kgilpin

import sys
import os
import appmap

#start the recorder
r = appmap.Recording()
with r:
    #run the SSH demo code
    import sshdemo
    sshdemo.Demo().runDemo()

kgilpin

name: sample_app_6th_ed
packages:
- path: app/mailers
- path: app/models
- path: app/jobs
- path: app/controllers
- path: app/helpers
- gem: actioncable
- gem: actionmailbox
- gem: actionmailer

kgilpin

Usage

1. Save rails_gem_paths.rb to your local directory

2. Run this command to open a VSCode project containing the local directory and all "active*" and "action*" gems. The script also prints out the gem names in appmap.yml form.

code . $(bundle exec ruby rails_gem_paths.rb)
# - gem: actioncable
# - gem: actionmailbox

kgilpin

https://app.land/applications/219?mapset=1970

kgilpin

hi

<script> alert('hi') </script>

kgilpin

root@3935c7d86a07:/# cat policy-2.yml
- !user alice

- !group developers

- !grant
  role: !group developers
  member: !user alice
  

kgilpin

- !policy
  id: conjur/authn-k8s/minikube/default
  owner: !group /k8s_admin
  body:
  - !webservice
    annotations:
      kubernetes/namespace: default

  - !host client

kgilpin

- !policy
  id: myapp
  body:
  - &variables
    - !variable
      id: database/username
      annotations:
        description: Application database username
    - !variable
      id: database/password

kgilpin

Approach

Create distinct roles with specific permissions to call untrusted web services.

Client services authenticate as one of these roles when calling an untrusted web service.

Discussion

When using an externalized (Nginx) forwarder and gatekeeper, a webservice client can send a Conjur access token for its own identity. The client doesn't have to worry about the gatekeeper misusing the access token,

kgilpin

# Defines a Bastion server layer. 
#
# Usage:
# conjur policy load --as-group ops bastion-policy.rb
policy "bastion" do
  # Members of this group will be able to adminsiter the bastion.
  admins = group "admins"
  # Members of this group will be able to login to the bastion
  # with a regular, non-privileged account. 
  users  = group "users"