oauth2cli icon indicating copy to clipboard operation
oauth2cli copied to clipboard

Add support for non-interactive logins on headless machines

Open trietsch opened this issue 3 years ago • 1 comments

This is an opinionated approach to support non-interactive logins on headless machines. These types of machines do not have access to a browser, and thus need to receive an authorization code as the starting point to successfully complete the regular OAuth 2.0 Authorization Code flow. This PR implements that and therefore resolves #13, not as a fallback, but explicitly. Generally it goes as follows:

  1. Create a config, with NonInteractive set to true
  2. Initiate the GetToken process, and you'll be prompted with an input
  3. In a separate process, initiate GetCodeAndConfig, and complete the login flow in the browser. Take note of the printed result, which is a base64 encoded struct, that holds both the authorization code and the used oauth2.config, which is necessary to successfully exchange the code for a token.
  4. Paste the base64 encoded OAuth2ConfigAndCode, which is decoded and unmarshalled, after which the oauth.config in the provided oauth2cli.Config is overwritten by the oauth2.config used during the retrieval of the code.
  5. The code is exchanged for a token

Note that the processes can be executed on the same machine (why would you do that? 😄), or on separate machines (the entire goal of this PR).

@int128 let me know what you think!

trietsch avatar Dec 09 '22 22:12 trietsch

@int128 any chance you could take a look at this PR? :)

trietsch avatar Jul 17 '23 04:07 trietsch