hashicorp / hashicorp/nomad

Headless Login on CLI with OIDC not currently possible

Open
#23,669 2 comments 1 reaction 0 assignees View on GitHub
stage/accepted theme/cli theme/security type/enhancement
Dominant language
Go
Stars
17k
Forks
2.1k
Avg merge
1d 9h
Merged PRs (30d)
105

Description

### Proposal
The `nomad login` command (when using OIDC auth) currrently uses xdg-open to open the browser for login. It also does not print the auth URL, so on a headless machine we cannot login at all. Please print the login URL to console so a headless remote machine can login.

### Use-cases
There are many but one example would be a development server which is accessed remotely via ssh. X-forwarding is possible but very slow.

### Attempted Solutions
Current workaround is to login to the web-ui on a local machine and copy-paste the secret into the NOMAD_TOKEN env var. This is very cumbersome.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by locating the Go implementation of the `nomad login` command and its OIDC flow, especially the use of `xdg-open`. Make the headless path print the authentication URL to the console, then verify that a user connecting over SSH can complete login without opening a local browser.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication, cli
Issue type
Feature
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.