a partial solve. https://github.com/nwaringa/tokenclone.
The (theoretical) pattern is essentially a two step workflow:
- Run job with auth, clone repos down
- Run your job with repos existing
Internally we are playing with this.
