CLI login timeout breaks security

[engrun]

What version of the credhub server you are using?

1.7.2

What version of the credhub cli you are using?

1.6.0

If you were attempting to accomplish a task, what was it you were attempting to do?

credhub login --client-name foo --client-secret bar -s --ca-cert

What did you expect to happen?

Login succeeds, and I would be logged in for a decent amount of time ( > 30 minutes )

What was the actual behavior?

Login succeeds, but I am forced to login over and over again (after every 30 seconds it seems).

Problem

This behaviour encourages all developers to set the password in their bashrc/zshrc files, meaning security is flawed as the password is suddenly exposed in files on every users computer.
This behaviour is now being observed after upgrading to 1.7.2

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/156037909

The labels on this github issue will be updated when the story is started.

[ebeer]

@engrun token validity timeout is set in the uaa configuration. CredHub stores your UAA token when you login via the command line. If a client credential expires, UAA does not allow refresh (unlike a user grant). If you decode the token stored in your ~/.credhub/config.json (with something like https://jwt.io/) after login, that would be a quick way to validate what token expiration is set for your credentials so you can adjust accordingly.

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/156048758

The labels on this github issue will be updated when the story is started.

[ebeer]

@engrun If that resolves your issue, please let us know

[engrun]

We are using concourse-up, which bundles credhub, so we have no controll over the installation. I'll report an issue with them instead. Thanks for the info. Btw, what is the default token timeout?

[ebeer]

@engrun I'm not certain of UAA's default timeout, but from here https://github.com/EngineerBetter/concourse-up/blob/22ba6e5f4e49243a60e3fd98f60e3239b61e0592/bosh/assets/concourse.yml#L126 it appears that the timeout is explicitly being set to 30 seconds. If this token were given only password and refresh_token scopes you would not be seeing this issue. The inclusion of client_credentials on line 123 of that config is overriding the other scopes.

[crawsible]

@engrun Closing this out because it's not related to this project.