mirror of
https://github.com/gravitational/teleport.git
synced 2026-09-01 16:03:55 +08:00
rosstimothy
510859bfb8
Removes any externally visibile notions to end users that a token name and token secret are two different entities. This removes the need to output a token_name and token_secret value from `tctl scoped tokens add` as well as removing the token_secret from teleport.yaml and teleport CLIs. Internally, the name of a scoped_token is still NOT a secret. The secret is a separate field in the scoped_token.status. When the token is presented to a user it is done so as `<token_name>:<base64(token_secret)`. The leading token_name is not encoded to allow users to visually dentify tokens they may have created with a specific name. The `~` separator was chosen because it is neither a valid backend key, scope separator, and does not need any special encoding if included in a URL. The token_secret is base64 encoded so that it appears as opaque text to users and can be included in a URL. Additionally, the tctl scoped ref parsing has been updated such that tctl get/edit/rm honors both `<token_name>` and `<token_name>:<base64(token_secret)>` This does contain a few breaking changes. The token_secret has been removed from the teleport.yaml file config and its equivalent CLI flags have been removed. Since scopes are still under active development and this only impacts scoped_tokens and not traditional tokens the impact of this change should be minimal.