Make local password generation length policy-aware

sysadmin commented

2026-10-12 12:18:02 +00:00

Contributor

MiroTalk SFU's JWT_SECRET now rejects anything under 32 characters, but the openbao lookup's generate=true path was hardcoded to always generate 20 chars regardless of the requested policy name -- the policy parameter only ever affected the (unused) server-side generate endpoint, never the local Python fallback actually used in practice.

_ensure_and_generate() now resolves length from a _POLICY_LENGTHS table (default=20, strong=24, weak=16, long32=32 -- new) instead of always using 20. Charset is still always the default policy's, unchanged -- a pre-existing limitation, now accurately documented in the policy: option's description. An unrecognized policy name still warns and falls back to 20 (previously every non-"default" name warned, even already-defined ones like "strong"/"weak").

🤖 Generated with Claude Code

https://claude.ai/code/session_012icUrjv3vgHtovVpHUFjdp

MiroTalk SFU's JWT_SECRET now rejects anything under 32 characters, but the openbao lookup's generate=true path was hardcoded to always generate 20 chars regardless of the requested policy name -- the policy parameter only ever affected the (unused) server-side generate endpoint, never the local Python fallback actually used in practice. _ensure_and_generate() now resolves length from a _POLICY_LENGTHS table (default=20, strong=24, weak=16, long32=32 -- new) instead of always using 20. Charset is still always the default policy's, unchanged -- a pre-existing limitation, now accurately documented in the policy: option's description. An unrecognized policy name still warns and falls back to 20 (previously every non-"default" name warned, even already-defined ones like "strong"/"weak"). 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_012icUrjv3vgHtovVpHUFjdp

sysadmin added 1 commit

2026-10-12 12:18:02 +00:00

Make local password generation length policy-aware

Ansible Lint / ansible-lint (pull_request) Successful in 26s

Details

c949740895

Mirrors the fix in silvarion.secrets (sibling copy of this lookup
plugin): _ensure_and_generate() now resolves length from a
_POLICY_LENGTHS table (default=20, strong=24, weak=16, long32=32)
instead of always generating 20 chars regardless of the requested
policy name. Charset is still always the default policy's -- unchanged,
pre-existing limitation, now accurately reflected in the policy:
option's docs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012icUrjv3vgHtovVpHUFjdp

jsanchezd added 1 commit

2026-10-12 12:55:15 +00:00

Try OpenBao's own generate endpoint before falling back to local generation

Ansible Lint / ansible-lint (pull_request) Successful in 25s

Details

43bb5d154a

Mirrors the fix in silvarion.secrets (sibling copy of this lookup
plugin). Confirmed live: the "default" ACL policy already grants
sys/policies/password/* read+list, and the ansible-role AppRole can
already call the real generate endpoint successfully within its
namespace -- the client method for this was already implemented, just
never called. _ensure_and_generate() now tries it first, which gets
every named policy's REAL charset and length. Falls back to local
generation only if the server-side call fails for any reason.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012icUrjv3vgHtovVpHUFjdp

jsanchezd merged commit cdb71ff332 into main

2026-10-12 17:39:10 +00:00

jsanchezd referenced this pull request from a commit

2026-10-12 17:39:10 +00:00

Merge pull request 'Make local password generation length policy-aware' (#3) from feature/openbao-policy-lengths into main

Rows
Columns

Make local password generation length policy-aware #3