OAUTH: gather CA parameters from provisioner list

[Slamdunk]

Hi, currently to get a user certificate we run the suggested:

$ TOKEN=$(step oauth --oidc --bare --client-id XXX --client-secret YYY)
$ step ca certificate --token $TOKEN [email protected] user.crt user.key

The step ca certificate doesn't need the OAUTH parameters as it's up to the step-ca server to decide how to use the TOKEN.

I wonder: could we as well let the step-ca give the correct OAUTH client parameters to step oauth by the provisioner list?
I guess that, to preserve consistency, it should be a step ca subcommand, so we can end up with:

$ TOKEN=$(step ca oauth --oidc --bare --provisioner MyCustomOidc)
$ step ca certificate --token $TOKEN [email protected] user.crt user.key

[tashian]

Hi @Slamdunk,

You may be looking for step ca token [email protected] --provisioner "OIDC" as the first command.

It looks like step ca token with an OIDC provisioner is just a shortcut to step oauth with the provisioner parameters.

Does that work for what you need to do?

[tashian]

Alternatively, you could use step ca provisioner list, extract the OIDC parameters from that, run your own flow with stpe oauth or however you like, and then use step ca certificate --token with the token you get back.

[Slamdunk]

Didn't see step ca token, sorry.

It seems it needs some tweaks though:

1. --root must be specified, but it's present in the $STEPPATH config, I guess there's no need for it
2. It lacks some useful options present in step oauth like --prompt
3. The email is specified, but not passed to the provisioner, so the provisioner (Google) asks me my email login

But I guess it wouldn't be straightforward to proxy step ca token to step oauth, since the former is general purpose.

I'll go with custom scripting around step ca provisioner list then, thank you

[maraino]

@Slamdunk all flags can be set in the file $STEPPATH/config/defaults.json, and using environment variables, there might be cases where this is not ideal, but we try to make the most common flags unique, ie:--root, --ca-url, especially the ones we set by default.

I don't think we use --prompt at any other place, so as a workaround you should be able to set "prompt":"consent" or something similar in your defaults.json. Another way to pass parameters to the step oath executed through the step ca token is using environment variables STEP_PROMPT=consent for example. The email can also be set in the defaults or environment variable.