mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-09 13:28:27 +00:00
Merge branch 'heads/main' into daniel/ms-teams-integration
This commit is contained in:
Daniel Hougaard
+39
-92
@@ -22,125 +22,72 @@ This command enables you to obtain SSH credentials used to access a remote host.
|
||||
<Accordion title="--hostname">
|
||||
The hostname of the SSH host to connect to. If not provided, you will be prompted to select from available hosts.
|
||||
</Accordion>
|
||||
<Accordion title="--loginUser">
|
||||
<Accordion title="--login-user">
|
||||
The login user for the SSH connection. If not provided, you will be prompted to select from available login users.
|
||||
</Accordion>
|
||||
<Accordion title="--writeHostCaToFile">
|
||||
<Accordion title="--write-host-ca-to-file">
|
||||
Whether to write the Host CA public key to `~/.ssh/known_hosts` if it doesn't already exist.
|
||||
|
||||
Default value: `true`
|
||||
</Accordion>
|
||||
<Accordion title="--outFilePath">
|
||||
<Accordion title="--out-file-path">
|
||||
The path to write the SSH credentials to such as `~/.ssh`, `./some_folder`, `./some_folder/id_rsa-cert.pub`. If not provided, the credentials will be added to the SSH agent and used to establish an interactive SSH connection.
|
||||
</Accordion>
|
||||
<Accordion title="--token">
|
||||
An authenticated token to use to authenticate with Infisical.
|
||||
Use a machine identity access token
|
||||
</Accordion>
|
||||
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="infisical ssh issue-credentials">
|
||||
This command is used to issue SSH credentials (SSH certificate, public key, and private key) against a certificate template.
|
||||
|
||||
We recommend using the `--addToAgent` flag to automatically load issued SSH credentials to the SSH agent.
|
||||
<Accordion title="infisical ssh add-host">
|
||||
This command is used to register a new SSH host with Infisical.
|
||||
|
||||
This command can be used with the `--write-user-ca-to-file`, `--write-host-cert-to-file`, and `--configure-sshd` flags
|
||||
to also configure the host's SSH daemon with the necessary certificate authority and host certificate settings.
|
||||
|
||||
```bash
|
||||
$ infisical ssh issue-credentials --certificateTemplateId=<certificate-template-id> --principals=<principals> --addToAgent
|
||||
$ infisical ssh add-host --projectId=<project-id> --hostname=<hostname>
|
||||
```
|
||||
|
||||
### Flags
|
||||
<Accordion title="--certificateTemplateId">
|
||||
The ID of the SSH certificate template to issue SSH credentials for.
|
||||
<Accordion title="--projectId">
|
||||
Project ID the host belongs to (required)
|
||||
</Accordion>
|
||||
<Accordion title="--principals">
|
||||
A comma-separated list of principals (i.e. usernames like `ec2-user` or hostnames) to issue SSH credentials for.
|
||||
<Accordion title="--hostname">
|
||||
Hostname of the SSH host (required)
|
||||
</Accordion>
|
||||
<Accordion title="--addToAgent">
|
||||
Whether to add issued SSH credentials to the SSH agent.
|
||||
<Accordion title="--alias">
|
||||
Alias for the SSH host (optional)
|
||||
</Accordion>
|
||||
<Accordion title="--write-user-ca-to-file">
|
||||
Write User CA public key to `/etc/ssh/infisical_user_ca.pub`
|
||||
|
||||
Default value: `false`
|
||||
</Accordion>
|
||||
<Accordion title="--user-ca-out-file-path">
|
||||
Custom file path to write the User CA public key
|
||||
|
||||
Default value: `/etc/ssh/infisical_user_ca.pub`
|
||||
</Accordion>
|
||||
<Accordion title="--write-host-cert-to-file">
|
||||
Write SSH host certificate to `/etc/ssh/ssh_host_<type>_key-cert.pub`
|
||||
|
||||
Default value: `false`
|
||||
</Accordion>
|
||||
<Accordion title="--configure-sshd">
|
||||
Update `TrustedUserCAKeys`, `HostKey`, and `HostCertificate` in the `/etc/ssh/sshd_config` file
|
||||
|
||||
Default value: `false`
|
||||
|
||||
Note that either the `--outFilePath` or `--addToAgent` flag must be set for the sub-command to execute successfully.
|
||||
Note: This flag requires both --write-user-ca-to-file and --write-host-cert-to-file to be set
|
||||
</Accordion>
|
||||
<Accordion title="--outFilePath">
|
||||
The path to write the SSH credentials to such as `~/.ssh`, `./some_folder`, `./some_folder/id_rsa-cert.pub`. If not provided, the credentials will be saved to the current working directory where the command is run.
|
||||
<Accordion title="--force">
|
||||
Force overwrite of existing certificate files as part of `--write-user-ca-to-file` and `--write-host-cert-to-file`
|
||||
|
||||
Note that either the `--outFilePath` or `--addToAgent` flag must be set for the sub-command to execute successfully.
|
||||
</Accordion>
|
||||
<Accordion title="--keyAlgorithm">
|
||||
The key algorithm to issue SSH credentials for.
|
||||
|
||||
Default value: `RSA_2048`
|
||||
|
||||
Available options: `RSA_2048`, `RSA_4096`, `EC_prime256v1`, `EC_secp384r1`.
|
||||
</Accordion>
|
||||
<Accordion title="--certType">
|
||||
The certificate type to issue SSH credentials for.
|
||||
|
||||
Default value: `user`
|
||||
|
||||
Available options: `user` or `host`
|
||||
</Accordion>
|
||||
<Accordion title="--ttl">
|
||||
The time-to-live (TTL) for the issued SSH certificate (e.g. `2 days`, `1d`, `2h`, `1y`).
|
||||
|
||||
Defaults to the Default TTL value set in the certificate template.
|
||||
</Accordion>
|
||||
<Accordion title="--keyId">
|
||||
A custom Key ID to issue SSH credentials for.
|
||||
|
||||
Defaults to the autogenerated Key ID by Infisical.
|
||||
Default value: `false`
|
||||
</Accordion>
|
||||
<Accordion title="--token">
|
||||
An authenticated token to use to issue SSH credentials.
|
||||
</Accordion>
|
||||
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="infisical ssh sign-key">
|
||||
This command is used to sign an existing SSH public key against a certificate template; the command outputs the corresponding signed SSH certificate.
|
||||
|
||||
```bash
|
||||
$ infisical ssh sign-key --certificateTemplateId=<certificate-template-id> --publicKey=<public-key> --principals=<principals> --outFilePath=<out-file-path>
|
||||
```
|
||||
<Accordion title="--certificateTemplateId">
|
||||
The ID of the SSH certificate template to issue the SSH certificate for.
|
||||
</Accordion>
|
||||
<Accordion title="--publicKey">
|
||||
The public key to sign.
|
||||
|
||||
Note that either the `--publicKey` or `--publicKeyFilePath` flag must be set for the sub-command to execute successfully.
|
||||
</Accordion>
|
||||
<Accordion title="--publicKeyFilePath">
|
||||
The path to the public key file to sign.
|
||||
|
||||
Note that either the `--publicKey` or `--publicKeyFilePath` flag must be set for the sub-command to execute successfully.
|
||||
</Accordion>
|
||||
<Accordion title="--principals">
|
||||
A comma-separated list of principals (i.e. usernames like `ec2-user` or hostnames) to issue SSH credentials for.
|
||||
</Accordion>
|
||||
<Accordion title="--outFilePath">
|
||||
The path to write the SSH certificate to such as `~/.ssh/id_rsa-cert.pub`; the specified file must have the `.pub` extension. If not provided, the credentials will be saved to the directory of the specified `--publicKeyFilePath` or the current working directory where the command is run.
|
||||
</Accordion>
|
||||
<Accordion title="--certType">
|
||||
The certificate type to issue SSH credentials for.
|
||||
|
||||
Default value: `user`
|
||||
|
||||
Available options: `user` or `host`
|
||||
</Accordion>
|
||||
<Accordion title="--ttl">
|
||||
The time-to-live (TTL) for the issued SSH certificate (e.g. `2 days`, `1d`, `2h`, `1y`).
|
||||
|
||||
Defaults to the Default TTL value set in the certificate template.
|
||||
</Accordion>
|
||||
<Accordion title="--keyId">
|
||||
A custom Key ID to issue SSH credentials for.
|
||||
|
||||
Defaults to the autogenerated Key ID by Infisical.
|
||||
</Accordion>
|
||||
<Accordion title="--token">
|
||||
An authenticated token to use to issue SSH credentials.
|
||||
Use a machine identity access token
|
||||
</Accordion>
|
||||
|
||||
</Accordion>
|
||||
|
||||
@@ -0,0 +1,40 @@
|
||||
---
|
||||
title: "Assume Privileges"
|
||||
description: "Learn how to temporarily assume the privileges of a user or machine identity within a project."
|
||||
---
|
||||
|
||||
This feature allows authorized users to temporarily take on the permissions of another user or identity. It helps administrators and access managers test and verify permissions before granting access, ensuring everything is set up correctly.
|
||||
It also reduces back-and-forth with end users when troubleshooting permission-related issues.
|
||||
|
||||
## How It Works
|
||||
|
||||
When an authorized user activates assume privileges mode, they temporarily inherit the target user or identity’s permissions for up to one hour.
|
||||
During this time, they can perform actions within the system with the same level of access as the target user.
|
||||
|
||||
- **Permission-based**: Only permissions are inherited, not the full identity
|
||||
- **Time-limited**: Access automatically expires after one hour
|
||||
- **Audited**: All actions are logged under the original user's account. This means any action taken during the session will be recorded under the entity assuming the privileges, not the target entity.
|
||||
- **Authorization required**: Only users with the specific **assume privilege** permission can use this feature
|
||||
- **Scoped to a single project**: You can only assume privileges for one project at a time
|
||||
|
||||
## How to Assume Privileges
|
||||
|
||||
<Steps>
|
||||
<Step title="Go to Project Access">
|
||||
Click on the user or identity you want to assume.
|
||||
|
||||
|
||||
</Step>
|
||||
|
||||
<Step title="Click Assume Privilege">
|
||||
Click **Assume Privilege**, then type `assume` to confirm and start your session.
|
||||
|
||||
|
||||
</Step>
|
||||
|
||||
<Step title="Session is Active">
|
||||
You will see a yellow banner indicating that your assume privilege session is active. You can exit at any time by clicking **Exit**.
|
||||
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
@@ -0,0 +1,56 @@
|
||||
---
|
||||
title: "GitHub Team Sync"
|
||||
description: "Learn how to automatically synchronize your GitHub teams with Infisical Groups."
|
||||
---
|
||||
|
||||
## Overview
|
||||
|
||||
The GitHub Organization Synchronization feature streamlines user and group management by automatically syncing users belonging to your specified GitHub organization with corresponding groups within Infisical. This integration ensures that users logging in via GitHub are automatically added to or removed from Infisical groups based on their team memberships within your GitHub organization.
|
||||
|
||||
## Configuration
|
||||
|
||||
To enable and configure GitHub Organization Synchronization, follow these steps:
|
||||
|
||||
<Steps>
|
||||
<Step title="Set up GitHub organization configuration">
|
||||
1. Navigate to **Organization Settings** and select the **Security Tab**.
|
||||
|
||||
2. Click the **Configure** button and provide the name of your GitHub Organization.
|
||||
|
||||
</Step>
|
||||
<Step title="Enable GitHub organization sync">
|
||||
Toggle ON GitHub Organization sync to activate sync.
|
||||
|
||||
</Step>
|
||||
<Step title="Approve the Infisical OAuth application on your organization">
|
||||
Connecting the Infisical OAuth application grants it permission to **read:org** details. This approval is done by selecting your organization during the GitHub OAuth login process.
|
||||
|
||||
1. Initiate the login process via the GitHub OAuth flow.
|
||||
|
||||
2. Select the organization you have connected.
|
||||
3. Grant access to Infisical oauth application to your configured organization. Infisical shown here is an organization, just for walkthrough.
|
||||
|
||||
|
||||
<Info>
|
||||
This action only needs to be done once and authorizes the Infisical OAuth app to read organization details, including team information.
|
||||
The following users don't need to select organization in GitHub on login anymore.
|
||||
</Info>
|
||||
</Step>
|
||||
|
||||
</Steps>
|
||||
|
||||
## Working
|
||||
|
||||
Once configured, the GitHub Organization Synchronization feature functions as follows:
|
||||
|
||||
When a user logs in via the GitHub OAuth flow and selects the configured organization, the system will then automatically synchronize the teams they are a part of in GitHub with corresponding groups in Infisical.
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
<Accordion title="Please check if your organization has approved the Infisical OAuth application.">
|
||||
If you encounter an error related to this, it indicates that you need to approve the Infisical OAuth application within your GitHub organization.
|
||||
|
||||
You can verify the application's approval status by navigating to **https://github.com/organizations/__your-organization__/settings/oauth_application_policy**. Replace `__your-organization__` with the actual name of your GitHub organization.
|
||||
|
||||
|
||||
</Accordion>
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 335 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 360 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 439 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 450 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 595 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 485 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 468 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 326 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 452 KiB |
@@ -34,7 +34,7 @@ description: "Learn how to configure a TeamCity Sync for Infisical."
|
||||
- **Build Configuration**: The build configuration to sync secrets to.
|
||||
|
||||
<Note>
|
||||
Not including a Build Configuration will sync secrets to the entire project.
|
||||
Not including a Build Configuration will sync secrets to the project.
|
||||
</Note>
|
||||
|
||||
5. Configure the **Sync Options** to specify how secrets should be synced, then click **Next**.
|
||||
@@ -44,6 +44,11 @@ description: "Learn how to configure a TeamCity Sync for Infisical."
|
||||
- **Overwrite Destination Secrets**: Removes any secrets at the destination endpoint not present in Infisical.
|
||||
- **Import Secrets (Prioritize Infisical)**: Imports secrets from the destination endpoint before syncing, prioritizing values from Infisical over TeamCity when keys conflict.
|
||||
- **Import Secrets (Prioritize TeamCity)**: Imports secrets from the destination endpoint before syncing, prioritizing values from TeamCity over Infisical when keys conflict.
|
||||
|
||||
<Note>
|
||||
Infisical only syncs secrets from within the target scope; inherited secrets will not be imported.
|
||||
</Note>
|
||||
|
||||
- **Auto-Sync Enabled**: If enabled, secrets will automatically be synced from the source location when changes occur. Disable to enforce manual syncing only.
|
||||
- **Disable Secret Deletion**: If enabled, Infisical will not remove secrets from the sync destination. Enable this option if you intend to manage some secrets manually outside of Infisical.
|
||||
|
||||
|
||||
+5
-3
@@ -160,6 +160,7 @@
|
||||
},
|
||||
"documentation/platform/access-controls/additional-privileges",
|
||||
"documentation/platform/access-controls/temporary-access",
|
||||
"documentation/platform/access-controls/assume-privilege",
|
||||
"documentation/platform/access-controls/access-requests",
|
||||
"documentation/platform/access-controls/project-access-requests",
|
||||
"documentation/platform/pr-workflows",
|
||||
@@ -300,7 +301,8 @@
|
||||
"documentation/platform/scim/jumpcloud",
|
||||
"documentation/platform/scim/group-mappings"
|
||||
]
|
||||
}
|
||||
},
|
||||
"documentation/platform/github-org-sync"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -887,8 +889,8 @@
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "LDAP Password",
|
||||
"pages": [
|
||||
"group": "LDAP Password",
|
||||
"pages": [
|
||||
"api-reference/endpoints/secret-rotations/ldap-password/create",
|
||||
"api-reference/endpoints/secret-rotations/ldap-password/delete",
|
||||
"api-reference/endpoints/secret-rotations/ldap-password/get-by-id",
|
||||
|
||||
Reference in New Issue
Block a user