Skip to content

Commit 7a50009

Browse files
authored
Merge pull request #90006 from mletalie/OSDOCS-12792
[OSDOCS-12792]More Secure Auth Flows in ROSA CLIs
2 parents c530d4b + 6207d22 commit 7a50009

File tree

2 files changed

+134
-19
lines changed

2 files changed

+134
-19
lines changed

modules/ccs-gcp-customer-procedure-wif.adoc

+32-11
Original file line numberDiff line numberDiff line change
@@ -39,24 +39,45 @@ Besides the required customer procedures listed in _Required customer procedure_
3939

4040
. Install the link:https://console.redhat.com/openshift/downloads[OpenShift Cluster Manager API command-line interface (`ocm`)].
4141
+
42-
To use the OCM CLI, you must authenticate against your Red Hat {cluster-manager} account. This is accomplished with the {cluster-manager} API token.
43-
+
44-
You can obtain your token link:https://console.redhat.com/openshift/token/show[here].
4542

46-
. To authenticate against your Red Hat {cluster-manager} account, run the following command:
47-
+
48-
[source,terminal]
49-
----
50-
$ ocm login --token <token> <1>
51-
----
52-
<1> Replace `<token>` with your {cluster-manager} API token.
53-
+
5443
[IMPORTANT]
5544
====
5645
[subs="attributes+"]
5746
OpenShift Cluster Manager API command-line interface (`ocm`) is a Developer Preview feature only.
5847
For more information about the support scope of Red Hat Developer Preview features, see link:https://access.redhat.com/support/offerings/devpreview/[Developer Preview Support Scope].
5948
====
49+
+
50+
// To use the OCM CLI, you must authenticate against your Red Hat {cluster-manager} account. This is accomplished with the {cluster-manager} API token.
51+
// +
52+
// You can obtain your token link:https://console.redhat.com/openshift/token/show[here].
53+
54+
. To authenticate against your Red Hat {cluster-manager} account, run one of the following commands.
55+
56+
.. If your system supports a web-based browser, run the Red{nbsp}Hat single sign-on (SSO) authorization code command for secure authentication:
57+
+
58+
.Syntax
59+
[source,terminal]
60+
----
61+
$ ocm login --use-auth-code
62+
----
63+
+
64+
Running this command will redirect you to the Red Hat SSO login. Log in with your Red{nbsp}Hat login or email.
65+
+
66+
.. If you are working with containers, remote hosts, and other environments without a web browser, run the Red{nbsp}Hat single sign-on (SSO) device code command for secure authentication:
67+
68+
+
69+
.Syntax
70+
[source,terminal]
71+
----
72+
$ ocm login --use-device-code
73+
----
74+
Running this command will redirect you to the Red{nbsp}Hat SSO login and provide a log in code.
75+
76+
+
77+
78+
To switch accounts, logout from https://sso.redhat.com and run the `ocm logout` command in your terminal before attempting to login again.
79+
80+
+
6081

6182
. Install the link:https://cloud.google.com/sdk/docs/install[gcloud CLI].
6283
+

modules/rosa-configure.adoc

+102-8
Original file line numberDiff line numberDiff line change
@@ -10,22 +10,116 @@ Use the following commands to configure the {product-title} (ROSA) CLI, `rosa`.
1010

1111
[id="rosa-login_{context}"]
1212
== login
13+
There are several methods you can use to log into your Red{nbsp}Hat account using the {product-title} (ROSA) CLI (`rosa`). These methods are described in detail below.
14+
15+
[IMPORTANT]
16+
====
17+
An offline authentication token is long-lived, stored on your operating system, and cannot be revoked. These factors increase overall security risks and the likelihood of unauthorized access to your account. Alternatively, the Red{nbsp}Hat secure browser-based single sign-on (SSO) method automatically sends your CLI instance a refresh token that is valid for 10 hours. Because this authorization code is unique and temporary, it is more secure and is the Red{nbsp}Hat recommended method of authentication.
18+
====
19+
20+
// Furthermore, offline authentication tokens are usually stored on your device by your operating system, which means other apps on your machine can access a token if the token is not properly secured. These offline tokens are long-lived and cannot be revoked. Users must copy and paste them manually which creates a security risk. Because of these factors, Red{nbsp}Hat recommends using the single sign-on method when logging into your account with the ROSA CLI (`rosa`). This method is more secure than logging in with an offline token.
21+
// ====
1322

14-
Log in to your Red{nbsp}Hat account, saving the credentials to the `rosa` configuration file. You must provide a token when logging in. You can copy your token from link:https://console.redhat.com/openshift/token/rosa[the ROSA token page].
1523

16-
The ROSA CLI (`rosa`) looks for a token in the following priority order:
24+
[id="rosa-login-sso_{context}"]
25+
=== login with single sign-on (SSO) authorization code
1726

18-
. Command-line arguments
19-
. The `ROSA_TOKEN` environment variable
20-
. The `rosa` configuration file
21-
. Interactively from a command-line prompt
27+
If your system supports a web-based browser, you can log in to the ROSA CLI (`rosa`) with a Red{nbsp}Hat single sign-on (SSO) authorization code.
28+
29+
[NOTE]
30+
====
31+
Single sign-on authorization is supported with ROSA CLI (`rosa`) version 1.2.36 or later.
32+
====
2233

34+
. To log into the ROSA CLI (`rosa`) with a Red{nbsp}Hat single sign-on authorization code, run the following command:
35+
36+
+
2337
.Syntax
2438
[source,terminal]
2539
----
26-
$ rosa login [arguments]
40+
$ rosa login --use-auth-code
41+
----
42+
+
43+
Running this command will redirect you to the Red{nbsp}Hat SSO login. Log in with your Red{nbsp}Hat login or email.
44+
+
45+
.Optional arguments inherited from parent commands
46+
[cols="30,70"]
47+
|===
48+
|Option |Definition
49+
50+
|--help
51+
|Shows help for this command.
52+
53+
|--debug
54+
|Enables debug mode.
55+
56+
|===
57+
+
58+
To switch accounts, logout from link:https://sso.redhat.com[https://sso.redhat.com] and run the `rosa logout` command in your terminal before attempting to login again.
59+
60+
[id="rosa-login-sso-device_{context}"]
61+
=== login with a single sign-on device code
62+
If you are working with containers, remote hosts, and other environments without a web browser, you can use a Red{nbsp}Hat single sign-on (SSO) device code for secure authentication. To do this, you must use a second device that has a web browser to approve the login.
63+
[NOTE]
64+
====
65+
Single sign-on authorization is supported with ROSA CLI (`rosa`) version 1.2.36 or later.
66+
====
67+
. To log in to ROSA CLI (`rosa`) with a Red Hat single sign-on device code, run the following command:
68+
69+
+
70+
.Syntax
71+
[source,terminal]
2772
----
73+
$ rosa login --use-device-code
74+
----
75+
+
76+
Running this command will redirect you to the Red Hat SSO login and provide a log in code.
77+
+
78+
.Optional arguments inherited from parent commands
79+
[cols="30,70"]
80+
|===
81+
|Option |Definition
82+
83+
|--help
84+
|Shows help for this command.
85+
86+
|--debug
87+
|Enables debug mode.
88+
89+
|===
90+
+
91+
To switch accounts, logout from link:https://sso.redhat.com[https://sso.redhat.com] and run the `rosa logout` command in your terminal before attempting to login again.
92+
93+
94+
[id="rosa-login-token_{context}"]
95+
=== login with an offline token
2896

97+
Log in to your Red{nbsp}Hat account, saving the credentials to the `rosa` configuration file.
98+
99+
To use offline tokens for automation purposes, you can download the OpenShift Cluster Manager API token from the link:https://console.redhat.com/openshift/token/rosa[OpenShift Cluster Manager API Token] page.
100+
101+
To use service accounts for automation purposes, see the link:https://console.redhat.com/iam/service-accounts[Service Accounts] page.
102+
103+
[NOTE]
104+
====
105+
Red{nbsp}Hat recommends using service accounts for automation purposes.
106+
====
107+
108+
// The ROSA CLI (`rosa`) looks for a token in the following priority order:
109+
110+
// . Command-line arguments
111+
// . The `ROSA_TOKEN` environment variable
112+
// . The `rosa` configuration file
113+
// . Interactively from a command-line prompt
114+
115+
. To log in to ROSA CLI (`rosa`) with a Red{nbsp}Hat offline token, run the following command:
116+
+
117+
.Syntax
118+
[source,terminal]
119+
----
120+
$ rosa login [arguments]
121+
----
122+
+
29123
.Arguments
30124
[cols="30,70"]
31125
|===
@@ -49,7 +143,7 @@ $ rosa login [arguments]
49143
|--token-url
50144
|The OpenID token URL (string). Default: `\https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/token`
51145
|===
52-
146+
+
53147
.Optional arguments inherited from parent commands
54148
[cols="30,70"]
55149
|===

0 commit comments

Comments
 (0)