Max_ttl can be exceeded when configured at plugin level about vault-plugin-secrets-artifactory HOT 4 CLOSED

Is this an expected behaviour? If yes, is setting the max-lease-ttl when mounting the secret engine the proper way to definitely limit the max_ttl?

@loicgreffier Without diving into the code, I'd say yes. Using max-least-ttl arg or change your Vault global configuration are the ways to limit the token's max_ttl.

from vault-plugin-secrets-artifactory.

@alexhung Thanks for the feedback. I guess the issue can be closed as this is the expected behaviour

from vault-plugin-secrets-artifactory.

@loicgreffier Thanks for the report. I've added this to our plan.

from vault-plugin-secrets-artifactory.

@loicgreffier When max-lease-ttl is not explicitly set, the plugin uses max lease TTL configured in your Vault server by default. (https://github.com/jfrog/vault-plugin-secrets-artifactory/blob/master/path_user_token_create.go#L116) IIRC that's 768 hours: https://developer.hashicorp.com/vault/docs/configuration#max_lease_ttl

from vault-plugin-secrets-artifactory.