Vault - OIDC Support

[girish]

Vault has no way to automatically migrate from LDAP to OIDC. So, we have now published a new package that has OIDC support.

Usually, we would not deprecate the old package since there is no easy way to migrate but in this case it seems we don't have much users of this app . There are hardly any support requests or threads on the forum. Admittedly, this seems like some ultra niche app for enterprises or people who are all in to the Hashicorp ecosystem.

[girish]

Also, because of the recent licensing changes in all of Hashicorp's products, Vault has been forked as OpenBao.

https://github.com/openbao/openbao/tree/development

[crazybrad]

@girish I know this thread is stale, but I was wondering if the lack on interest in Vault is due to complexity of Vault and Hashicorp's licensing change.

Recently, I have been investigating other secrets management platforms and perhaps Infisical is better suited to our community. Infisical Packaging would require PostgreSQL, Redis, Email, and Auth, all of which is natively supported in Cloudron. Thoughts?

[joseph]

My 2c . Vault falls into this "enterprise secrets management" space . It's used (if at all) by large companies who have an army of sysadmins of their own. This is probably why we don't hear much usage in Cloudron context.

[crazybrad]

@joseph I agree. I looked at some of the implementation requirements and it takes effort. With each Cloudron app update and server reboot, it requires a process to "turn on" the server. That involves presenting several keys to unlock the server. For large companies with dev ops resources, this is doable. But for smaller companies, it is too much effort with a huge risk of bringing down applications if you miss a secrets server reboot.