As part of their day-to-day work, each member of our analysis team must handle a variety of sensitive information. For example: username and passwords for our internal databases, and tokens for accessing APIs. Some of this is specific to each individual, while some are shared by the whole team.

Ideally, each team member would only need to enter some individual login information once and then have automatic access to everything. For instance, our custom analysis libraries would need to be able to find the tokens it needs to access the web services we use.

What is a best practice for handling this type of situation?

  • 1
    Any SSO and role-assumption service would cover this, but I’m assuming that is not in place at this time? – John Keates Mar 17 '20 at 9:33
  • Thanks. We actually do use Lastpass, but that doesn't quite fit the bill. See comment below. – Andrew Plowright Mar 17 '20 at 18:20
  • LastPass is a password manager, not a single sign-on solution or identity federation system :-) – John Keates Mar 18 '20 at 5:55

You are looking for a password vault solution like KeePass, Lastpass or Bitwaren. Because you have shared passwords as well, an online solution would be the preferred option.

There are many different products available with subtle differences. You have to evaluate for yourself, which flavor is right for you. If it is an online solution, you should opt for an on-premise implementation, where you have full control over the server. You do not want to push your credentials into a cloud system managed by a third party.

Such a solution would fulfill your requirements. Each user has to login with his credentials on the platform and gets access to the credentials and tokens that he or she needs.

  • Thanks. I should have mentioned that we do already use LastPass. However, to my knowledge, users still retrieve credentials from LastPass one-by-one, as they're needed. For instance, they retrieve a username and password from LastPass when logging on to their email accounts. This works great, but I'm thinking of a situation where they might want to, say, run a script that will access multiple web services and databases. We wouldn't want to stop and fill in the tokens and credentials for each of those. – Andrew Plowright Mar 17 '20 at 18:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.