feat: add JumpCloud API key v2 detector (jca_ prefix)#4626
feat: add JumpCloud API key v2 detector (jca_ prefix)#4626rootranjan wants to merge 1 commit intotrufflesecurity:mainfrom
Conversation
|
|
rootranjan
force-pushed
the
feat/jumpcloud-v2-detector
branch
from
77f7806 to
7a3da74
Compare
- Add v2 detector for modern JumpCloud API keys (40 chars total: jca_ + 36) - Include false positive filtering (only digits/letters, sequential patterns) - Add entropy check (threshold 3.0) - Move existing detector to v1 with Versioner interface - Both versions share same DetectorType but report version in ExtraData
rootranjan
force-pushed
the
feat/jumpcloud-v2-detector
branch
from
7a3da74 to
0a3c405
Compare
|
|
||
| // JumpCloud API keys with jca_ prefix: jca_ + 36 alphanumeric characters (40 total) | ||
| // Example: jca_aBcDeFgHiJkLmNoPqRsTuVwXyZ123456 | ||
| keyPat = regexp.MustCompile(`\bjca_([a-zA-Z0-9]{36})\b`) |
There was a problem hiding this comment.
Can you share the source/documentation of this?
This page says the new format is prefixed with jcc_ and the length is also greater that what you have added.
There was a problem hiding this comment.
Hi @shahzadhaider1,
I couldn’t find any official JumpCloud docs that specify the full format or length of the admin API key. The JumpCloud APIs help article only states that the admin API key is prefixed with jca_ (“You’ll receive an API key, it has the prefix jca_ before it…” in the Accessing Your API Key section).
The page you linked (Understand Changes to Connect Keys) describes the newer Connect key format, which is prefixed with jcc_ and is a Base64-encoded JSON blob used for agent enrollment, not the admin API key.
In this detector I’m targeting the jca_ admin API key and I’ve chosen the length/charset based on observed keys rather than a published spec. I’ve verified the pattern against valid keys and it matches the current format. If you’d like to double-check, you can follow the steps in the Accessing Your API Key section to generate a key and confirm it matches this pattern.
3 participants
Closes #4624
Description:
JumpCloud has introduced a new API key format with a
jca_prefix. This PR adds a v2 detector to support this new format.Changes:
jca_+ 36 alphanumeric)Key Format:
jca_jca_[a-zA-Z0-9]{36}Checklist:
make test-community)?make lint)?