HTTP Registry Support for profile registries

[ericofusco]

HTTP support for profile registries has been removed in #855.

This is a neat feature to generate AWS profiles based on access a specific user has. I wonder if we can get the feature added again without the dependency on common-fate integrations.

[chrnorm]

@ericofusco did you have a HTTP registry implemented? In removing it the assumption was that it had been only used for Common Fate, so I would love to hear if you had a use case for it.

[ericofusco]

@chrnorm Not at the moment but we were planning on using as a better alternative to Git.

The documentation states a custom HTTP registry/deployment URL is supported: https://docs.commonfate.io/granted/usage/profile-registry#syncing-a-profile-registry

[chrnorm]

Thanks for the info and for the heads up on the docs inconsistency.

For your use case, would you need an authenticated endpoint? The previous spec used an OIDC token for this, but the implementation was fairly complex and so if we did add this back in I’d wonder if we could opt for something simpler, or omit auth entirely until we have feature requests for it.

(context: this is the first time I’ve heard of the HTTP registry being considered for use outside of the Common Fate integration. Given that it is unused AFAIK we have some leeway to simplify the implementation IMO)

[ericofusco]

Actually the authentication is the key part for me to consider the HTTP registry. Otherwise, git would be enough.

The reason is because we have several AWS organizations with different levels of access and sensitivity, although we can use git and users can pull profiles based on groups/folders, it requires users to add multiple registries when they belong to different groups. In addition, when the registry is backed by git it's essentially an RBAC database with AWS accounts, roles and their groups that can assume them which needs to be accessible to everyone which isn't ideal and creating a git repository per group isn't scalable.

So my idea was to auth into the OIDC provider and add the groups from authenticated user to the ID token, send to the custom HTTP registry I was planning to create and return the AWS profiles based on user groups.

[chrnorm]

Separate to the above thread, if anyone is currently using HTTP Registries I’d love to hear from you in this discussion.