You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We should move the entire backend configuration using !ENV to facilitate configuration using docker compose and its env context
elisanp
changed the title
[Satosa] Example pyeudiw_backend.yaml is not secure-by-design
[Satosa] Example pyeudiw_backend.yaml can be secured more about private keys configuration
Oct 17, 2024
The example configuration file of the satosa backend, which is https://github.com/italia/eudi-wallet-it-python/blob/dev/example/satosa/pyeudiw_backend.yaml includes some hardcoded private keys.
For example, see this one.
eudi-wallet-it-python/example/satosa/pyeudiw_backend.yaml
Lines 89 to 96 in ac69db4
This is okay-ish for development purposes, but the project should eventually provide an example configuration file that states without ambiguity which configuration parameters are secrets that in a deploy process should be injected by a CI/CD pipeline, like this one.
https://github.com/italia/Satosa-Saml2Spid/blob/8272442b122ddf19d80ff8cfd00226f61d170d1a/example/plugins/backends/saml2_backend.yaml#L10-L11
This should be done so that uninformed developers do not accidentally go to production with an unsecure signing key
The text was updated successfully, but these errors were encountered: