Make local password generation length policy-aware

sysadmin commented

2026-10-12 12:18:02 +00:00

Contributor

MiroTalk SFU's JWT_SECRET now rejects anything under 32 characters, but the openbao lookup's generate=true path was hardcoded to always generate 20 chars regardless of the requested policy name -- the policy parameter only ever affected the (unused) server-side generate endpoint, never the local Python fallback actually used in practice.

_ensure_and_generate() now resolves length from a _POLICY_LENGTHS table (default=20, strong=24, weak=16, long32=32 -- new) instead of always using 20. Charset is still always the default policy's, unchanged -- a pre-existing limitation, now accurately documented in the policy: option's description. An unrecognized policy name still warns and falls back to 20 (previously every non-"default" name warned, even already-defined ones like "strong"/"weak").

🤖 Generated with Claude Code

https://claude.ai/code/session_012icUrjv3vgHtovVpHUFjdp

MiroTalk SFU's JWT_SECRET now rejects anything under 32 characters, but the openbao lookup's generate=true path was hardcoded to always generate 20 chars regardless of the requested policy name -- the policy parameter only ever affected the (unused) server-side generate endpoint, never the local Python fallback actually used in practice. _ensure_and_generate() now resolves length from a _POLICY_LENGTHS table (default=20, strong=24, weak=16, long32=32 -- new) instead of always using 20. Charset is still always the default policy's, unchanged -- a pre-existing limitation, now accurately documented in the policy: option's description. An unrecognized policy name still warns and falls back to 20 (previously every non-"default" name warned, even already-defined ones like "strong"/"weak"). 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_012icUrjv3vgHtovVpHUFjdp

sysadmin added 1 commit

2026-10-12 12:18:02 +00:00

Make local password generation length policy-aware

Ansible Lint / ansible-lint (pull_request) Successful in 2m59s

Details

17296efa3b

Mirrors the fix in silvarion.secrets/silvarion.base (sibling copies of
this lookup plugin): _ensure_and_generate() now resolves length from a
_POLICY_LENGTHS table (default=20, strong=24, weak=16, long32=32)
instead of always generating 20 chars regardless of the requested
policy name. Charset is still always the default policy's -- unchanged,
pre-existing limitation, now accurately reflected in the policy:
option's docs.

Prompted by MiroTalk SFU's JWT_SECRET, which rejects anything under
32 characters -- mirotalksfu_jwt_secret was generated at 20 chars
(this plugin's old hardcoded default) and crash-looped the container
once an upstream image update started enforcing that check.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012icUrjv3vgHtovVpHUFjdp

jsanchezd added 1 commit

2026-10-12 12:56:02 +00:00

Try OpenBao's own generate endpoint before falling back to local generation

Ansible Lint / ansible-lint (pull_request) Successful in 2m32s

Details

3938afcd4a

Mirrors the fix in silvarion.secrets/silvarion.base (sibling copies of
this lookup plugin). Confirmed live: the "default" ACL policy already
grants sys/policies/password/* read+list, and the ansible-role AppRole
can already call the real generate endpoint successfully within its
namespace -- the client method for this was already implemented, just
never called. _ensure_and_generate() now tries it first, which gets
every named policy's REAL charset and length. Falls back to local
generation only if the server-side call fails for any reason.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012icUrjv3vgHtovVpHUFjdp

jsanchezd merged commit 7d4e340502 into main

2026-10-12 17:38:30 +00:00

jsanchezd deleted branch feature/openbao-policy-lengths

2026-10-12 17:38:30 +00:00

jsanchezd referenced this pull request from a commit

2026-10-12 17:38:31 +00:00

Merge pull request 'Make local password generation length policy-aware' (#13) from feature/openbao-policy-lengths into main

Rows
Columns

Make local password generation length policy-aware #13