mirror of
https://github.com/int128/kubelogin.git
synced 2026-05-14 11:56:35 +00:00
905238ce07
* Add new `--oidc-use-access-token` flag to `get-token` Implements https://github.com/int128/kubelogin/issues/1083. See description there for context. In its current form, this PR is bare bones functionality. I have not yet added any tests to confirm this behavior. Additionally, we could consider updtating some of the naming. It is confusing to return a `TokenSet` where `IDToken` actually has an `accessToken`. I'm open to feedback on how best to improve this. However, this PR is functional. I have validated it locally. Without adding `--oidc-use-access-token`, and `id_token` is successfully returned. Adding `--oidc-use-access-token` results in an `access_token` being successfully returned. * Fix failing tests Needed to plumb through our new parameter `UseAccessToken` to the mocks as well. * Add a test to make sure new flag is plumbed through * Support Access Tokens whose audience differ from the client_id As noted in the PR, there are some cases where the access token `aud` field will not be the `client_id`. To allow for these, we use a different token verifier that will not verify that claim. --------- Co-authored-by: Adam kafka <akafka@tesla.com>
76 lines
2.2 KiB
Go
76 lines
2.2 KiB
Go
package cmd
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"github.com/int128/kubelogin/pkg/usecases/setup"
|
|
"github.com/spf13/cobra"
|
|
"github.com/spf13/pflag"
|
|
)
|
|
|
|
// setupOptions represents the options for setup command.
|
|
type setupOptions struct {
|
|
IssuerURL string
|
|
ClientID string
|
|
ClientSecret string
|
|
ExtraScopes []string
|
|
UsePKCE bool
|
|
UseAccessToken bool
|
|
tlsOptions tlsOptions
|
|
authenticationOptions authenticationOptions
|
|
}
|
|
|
|
func (o *setupOptions) addFlags(f *pflag.FlagSet) {
|
|
f.StringVar(&o.IssuerURL, "oidc-issuer-url", "", "Issuer URL of the provider")
|
|
f.StringVar(&o.ClientID, "oidc-client-id", "", "Client ID of the provider")
|
|
f.StringVar(&o.ClientSecret, "oidc-client-secret", "", "Client secret of the provider")
|
|
f.StringSliceVar(&o.ExtraScopes, "oidc-extra-scope", nil, "Scopes to request to the provider")
|
|
f.BoolVar(&o.UsePKCE, "oidc-use-pkce", false, "Force PKCE usage")
|
|
f.BoolVar(&o.UseAccessToken, "oidc-use-access-token", false, "Instead of using the id_token, use the access_token to authenticate to Kubernetes")
|
|
o.tlsOptions.addFlags(f)
|
|
o.authenticationOptions.addFlags(f)
|
|
}
|
|
|
|
type Setup struct {
|
|
Setup setup.Interface
|
|
}
|
|
|
|
func (cmd *Setup) New() *cobra.Command {
|
|
var o setupOptions
|
|
c := &cobra.Command{
|
|
Use: "setup",
|
|
Short: "Show the setup instruction",
|
|
Args: cobra.NoArgs,
|
|
RunE: func(c *cobra.Command, _ []string) error {
|
|
grantOptionSet, err := o.authenticationOptions.grantOptionSet()
|
|
if err != nil {
|
|
return fmt.Errorf("setup: %w", err)
|
|
}
|
|
in := setup.Stage2Input{
|
|
IssuerURL: o.IssuerURL,
|
|
ClientID: o.ClientID,
|
|
ClientSecret: o.ClientSecret,
|
|
ExtraScopes: o.ExtraScopes,
|
|
UsePKCE: o.UsePKCE,
|
|
UseAccessToken: o.UseAccessToken,
|
|
GrantOptionSet: grantOptionSet,
|
|
TLSClientConfig: o.tlsOptions.tlsClientConfig(),
|
|
}
|
|
if c.Flags().Lookup("listen-address").Changed {
|
|
in.ListenAddressArgs = o.authenticationOptions.ListenAddress
|
|
}
|
|
if in.IssuerURL == "" || in.ClientID == "" {
|
|
cmd.Setup.DoStage1()
|
|
return nil
|
|
}
|
|
if err := cmd.Setup.DoStage2(c.Context(), in); err != nil {
|
|
return fmt.Errorf("setup: %w", err)
|
|
}
|
|
return nil
|
|
},
|
|
}
|
|
c.Flags().SortFlags = false
|
|
o.addFlags(c.Flags())
|
|
return c
|
|
}
|