{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/vault/issues/571","labels_url":"https://api.github.com/repos/hashicorp/vault/issues/571/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/vault/issues/571/comments","events_url":"https://api.github.com/repos/hashicorp/vault/issues/571/events","html_url":"https://github.com/hashicorp/vault/issues/571","id":103317771,"number":571,"title":"Dynamic User Creation on SSH Backend","user":{"login":"ekristen","id":48329,"avatar_url":"https://avatars.githubusercontent.com/u/48329?v=3","gravatar_id":"","url":"https://api.github.com/users/ekristen","html_url":"https://github.com/ekristen","followers_url":"https://api.github.com/users/ekristen/followers","following_url":"https://api.github.com/users/ekristen/following{/other_user}","gists_url":"https://api.github.com/users/ekristen/gists{/gist_id}","starred_url":"https://api.github.com/users/ekristen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ekristen/subscriptions","organizations_url":"https://api.github.com/users/ekristen/orgs","repos_url":"https://api.github.com/users/ekristen/repos","events_url":"https://api.github.com/users/ekristen/events{/privacy}","received_events_url":"https://api.github.com/users/ekristen/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-08-26T16:46:55Z","updated_at":"2015-08-26T23:25:32Z","closed_at":null,"body":"What do you think about giving the SSH backend with the dynamic key the ability to create the user as well and set a dynamic password for the session? It could be implemented as a dynamic_user instead of dynamic_key option.\r\n\r\nThoughts?"},"comment":{"url":"https://api.github.com/repos/hashicorp/vault/issues/comments/135204307","html_url":"https://github.com/hashicorp/vault/issues/571#issuecomment-135204307","issue_url":"https://api.github.com/repos/hashicorp/vault/issues/571","id":135204307,"user":{"login":"ekristen","id":48329,"avatar_url":"https://avatars.githubusercontent.com/u/48329?v=3","gravatar_id":"","url":"https://api.github.com/users/ekristen","html_url":"https://github.com/ekristen","followers_url":"https://api.github.com/users/ekristen/followers","following_url":"https://api.github.com/users/ekristen/following{/other_user}","gists_url":"https://api.github.com/users/ekristen/gists{/gist_id}","starred_url":"https://api.github.com/users/ekristen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ekristen/subscriptions","organizations_url":"https://api.github.com/users/ekristen/orgs","repos_url":"https://api.github.com/users/ekristen/repos","events_url":"https://api.github.com/users/ekristen/events{/privacy}","received_events_url":"https://api.github.com/users/ekristen/received_events","type":"User","site_admin":false},"created_at":"2015-08-26T23:25:32Z","updated_at":"2015-08-26T23:25:32Z","body":"Well I like the dynamic key system better than the OTP because it forces short lived secrets, whereas OTP does not, that means old possibly compromised passwords and ssh keys could be on the server still. OTP should enforce only valid users with valid access to vault can access but I have audit logs with vault already so I know what users are calling all endpoints. I also have auditing on all servers auth logs too. \r\n\r\nI think there is a nice use case whereby I grant someone access to use a specific role that allows them access to a certain set of servers without first having to have my configuration management server create an account on a linux box, especially for accounts that rarely get used. \r\n\r\nLike I mentioned earlier if we slightly change the install_script to provide the username, and move the authorized key path to the install_script then we can allow for any behavior and not limit it to just that of modifying the authorized_keys file.\r\n\r\n"}}