Feature: Expose bhe_saml_sp_key and bhe_saml_sp_cert via ENV variables

[Daniel-CS-Team]

Feature Description

Expose bhe_saml_sp_key and bhe_saml_sp_cert via ENV variables, so that they can be managed via docker secrets or AWS SecretsManager or equivalent for other platforms.

Are you intending to implement this feature?

no

Current Behavior

bhe_saml_sp_key and bhe_saml_sp_cert must be set in the config-file. Which means that you have to put a private key in plaintext in a static config file, which might be managed via git. This is considered bad practice (at least in our organization), as secrets should only be available at runtime.

Desired Behavior

bhe_saml_sp_key and bhe_saml_sp_cert can be controlled via ENV variables, so that they can be provided only at container runtime and can be stored via the platforms secrets management facility.

Use Case

The features increases the security of bhe_saml_sp_key, makes management of BH easier and makes BH more compliant with security best practices.

Additional Information

First mentioned in Issue 83.

[yannickwellens]

Any news on this? :)

[XanderVanRompaye1]

Hi, we are waiting for this feature so we can enable SSO.
Is there an update on this issue?
Thanks in advance!

[StephenHinck]

Apologies for the delay on this one - this is already supported, please see: https://github.com/SpecterOps/BloodHound/wiki/Using-Environment-Variables-For-Sensitive-Configuration. You may use the variables bhe_saml_sp_cert and bhe_saml_sp_key.