Make local password generation length policy-aware

sysadmin commented

2026-10-12 12:18:01 +00:00

Contributor

MiroTalk SFU's JWT_SECRET now rejects anything under 32 characters, but the openbao lookup's generate=true path was hardcoded to always generate 20 chars regardless of the requested policy name -- the policy parameter only ever affected the (unused) server-side generate endpoint, never the local Python fallback actually used in practice.

_ensure_and_generate() now resolves length from a _POLICY_LENGTHS table (default=20, strong=24, weak=16, long32=32 -- new) instead of always using 20. Charset is still always the default policy's, unchanged -- a pre-existing limitation, now accurately documented in the policy: option's description. An unrecognized policy name still warns and falls back to 20 (previously every non-"default" name warned, even already-defined ones like "strong"/"weak").

🤖 Generated with Claude Code

https://claude.ai/code/session_012icUrjv3vgHtovVpHUFjdp

MiroTalk SFU's JWT_SECRET now rejects anything under 32 characters, but the openbao lookup's generate=true path was hardcoded to always generate 20 chars regardless of the requested policy name -- the policy parameter only ever affected the (unused) server-side generate endpoint, never the local Python fallback actually used in practice. _ensure_and_generate() now resolves length from a _POLICY_LENGTHS table (default=20, strong=24, weak=16, long32=32 -- new) instead of always using 20. Charset is still always the default policy's, unchanged -- a pre-existing limitation, now accurately documented in the policy: option's description. An unrecognized policy name still warns and falls back to 20 (previously every non-"default" name warned, even already-defined ones like "strong"/"weak"). 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_012icUrjv3vgHtovVpHUFjdp

sysadmin added 1 commit

2026-10-12 12:18:01 +00:00

Add long32 password-generation policy, make local generation length policy-aware

Ansible Lint / ansible-lint (pull_request) Successful in 6m58s

Details

714696db4c

MiroTalk SFU's JWT_SECRET now rejects anything under 32 characters, but
every openbao lookup generate=true call was hardcoded to 20 chars
regardless of which named policy was requested -- the policy parameter
only ever affected the (unused) server-side generate endpoint, never the
local Python fallback actually used by generate=true in practice.

- roles/openbao/defaults/main/generators.yml: add a "long32" policy
  (32 chars, same charset as "default") alongside the existing
  default/strong/weak.
- plugins/lookup/openbao.py: _ensure_and_generate() now resolves length
  from a _POLICY_LENGTHS table (default=20, strong=24, weak=16, long32=32)
  instead of always generating 20 chars. Charset is still always the
  default policy's regardless of name -- unchanged, pre-existing
  limitation, now accurately reflected in the policy: option's docs.
  An unrecognized policy name still warns and falls back to 20, same as
  before (previously every non-"default" name warned, even "strong"/"weak").

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012icUrjv3vgHtovVpHUFjdp

jsanchezd added 1 commit

2026-10-12 12:54:54 +00:00

Try OpenBao's own generate endpoint before falling back to local generation

Ansible Lint / ansible-lint (pull_request) Successful in 5m31s

Details

3b2e72d0e0

Confirmed live: the "default" ACL policy already grants
sys/policies/password/* read+list, and the ansible-role AppRole (via
that policy) can already call the real generate endpoint successfully
within its namespace -- the client method for this
(_OpenBaoClient.generate_password) was already implemented, just never
called. _ensure_and_generate() now tries it first, which gets every
named policy's REAL charset and length (not just an approximated
length against the default policy's charset). Falls back to local
generation only if the server-side call fails for any reason (policy
not provisioned on this server/namespace, token lacks permission,
network error, etc).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012icUrjv3vgHtovVpHUFjdp

jsanchezd merged commit 604eae9c25 into main

2026-10-12 17:37:50 +00:00

jsanchezd deleted branch feature/openbao-policy-lengths

2026-10-12 17:37:50 +00:00

jsanchezd referenced this pull request from a commit

2026-10-12 17:37:50 +00:00

Merge pull request 'Make local password generation length policy-aware' (#4) from feature/openbao-policy-lengths into main

Rows
Columns

Make local password generation length policy-aware #4