Add DPAPI based credential store on Windows #464
Conversation
Implement a unified proxy pattern for the available credential stores. This allows users to select from multiple stores on all platforms, as we currently support for Linux.
Add a new credential store on Windows that uses DPAPI to encrypt the password field in a file. The file format is otherwise identical to the Plaintext credential store. The default location for the DPAPI store is ~/.gcm/dpapi_store and this can be configured with the GCM_DPAPI_STORE_PATH or credential.dpapiStorePath. The addition of the DPAPI credential store allows for secure credential storage on Windows in cases where the Windows Credential Manager cannot work/has limitations. Specifically, DPAPI works over network sessions (like SSH) and is not subject to size limits.
Add an explicit test for credential persistence. If Windows indicates that either we don't have a credential set for the logon session, or the maximum allowed persistence for generic credentials is less than "local machine" then fail.
mjcheetham
requested review from
vtbassmatt,
derrickstolee,
vdye,
ldennington and
jeffhostetler
and removed request for
vtbassmatt and
derrickstolee
The DPAPI interface as exposed in .NET ( This is the same pattern that MSAL.NET and Visual Studio use for protecting their token caches. |
That should be easy to add actually in the existing "unit" tests! |
Introduce a new credential store for Windows that uses DPAPI to encrypt the credentials on disk.
The default credential store on Windows will continue to be the Windows Credential Manager (wincredman), but by offering DPAPI we will allow the following limitations to be overcome:
We only continue to use the wincredman solution as it offers a reasonable GUI for viewing and deleting stored credentials for the user. The plan would be to change the default to the DPAPI credential store if/when we even create our own easy to use GUI for managing GCM's stored credentials.
As part of this change it is now possible to also use the plaintext credential store on Windows and macOS, following the same model as we have for selecting the credential store on Linux. The only difference is that Windows and macOS have a default store, and on Linux you must select one.
Fixes #452