docs: update OIDC client documentation - #845
Conversation
remove oidc auto feature.
c396b66 to
7f0dc46
Compare
| *auth_type* is specified to be "oidc" in the *rucio.cfg* file, `-S` can be | ||
| omitted as well. Furthermore, we use the same default issuer as configured on | ||
| Rucio server side. | ||
| The default IdP/issuer is configured on the Rucio server side. If the server supports |
There was a problem hiding this comment.
In case an operator gets lost and is reading this page, a link to the config parameter to set is a good idea
| `idpsecrets.json` file. | ||
|
|
||
| 1. Login via user's browser + fetch code: | ||
| In the examples below we assume you do not want to use the Rucio account name from your |
There was a problem hiding this comment.
This is sort of confusingly worded. Should we just say
This example assumes a local `rucio.cfg` that only contains `client.rucio_host`.
If `client.account` is set to your preferred account, omit `--account` options when applicable. If `client.auth_type` is set, omit `--auth-strategy`. ?
| whoami | ||
| ``` | ||
| ```bash | ||
| rucio --account <rucio_account_name> --auth-strategy OIDC -v whoami |
There was a problem hiding this comment.
Should we include the -v? Because this is user docs this may just make noise instead of just verifying the user logged in
| - The same holds for the `aud` (audience) claim. | ||
| - The token issuer is known to the Rucio authentication server. | ||
| - The identity of the token (`SUB=<user sub claim>`, `ISS=<issuer url>`) is assigned to | ||
| an existing, pre-provisioned Rucio account. |
There was a problem hiding this comment.
I think this is too dense for a user audience, users for the most part I don't think will be trying to get tokens from a source that hasn't been set up (or at least blessed) by the deployment operators. (At least I hope!) This should probably be added to some operator docs instead.
| oauth_manager daemon run, it will return this existing new token. If the | ||
| presented token is invalid/expired/does not have refresh token in the DB, no | ||
| refresh will be attempted. | ||
| `auth_oidc_refresh_active` is `false` by default. If enabled, the client tracks the |
There was a problem hiding this comment.
| `auth_oidc_refresh_active` is `false` by default. If enabled, the client tracks the | |
| If enabled, the client tracks the |
| - token issuer is known to Rucio Authentication server | ||
| - the identity of the token (`SUB=\<user sub claim\>, ISS=\<issuer url\>`) is | ||
| assigned to an existing Rucio account (pre-provisioned) | ||
| - The token `scope` claim contains at least the minimum scope (e.g. `openid profile`) |
There was a problem hiding this comment.
This is a repeat of the wgll discovery section. I still think this should be removed added to operator information, but at least one of these should be removed so we don't get conflict between them at a later date
| s = requests.session() | ||
| your_token = "<your JWT access token string>" | ||
| headers = {"X-Rucio-Auth-Token": your_token} | ||
| address = "https://<Rucio Auth Server Name>/accounts/guenther" |
There was a problem hiding this comment.
| address = "https://<Rucio Auth Server Name>/accounts/guenther" | |
| address = "https://<Rucio Auth Server Name>/accounts/<rucio_account_name>" |
| ``` | ||
|
|
||
| ```json | ||
| { |
There was a problem hiding this comment.
All the account=guenther info should be stripped out here
| auth_token_file_path = /path/to/token/file | ||
| ``` | ||
|
|
||
| Note that tokens found via WLCG token discovery (environment variables or `bt_u$ID` |
There was a problem hiding this comment.
Should use the :: note :: format
| There is also an option to specify a `auth_token_file_path` in the `client` | ||
| section of the rucio.cfg file. Rucio Client will then store and search for | ||
| user's token saved in such file: | ||
| ## Token file location |
There was a problem hiding this comment.
Worth just moving the section of wgll discovery down into here and naming the section "Token Discovery"
| user's token saved in such file: | ||
| ## Token file location | ||
|
|
||
| By default the Rucio client stores its token in a file under a per-account token |
There was a problem hiding this comment.
This is vague and a little confusing. Where exactly is that path supposed to be?
2 participants
remove oidc auto feature and add WLCG token discovery for oidc auth.
Closes: #827