Skip to content

KeeperPAM Config Commands Added#126

Open
adeshmukh-ks wants to merge 48 commits intopam-commandsfrom
pam-config-int
Open

KeeperPAM Config Commands Added#126
adeshmukh-ks wants to merge 48 commits intopam-commandsfrom
pam-config-int

Conversation

@adeshmukh-ks
Copy link
Copy Markdown
Contributor

No description provided.

ukumar-ks and others added 23 commits November 12, 2025 21:32
* Fix asyncio event loop cleanup with SSO auth

Previously, when applications using SSO authentication exited, the
asyncio event loop was closed while background tasks were still
running, resulting in:
- ERROR: Task was destroyed but it is pending
- RuntimeError: Event loop is closed

This issue occurred specifically with SSO authentication flows that
use push notifications, but not with password-only authentication.

This fix ensures proper cleanup by:
1. Cancelling all pending tasks before stopping the event loop
2. Giving tasks time (0.3s) to handle CancelledError gracefully
3. Waiting for the event loop thread to finish before closing

This prevents "Task was destroyed but it is pending" errors when
shutting down applications that use SSO with push notifications.

* Revert "Fix asyncio event loop cleanup with SSO auth"

This reverts commit 8364e1c.

* Close login websocket after authentication

During SSO authentication flows, a push notification websocket
(LoginPushNotifications) is created to handle 2FA, device approval,
and SSO data key requests.

This websocket was never closed after successful login, causing
it to remain active until application shutdown. This resulted in
asyncio errors about pending tasks being destroyed.

Fix: Close login.push_notifications in _on_logged_in() immediately
after authentication completes and before any post-login setup.
verify-records and verify-shared-folder commands added
@socket-security
Copy link
Copy Markdown

socket-security bot commented Jan 7, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedpydantic@​2.12.5100100100100100

View full report

@adeshmukh-ks adeshmukh-ks changed the base branch from pam-config to pam-commands March 26, 2026 06:23
else:
logger.info("User record belongs to another record.")

logger.info("")
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

empty iinfo?

logger.info("")

while True:
res = input(f"Does this user belong to {parent_record.title} Y/N >").lower()
Copy link
Copy Markdown

@sali-ks sali-ks Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

create helper method yes/no checks Also support both 'y' and 'yes' as an input

logger.error(f"The user record is not a PAM User.")
return

record_rotation = params.record_rotation_cache.get(user_record.record_uid)
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

pam action service add has a hard NameError: it reads params.record_rotation_cache, but the function argument is named context. That makes the command fail after record-type validation, so the new service-link flow is unusable.

return None

gateway_context, payload = GatewayContext.find_gateway(vault=vault,
find_func=_find_job,
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Discovery-by-job lookup is effectively dead code because GatewayContext.find_gateway() iterates an empty list. Both job status/preview and job removal call this helper, so they will never find a matching configuration even when the job exists.
Check line 78-83 in init.py
configuration_records=list()


@staticmethod
def add_arguments_to_parser(parser: argparse.ArgumentParser):
choices = ['on', 'off', 'default']
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PAMConfigNewCommand parser destinations do not match what the implementation reads. The parser stores gateway and shared_folder, while the execution path expects gateway_uid and shared_folder_uid, so user-supplied values are ignored.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

parser.add_argument('--gateway', '-g', dest='gateway', action='store', help='Gateway UID or Name')
        parser.add_argument('--shared-folder', '-sf', dest='shared_folder', action='store',
                                help='Share Folder where this PAM Configuration is stored. Should be one of the folders to '
                                        'which the gateway has access to.')


@staticmethod
def add_arguments_to_parser(parser: argparse.ArgumentParser):
choices = ['on', 'off', 'default']
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

parser.add_argument('--gateway', '-g', dest='gateway', action='store', help='Gateway UID or Name')
        parser.add_argument('--shared-folder', '-sf', dest='shared_folder', action='store',
                                help='Share Folder where this PAM Configuration is stored. Should be one of the folders to '
                                        'which the gateway has access to.')

value=item.get("value")
)
)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This method constructs Statement objects, but returns the raw statement_struct list instead. That breaks its own type contract and pushes raw parsed data into rule creation/update.

logger.info(" * Changing the resource admin UID.")
rule_item.admin_uid = admin_uid

statement = kwargs.get("statement")
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Rule update validates a new statement but never applies it to rule_item.statement. The CLI appears to succeed while silently doing nothing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants