[Feature request] Multiple admin-secret keys and secret key management

[revskill10]

Currently, Hasura only allows 1 secret key as admin role.

This feature request suggests a tab on console for admin to add/edit/revoke more key-role pair:

• Key is the access_key
• Role is the role.
• (optional) Expired time (default is forever)

So, this will allow bypass JWT authentication for specific client.

The default admin-secret should be immutable and showable for the first admin only.

API usage:

Client needs to send header x-hasura-secret-key to access hasura.

Use case:

• I have some 3rd party applications which needs a key to access hasura.
• A team could safely colloborate in console with many roles: dev, database administrators, manager,... with each role has only specific permissions.

Related issue:

#587

With this feature, hasura will eventually support access console for all roles.

Alternative solution:

We need a table secret_keys with three columns above and a join table between secret_keys and the table you want to grant access. And use secret_keys in permissions settings.

[mnlbox]

@revskill10 I love your idea Or maybe more general if Hasura can support a simple user password authentication and merge that with jwt or webhook then admin users can use builtin authentication feature. (I think this approach is more dynamic than key/role approach and still we can use one specific user/password rather than key/password for specific client app)

In that case we also need some new permissions for example called:

• access_data_tab
• access_graphql_tab
• access_remote_schema_tab
• access_trigger_tab

To restrict access to each part of console app.

[revskill10]

@mnlbox I think user management is a different issue.
This is all about secret keys management. Imagine you could grant some clients a secret key for them to access as a role. That client could be a user, or could be another server.

[jasonmccallister]

@revskill10 are you thinking more along the lines of allowing multiple admins specific keys to hit the API or console? I think that would be really useful as people leave teams/companies then you only need to remove that users admin key.

[revskill10]

@jasonmccallister My main motivation for this feature is that, i need to integrate a 3rd client to access Hasura as a specific role. So the simplest solution is to grant an access_key for it.

[jasonmccallister]

Ok perfect, we have a huge need for this feature as well! Thanks @revskill10!

[jasonmccallister]

Also, I would say this falls into two buckets:

1. Assigning admin keys to clients
2. Assigning roles

We have a separate function that returns a JWT for a predefined role for the 3rd party client - that works well but of course it does not allow them to use the console in stage.

[jflambert]

I don't think any work was done on this but we're about to do something of our own.

We'll roll out two hasuras talking to the same DB. One is "maintenance" and the other is "developer". Maintenance will be used to manage metadata and permissions. "developer" will be restricted to the API panel.

They'll both have different admin secrets, but "developer" will have a specific x-hasura-role injected through nginx (to hide some endpoints as necessary). We're forking hasura and keeping only the API tab in the top bar so that you can't mess with the metadata as "developer". We'll also hide the Request Headers so "developer" can't change role (but it wouldn't matter because of nginx)

Is this really the only/easiest way to achieve this right now? @coco98 and @tirumaraiselvan ?

[marcel-happyfloat]

@jflambert Not sure if this is related, but in the latest community call they are talking about multiple JWTs for complex auth flows: https://hasura.io/community/community-call/2022/march/

[tirumaraiselvan]

Hey folks, multiple admin secrets is available in our Cloud/EE offering: https://hasura.io/docs/latest/graphql/cloud/security/multiple-admin-secrets/

We understand this may not be the most ideal thing for open-source users but there is an easy workaround to achieve the same in OSS: create JWT tokens with role: admin each of which can be used essentially as an admin secret.

[jasonmccallister]

Thank you @tirumaraiselvan that is what I have done in the meantime although it does not provide access to the console it does work with the OSS version.

Keep up the great work!!!