oauth, saml, oidc accomplish the same thing in a way more mature way, so if you’re already using SSO just do that instead of adding another point of failure..

▲

mjg59 6 hours ago | parent [-]

No they don't - you're still giving the agent a static token that can be exfiltrated and used elsewhere.

▲

hmokiguess 4 hours ago | parent [-]

doesn't the token has an expiry window though? if you're using oidc/sso with aws for example it is short lived and can be revoked

	▲	mjg59 2 hours ago \| parent [-]
		The refresh token is often going to be good for a week, even if the access token isn't.