cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
853
Views
15
Helpful
3
Replies
hkubota
Beginner

Device Password Vault for NSO

Hi,

 

In NSO I can configure hard-coded accounts and password to connect to devices (authgroups).

If I do not want that (our security team does not like that) and instead I have to to keep device passwords in a system like HashiCorp Vault, how can this be integrated into NSO?

 

Typically I'd give NSO at startup time a one-time password which it would use to get a token out of Vault which it can use to get the passwords out of Vault. But I see no way to integrate this in NSO.

Am I missing something or is this simply not implemented and not (easily) implementable?

Is there maybe a hook to get a password out from an external system or Python/Java program instead of having it hard-coded in an authgroup configuration?

 

1 ACCEPTED SOLUTION

Accepted Solutions

Actually, I was behind the curve, it is included in nso-4.7.2, from the CHANGES file:

ncs: Authentication groups are extended to support action callbacks to
retrieve southbound user and credentials for a local user, device and
the authgroup that device belongs to.

(ENG-17868)

 

It is the 'callback-node' and 'action-name' settings in the umap or default-map configuration.

View solution in original post

3 REPLIES 3
joepak
Cisco Employee

 
vleijon
Cisco Employee

It is not currently possible to do what you want, but it is a feature that will come in a future release. We have had this request from other customers as well.

 

I am not entirely sure which release it will be in or when that will be released. If someone from the product management team is watching, they might know.

Actually, I was behind the curve, it is included in nso-4.7.2, from the CHANGES file:

ncs: Authentication groups are extended to support action callbacks to
retrieve southbound user and credentials for a local user, device and
the authgroup that device belongs to.

(ENG-17868)

 

It is the 'callback-node' and 'action-name' settings in the umap or default-map configuration.

View solution in original post