awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 11:44:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4905 from Infisical/fix/pam-fetch-credentials

Browse Source 
pam: allow account credentials to be fetched more than once
This commit is contained in:
Andre
2025-11-20 11:29:56 -05:00
committed by GitHub
parent f619c0df3e be7641601f
commit 8eb257b04e
5 changed files with 60 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
backend/src/ee/routes/v1/pam-session-router.ts
View File

@@ -41,17 +41,15 @@ export const registerPamSessionRouter = async (server: FastifyZodProvider) => {
}, },
onRequest: verifyAuth([AuthMode.IDENTITY_ACCESS_TOKEN]), onRequest: verifyAuth([AuthMode.IDENTITY_ACCESS_TOKEN]),
handler: async (req) => { handler: async (req) => {
const { credentials, projectId, account } = await server.services.pamAccount.getSessionCredentials( const { credentials, projectId, account, sessionStarted } =
req.params.sessionId, await server.services.pamAccount.getSessionCredentials(req.params.sessionId, req.permission);
req.permission
);
await server.services.auditLog.createAuditLog({ await server.services.auditLog.createAuditLog({
...req.auditLogInfo, ...req.auditLogInfo,
orgId: req.permission.orgId, orgId: req.permission.orgId,
projectId, projectId,
event: { event: {
type: EventType.PAM_SESSION_START, type: EventType.PAM_SESSION_CREDENTIALS_GET,
metadata: { metadata: {
sessionId: req.params.sessionId, sessionId: req.params.sessionId,
accountName: account.name accountName: account.name
@@ -59,6 +57,21 @@ export const registerPamSessionRouter = async (server: FastifyZodProvider) => {
} }
}); });
if (sessionStarted) {
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
orgId: req.permission.orgId,
projectId,
event: {
type: EventType.PAM_SESSION_START,
metadata: {
sessionId: req.params.sessionId,
accountName: account.name
}
}
});
}
return { credentials: credentials as z.infer<typeof SessionCredentialsSchema> }; return { credentials: credentials as z.infer<typeof SessionCredentialsSchema> };
} }
}); });

10
backend/src/ee/services/audit-log/audit-log-types.ts
View File

@@ -536,6 +536,7 @@ export enum EventType {
DASHBOARD_GET_SECRET_VALUE = "dashboard-get-secret-value", DASHBOARD_GET_SECRET_VALUE = "dashboard-get-secret-value",
DASHBOARD_GET_SECRET_VERSION_VALUE = "dashboard-get-secret-version-value", DASHBOARD_GET_SECRET_VERSION_VALUE = "dashboard-get-secret-version-value",
PAM_SESSION_CREDENTIALS_GET = "pam-session-credentials-get",
PAM_SESSION_START = "pam-session-start", PAM_SESSION_START = "pam-session-start",
PAM_SESSION_LOGS_UPDATE = "pam-session-logs-update", PAM_SESSION_LOGS_UPDATE = "pam-session-logs-update",
PAM_SESSION_END = "pam-session-end", PAM_SESSION_END = "pam-session-end",
@@ -3988,6 +3989,14 @@ interface OrgRoleDeleteEvent {
}; };
} }
interface PamSessionCredentialsGetEvent {
type: EventType.PAM_SESSION_CREDENTIALS_GET;
metadata: {
sessionId: string;
accountName: string;
};
}
interface PamSessionStartEvent { interface PamSessionStartEvent {
type: EventType.PAM_SESSION_START; type: EventType.PAM_SESSION_START;
metadata: { metadata: {
@@ -4542,6 +4551,7 @@ export type Event =
| OrgRoleCreateEvent | OrgRoleCreateEvent
| OrgRoleUpdateEvent | OrgRoleUpdateEvent
| OrgRoleDeleteEvent | OrgRoleDeleteEvent
| PamSessionCredentialsGetEvent
| PamSessionStartEvent | PamSessionStartEvent
| PamSessionLogsUpdateEvent | PamSessionLogsUpdateEvent
| PamSessionEndEvent | PamSessionEndEvent

21
backend/src/ee/services/pam-account/pam-account-service.ts
View File

@@ -668,11 +668,6 @@ export const pamAccountServiceFactory = ({
throw new BadRequestError({ message: "Session has ended or expired" }); throw new BadRequestError({ message: "Session has ended or expired" });
} }
// Verify that the session has not already had credentials fetched
if (session.status !== PamSessionStatus.Starting) {
throw new BadRequestError({ message: "Session has already been started" });
}
const account = await pamAccountDAL.findById(session.accountId); const account = await pamAccountDAL.findById(session.accountId);
if (!account) throw new NotFoundError({ message: `Account with ID '${session.accountId}' not found` }); if (!account) throw new NotFoundError({ message: `Account with ID '${session.accountId}' not found` });
@@ -689,11 +684,16 @@ export const pamAccountServiceFactory = ({
const decryptedResource = await decryptResource(resource, session.projectId, kmsService); const decryptedResource = await decryptResource(resource, session.projectId, kmsService);
let sessionStarted = false;
// Mark session as started // Mark session as started
await pamSessionDAL.updateById(sessionId, { if (session.status === PamSessionStatus.Starting) {
status: PamSessionStatus.Active, await pamSessionDAL.updateById(sessionId, {
startedAt: new Date() status: PamSessionStatus.Active,
}); startedAt: new Date()
});
sessionStarted = true;
}
return { return {
credentials: { credentials: {
@@ -701,7 +701,8 @@ export const pamAccountServiceFactory = ({
...decryptedAccount.credentials ...decryptedAccount.credentials
}, },
projectId: project.id, projectId: project.id,
account account,
sessionStarted
}; };
}; };

38
frontend/src/hooks/api/auditLogs/constants.tsx
View File

@@ -262,24 +262,25 @@ export const eventToNameMap: { [K in EventType]: string } = {
[EventType.UPDATE_IDENTITY_PROJECT_MEMBERSHIP]: "Update Identity Project Membership", [EventType.UPDATE_IDENTITY_PROJECT_MEMBERSHIP]: "Update Identity Project Membership",
[EventType.DELETE_IDENTITY_PROJECT_MEMBERSHIP]: "Delete Identity Project Membership", [EventType.DELETE_IDENTITY_PROJECT_MEMBERSHIP]: "Delete Identity Project Membership",
[EventType.PAM_SESSION_START]: "PAM Session Start", [EventType.PAM_SESSION_CREDENTIALS_GET]: "Get PAM Session Credentials",
[EventType.PAM_SESSION_LOGS_UPDATE]: "PAM Session Logs Update", [EventType.PAM_SESSION_START]: "Start PAM Session",
[EventType.PAM_SESSION_END]: "PAM Session End", [EventType.PAM_SESSION_LOGS_UPDATE]: "Update PAM Session Logs",
[EventType.PAM_SESSION_GET]: "PAM Session Get", [EventType.PAM_SESSION_END]: "End PAM Session",
[EventType.PAM_SESSION_LIST]: "PAM Session List", [EventType.PAM_SESSION_GET]: "Get PAM Session",
[EventType.PAM_FOLDER_CREATE]: "PAM Folder Create", [EventType.PAM_SESSION_LIST]: "List PAM Sessions",
[EventType.PAM_FOLDER_UPDATE]: "PAM Folder Update", [EventType.PAM_FOLDER_CREATE]: "Create PAM Folder",
[EventType.PAM_FOLDER_DELETE]: "PAM Folder Delete", [EventType.PAM_FOLDER_UPDATE]: "Update PAM Folder",
[EventType.PAM_ACCOUNT_LIST]: "PAM Account List", [EventType.PAM_FOLDER_DELETE]: "Delete PAM Folder",
[EventType.PAM_ACCOUNT_ACCESS]: "PAM Account Access", [EventType.PAM_ACCOUNT_LIST]: "List PAM Accounts",
[EventType.PAM_ACCOUNT_CREATE]: "PAM Account Create", [EventType.PAM_ACCOUNT_ACCESS]: "Access PAM Account",
[EventType.PAM_ACCOUNT_UPDATE]: "PAM Account Update", [EventType.PAM_ACCOUNT_CREATE]: "Create PAM Account",
[EventType.PAM_ACCOUNT_DELETE]: "PAM Account Delete", [EventType.PAM_ACCOUNT_UPDATE]: "Update PAM Account",
[EventType.PAM_RESOURCE_LIST]: "PAM Resource List", [EventType.PAM_ACCOUNT_DELETE]: "Delete PAM Account",
[EventType.PAM_RESOURCE_GET]: "PAM Resource Get", [EventType.PAM_RESOURCE_LIST]: "List PAM Resources",
[EventType.PAM_RESOURCE_CREATE]: "PAM Resource Create", [EventType.PAM_RESOURCE_GET]: "Get PAM Resource",
[EventType.PAM_RESOURCE_UPDATE]: "PAM Resource Update", [EventType.PAM_RESOURCE_CREATE]: "Create PAM Resource",
[EventType.PAM_RESOURCE_DELETE]: "PAM Resource Delete", [EventType.PAM_RESOURCE_UPDATE]: "Update PAM Resource",
[EventType.PAM_RESOURCE_DELETE]: "Delete PAM Resource",
[EventType.CREATE_CERTIFICATE_PROFILE]: "Create Certificate Profile", [EventType.CREATE_CERTIFICATE_PROFILE]: "Create Certificate Profile",
[EventType.UPDATE_CERTIFICATE_PROFILE]: "Update Certificate Profile", [EventType.UPDATE_CERTIFICATE_PROFILE]: "Update Certificate Profile",
@@ -314,6 +315,7 @@ const sharedProjectEvents = [
export const projectToEventsMap: Partial<Record<ProjectType, EventType[]>> = { export const projectToEventsMap: Partial<Record<ProjectType, EventType[]>> = {
[ProjectType.PAM]: [ [ProjectType.PAM]: [
...sharedProjectEvents, ...sharedProjectEvents,
EventType.PAM_SESSION_CREDENTIALS_GET,
EventType.PAM_SESSION_START, EventType.PAM_SESSION_START,
EventType.PAM_SESSION_LOGS_UPDATE, EventType.PAM_SESSION_LOGS_UPDATE,
EventType.PAM_SESSION_END, EventType.PAM_SESSION_END,

1
frontend/src/hooks/api/auditLogs/enums.tsx
View File

@@ -254,6 +254,7 @@ export enum EventType {
UPDATE_IDENTITY_PROJECT_MEMBERSHIP = "update-identity-project-membership", UPDATE_IDENTITY_PROJECT_MEMBERSHIP = "update-identity-project-membership",
DELETE_IDENTITY_PROJECT_MEMBERSHIP = "delete-identity-project-membership", DELETE_IDENTITY_PROJECT_MEMBERSHIP = "delete-identity-project-membership",
PAM_SESSION_CREDENTIALS_GET = "pam-session-credentials-get",
PAM_SESSION_START = "pam-session-start", PAM_SESSION_START = "pam-session-start",
PAM_SESSION_LOGS_UPDATE = "pam-session-logs-update", PAM_SESSION_LOGS_UPDATE = "pam-session-logs-update",
PAM_SESSION_END = "pam-session-end", PAM_SESSION_END = "pam-session-end",