3 ms·
JWT/OIDC, where the thing you're authenticating to (like MongoDB Atlas) trusts your identity provider (AWS, GCP, Modal, GitLab CI). It's better than mTLS becaus
by sofixa 2y ago
JWT/OIDC, where the thing you're authenticating to (like MongoDB Atlas) trusts your identity provider (AWS, GCP, Modal, GitLab CI). It's better than mTLS because it allows for more flexibility in claims (extra metadata and security checks can be done with arbitrary data provided by the identity provider), and JWTs are usually shorter lived than certificates.
- Thaxll 2y agoHow do you allow a driver using that exactly?
- sofixa 2y agoA db connection driver? You pass the JWT as the username/password which contains the information about your identity and is signed by the identity provider that the party you're authenticating to has been configured to trust. Or, you use a broker like Vault to which you authenticate with that JWT, and which generates a just in time ephemeral username/password for your database, which gets rotated at some point.
- ekzhang 2y agoWe have a native OIDC integration at Modal, as well! Every container gets a token. https://modal.com/docs/guide/oidc-integration https://modal.com/docs/guide/oidc-integration
- fusjdffddddddds 2y ago[flagged]
- sofixa 2y agoAwesome, great for you. OIDC/JWT for cross-stuff auth should become the norm.