nginxinc/nginx-ldap-auth

Is there any way we can avoid providing X-Ldap-BindPass as plain text.

skiransk opened this issue · 2 comments

skiransk commented

Hello @vl-homutov

Can anyone please let me know if you tried any other way of providing the X-Ldap_BindPass instead of providing it in plain text.
Committing the admin password to git something risky.

Thank you in advance.
SK

worsco commented

Is this a situation where a vault (like hashicorp vault, or perhaps using puppet/ansible/salt/etc and a secret vault) would store your secret? And then on deployment of the configuration you'd fill in the "X-Ldap_BindPass"?

rajdeep-2001 commented

I have the same situation where we are fetching the X-Ldap-BindPass from AWS secret/parameter store and filling it in the nginx configuration file via terraform automation and cloudconfig userdata during deployment. However, this password is still plain text in the nginx conf in the Nginx Plus EC2 instance. Is there a way to encrypt it in the conf itself for AD authentication? Any help/suggestions would be greatly appreciated. Thanks!!