Repository navigation
security(sso): implement client secret encryption for SSO providers (MVA-3395) #9501
Description
Context
Part of #8994 security hardening. Currently, OAuth client secrets are stored in plaintext in the sso_providers.config JSONB field.
Security Risk
Severity: HIGH
- Database compromise exposes all OAuth client secrets
- Insider threat with DB read access
- Backup exposure
Requirements
- Implement field-level encryption using
cryptography.fernetor integrate with secrets manager (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager) - Encrypt all existing secrets during migration
- Add encryption/decryption layer in
SSOProvidermodel - Ensure backward compatibility during rollout
Acceptance Criteria
- Encryption implementation complete
- Migration script tested on staging
- All new secrets automatically encrypted
- Decryption transparent to SSO service
- Security review by SecurityEngineer
References
- Security assessment:
SSO_OIDC_SECURITY_ASSESSMENT.md(H-2) - Model location:
autobot-slm-backend/user_management/models/sso.py:84-87 - Paperclip issue: MVA-3395
Activity
security(slm/sso): encrypt SSO client secrets at rest with AES-256-GCM (
mrveiss commentedon Jun 17, 2026
Verify-and-close (umbrella #9930 sweep): Already implemented. OAuth client secrets are encrypted at rest via
SSOSecretsManager(autobot-slm-backend/user_management/services/sso_secrets.py) storing AES-256-GCM ciphertext insystem_secrets(key schemesso:provider:{id}:{field}); the providerconfigholds only{field}_refreferences — no plaintext. Migrationmigrations/migrate_sso_secrets_to_system_secret.py(+ test) backfills legacy plaintext. NOTE: the unified-secrets umbrella #10088 will later migrate this into the System/SSO vault (sub-umbrella #8994 Phase C1 #10153). Recommend closing as already-delivered; rotation/vault-migration tracked in #10153/#10154.mrveiss commentedon Jun 22, 2026
Already implemented in
Dev_new_gui. SSO sensitive credentials (client_secret, bind_password) are stored encrypted in SystemSecret storage, not plaintext JSONB:sso_service.pyusessecrets_mgr.store_secrets()on create/update (line 122/158) andsecrets_mgr.retrieve_secret(provider.id, 'client_secret')on use (line 252); model docstring (sso.py:85) documents it. Verified-closed.mrveiss commentedon Jun 22, 2026
Verified implemented in current Dev_new_gui:
SSOSecretsManager(autobot-slm-backend/user_management/services/sso_secrets.py:24) encrypts client_secret/bind_password viaservices.encryption.encrypt_datainto system_secrets (keysso:provider:{id}:client_secret); config holds only refs. Closing as delivered (unified-vault migration tracked separately at #10153).