{"action":"created","issue":{"url":"https://api.github.com/repos/coreos/dex/issues/377","repository_url":"https://api.github.com/repos/coreos/dex","labels_url":"https://api.github.com/repos/coreos/dex/issues/377/labels{/name}","comments_url":"https://api.github.com/repos/coreos/dex/issues/377/comments","events_url":"https://api.github.com/repos/coreos/dex/issues/377/events","html_url":"https://github.com/coreos/dex/issues/377","id":141733277,"number":377,"title":"configuration data management","user":{"login":"sym3tri","id":224222,"avatar_url":"https://avatars.githubusercontent.com/u/224222?v=3","gravatar_id":"","url":"https://api.github.com/users/sym3tri","html_url":"https://github.com/sym3tri","followers_url":"https://api.github.com/users/sym3tri/followers","following_url":"https://api.github.com/users/sym3tri/following{/other_user}","gists_url":"https://api.github.com/users/sym3tri/gists{/gist_id}","starred_url":"https://api.github.com/users/sym3tri/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sym3tri/subscriptions","organizations_url":"https://api.github.com/users/sym3tri/orgs","repos_url":"https://api.github.com/users/sym3tri/repos","events_url":"https://api.github.com/users/sym3tri/events{/privacy}","received_events_url":"https://api.github.com/users/sym3tri/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/coreos/dex/labels/area/usability","name":"area/usability","color":"bfe5bf"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":19,"created_at":"2016-03-17T23:24:19Z","updated_at":"2016-04-08T04:21:12Z","closed_at":null,"body":"One source of friction around bootstrapping/migrating has been with the way dex handles its config data (especially the `client_identity` table).\r\n\r\nIt was always the intention to allow config data to be edited via the API. However we can't do that now b/c the workers only load data on startup, and it is never refreshed. This is a separate issue we should address separately. \r\n\r\nToday updating clients is actually not possible at all since their IDs/secrets are auto-generated upon insert, and cannot be updated. Meaning it is impossible to recreate an exact copy of a dex deployment, or configure a deterministic deployment. \r\n\r\nWe should probably _not_ diverge from the OIDC spec and allow some sort of special static ID/secret client registration. However I propose some new dexctl sub-commands and bootstrap API endpoints do raw import/export/deletion of various config data. Perhaps the following would solve most of these issues:\r\n\r\n**Connectors**\r\n- `dexctl connectors export`\r\n- `dexctl connectors import -f ./my-connector-config.json` (this could replace set-connector-configs)\r\n- `dexctl connectors delete-all`\r\n\r\n**Clients**\r\n- `dexctl clients export`\r\n- `dexctl clients import -f ./my-clients-config.json`\r\n- `dexctl clients delete-all`\r\n\r\nNOTE:\r\n- These are only accessible to the system operator.\r\n- Imports should fail and rollback if _ANY_ duplicate ID already exists. (if dupes exist user is expected to export, delete-all, import).\r\n- Imports must have strict validation checks (considering we don't handle client/server version skew in any form today).\r\n- These are distinct from `get-connector-configs` and `set-connector-configs` b/c they are only intended to be machine readable json files.\r\n- Should be properly authenticated.\r\n- Encryption/Decryption of secrets must be considered. \r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/coreos/dex/issues/comments/207202985","html_url":"https://github.com/coreos/dex/issues/377#issuecomment-207202985","issue_url":"https://api.github.com/repos/coreos/dex/issues/377","id":207202985,"user":{"login":"bobbyrullo","id":9629,"avatar_url":"https://avatars.githubusercontent.com/u/9629?v=3","gravatar_id":"","url":"https://api.github.com/users/bobbyrullo","html_url":"https://github.com/bobbyrullo","followers_url":"https://api.github.com/users/bobbyrullo/followers","following_url":"https://api.github.com/users/bobbyrullo/following{/other_user}","gists_url":"https://api.github.com/users/bobbyrullo/gists{/gist_id}","starred_url":"https://api.github.com/users/bobbyrullo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bobbyrullo/subscriptions","organizations_url":"https://api.github.com/users/bobbyrullo/orgs","repos_url":"https://api.github.com/users/bobbyrullo/repos","events_url":"https://api.github.com/users/bobbyrullo/events{/privacy}","received_events_url":"https://api.github.com/users/bobbyrullo/received_events","type":"User","site_admin":false},"created_at":"2016-04-08T04:21:12Z","updated_at":"2016-04-08T04:21:12Z","body":"Ah, so you are actually talking about per-instance config. I thought you were saying that the file loads it into the DB. \r\n\r\nI don't think we want to support both having it in a file and in the database"}}