Feature-Request: command line login

[erikatdeka]

Currently, when you type cloudctl login, a brower window opens with the login screen. A login from server environments without browser is therefore only difficult or not possible.

It should be possible to add a user and password to the login command. A browser is then no longer needed.
For example: cloudctl login -u -p

[majst01]

This is not so easy possible and therefore not implemented actually for oauth based authentication workflows. For the same reason tools like gcloud or github cli do it in the same way we do, they open a browser window where the user is prompted for login credentials. This allows the implementation of 2FA mechanisms for example.

[peterfromthehill]

Hi,
i would like to take up the topic again because the idea is very interesting.
For example, you mentioned gcloud. There you can use the --no-browser option to display the login URL and get a kind of token back.
Alternatively, I also have the opportunity to handle service accounts in the GCP environment. Is this maybe an option here?

[fschaphaus]

@peterfromthehill You need a service account. Then it is quite easy to get the token.

Here is a solution with curl:

KEYCLOAK_URL=
REALM=
CLIENT_ID=
CLIENT_SECRET=
KEYCLOAK_USER=
KEYCLOAK_PASSWORD=

export CLOUDCTL_APITOKEN=$(curl -sSX POST "https://$KEYCLOAK_URL/auth/realms/$REALM/protocol/openid-connect/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "client_id=$CLIENT_ID" \
  -d "client_secret=$CLIENT_SECRET" \
  -d "username=$KEYCLOAK_USER" \
  -d "password=$KEYCLOAK_PASSWORD" \
  -d "grant_type=password" | jq -r '.access_token')

# The command should work
cloudctl project ls

and a solution with Terraform:

data "http" "keycloak" {
  url    = var.keycloak_url
  method = "POST"

  request_headers = {
    Accept         = "application/json"
    "Content-Type" = "application/x-www-form-urlencoded"
  }

  request_body = "client_id=${var.keycloak_client_id}&client_secret=${var.keycloak_client_secret}&username=${var.keycloak_username}&password=${var.keycloak_password}&grant_type=password"
}

locals {
  keycloak_token = jsondecode(data.http.keycloak.response_body).access_token
}

You can then simply use local.keycloak_token to get the token.