saligrama
Joined 3 years ago
Karma
27
Submissions
9
Member since
Mar 2
Recent submissions
Comment · 4 days ago
Yes, exactly, a cloud agent always authenticates itself (via OIDC) as an agent (machine) identity, with the option for the identity of the human who launched it to ride along.
We then have the ability to enforce (extremely fine grained) policies based on that combined identity, plus any of the claims in the OIDC token (e.g., the repo URL), plus any of the data on the protocol itself (e.g., block non-read-only queries; redact anything sensitive).
Comment · 4 days ago
Yes, exactly, a cloud agent always authenticates itself (via OIDC) as an agent (machine) identity, with the option for the identity of the human who launched it to ride along.
We then have the ability to enforce (extremely fine grained) policies based on that combined identity, plus any of the claims in the OIDC token (e.g., the repo URL), plus any of the data on the protocol itself (e.g., block non-read-only queries; redact anything sensitive).
Comment · 3 years ago
Baserunner [1] does exactly this. I described using it for Firebase security research in my blog post [2].
[1] https://github.com/iosiro/baserunner
[2] https://saligrama.io/blog/post/firebase-insecure-by-default/
https://saligrama.io