Re:Passage: A fork of password-store that uses age instead o...
by SahAssar on Saturday December 18, 2021 @06:05AM
(#29603567)
Most services don't have a good way to restrict 2fa to certain keys which would be required for that.
Also that would still mean rotating any tokens/m2m keys that have been issued.
The "proper way" would be to try to minimize how many tokens/keys are readable by employees (they should probably be only read by deployment jobs etc.) and use SSO for interactive logins. When offboarding a user it should be enough to remove the user from the SSO provider and rotate any tokens/m2m keys that the employee actually had access to (as long as the employee did not get access to issue new tokens).
Unfortunately a lot of services treat SSO as a "premium" feature and require "call us" enterprise plans for it.
Also that would still mean rotating any tokens/m2m keys that have been issued.
The "proper way" would be to try to minimize how many tokens/keys are readable by employees (they should probably be only read by deployment jobs etc.) and use SSO for interactive logins. When offboarding a user it should be enough to remove the user from the SSO provider and rotate any tokens/m2m keys that the employee actually had access to (as long as the employee did not get access to issue new tokens).
Unfortunately a lot of services treat SSO as a "premium" feature and require "call us" enterprise plans for it.