Repository navigation
fix(cli): renew client credentials OIDC tokens - #4389
TaylorMutch merged 3 commits into
Conversation
Closes NVIDIA#4287 Signed-off-by: Eric Curtin <eric.curtin@docker.com>
|
@elezar @johntmyers PTAL when you get a chance, and |
Signed-off-by: Eric Curtin <eric.curtin@docker.com>
|
@elezar @johntmyers PTAL, and |
Signed-off-by: Eric Curtin <eric.curtin@docker.com>
|
Merged main and fixed the conflict. @elezar @johntmyers PTAL, and |
|
@TaylorMutch @SDAChess could you please triage #4287 so the issue check can pass? Thank you! |
|
@drew @krishicks PTAL when you get a chance, and could one of you triage #4287 so the issue check can pass? |
|
@pimlock @TaylorMutch PTAL when you get a chance, and could one of you triage #4287 so the issue check can pass? |
|
/ok to test c2b7bed |
TaylorMutch
left a comment
TaylorMutch
left a comment
There was a problem hiding this comment.
Reviewed client-credentials renewal across command authentication, provider commands, and shell completion.
Supplemental local CLI integration tests verified login, renewal after forced cache expiry, use of the renewed bearer token, cache persistence, and failure before mutation when the client secret is missing. Disabling client-credentials renewal made the success test fail with the original error. Existing OIDC and token-cache tests also passed. These supplemental integration tests remain local and are not included in this PR.
Summary
The CLI now renews an expired client credentials token by repeating the grant, instead of failing with
no refresh token available.Related Issue
Closes #4287
Changes
client_credentials, absent in older files).oidc_renew_token, used by command auth, provider commands and shell completion. It reusesoidc_client_credentials_flow.OPENSHELL_OIDC_CLIENT_SECRET, the error names the variable. The secret is never stored.Testing
cargo test -p openshell-cli --lib oidc_auth,-p openshell-bootstrap --lib oidc_token, the OIDC integration test,cargo clippy -p openshell-cli -p openshell-bootstrap --all-targets -D warnings,cargo fmt --check. Tokens issued before this change have no marker and still need onegateway login.Checklist