ocp-sso-token 0.1.0

Obtain an OCP OAuth token for an SSO IdP with Kerberos support

Automation to create OpenShift CLI tokens for OpenID-connected IdP with Kerberos support

This package can be found on PyPI as ocp-sso-token.

Problem: several manual steps to log into an OpenShift cluster via OIDC without ROPC

To log into an OpenShift cluster on the command line, oc login supports user/password authentication for various identity providers like LDAP or OIDC with ROPC grant flow.

If no provider with password support is configured, the user is referred to the OAuth login page to obtain a temporary token interactively. After selecting the right provider, the user is forwarded to authenticate with the SSO provider, and redirected back to the cluster afterwards. Another click reveals the temporary token that can now be used for the CLI tools.

For an OpenID provider that supports Kerberos tickets, the authentication with the SSO provider happens transparently. For such setups, logging into a cluster via the CLI roughly requires the following steps:

• run oc login and click on the link, or visit a bookmark for the cluster login page
• click on the button for the OpenID provider
• watch the webpages forwarding to each other
• click on the link to reveal the temporary token
• use the shown temporary token/oc login command to log into the cluster

These steps must be performed daily and per cluster.

Approach: automate all the steps above

The Python script in this repository automates all the steps to obtain the temporary token so that the following is possible:

kinit $user@$domain
oc login --server $server --token $(ocp-sso-token $server)

Installing the script

# from PyPI
pip install ocp-sso-token

# from source
pip install --user git+https://gitlab.com/cki-project/ocp-sso-token

Using the script to log into an OpenShift cluster via OIDC

usage: ocp-sso-token [-h] [--identity-providers IDENTITY_PROVIDERS] api_url

Log into an OCP cluster via Kerberos tickets

positional arguments:
  api_url               Cluster API URL like https://api.cluster:6443

optional arguments:
  -h, --help            show this help message and exit
  --identity-providers IDENTITY_PROVIDERS
                        Identity provider names (default: SSO,OpenID)

Running a smoke test:

kinit [e-mail]
server=https://api.cluster:6443
oc --server $server --token $(ocp-sso-token $server) get project

If your identity provider name is not included in the defaults shown above, add it via --identity-providers. The first matching identity provider will be used.

Creating a development setup and running the tests

Installing development dependencies:

pip install -e .[dev]

Running linting/tests:

tox

Creating a release

1. Create a release MR with an update of the version number in ocp_sso_token/__init__.py, e.g to '3.1.4'

2. After merging, push a new tag with the same version prefixed with v, e.g.

   git tag v3.1.4
   git push origin v3.1.4
   

3. Wait for the pipeline to finish

4. Check the resulting GitLab and PyPI releases