oracle / oracle/oci-cli

OCI CLI to alert CR+LF line breaks used in the PEM formatted key files

Open
#757 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
669
Forks
236
Avg merge
1m
Merged PRs (30d)
4

Description

The oci command raises a generic error 401 NotAuthenticated, if the .pem files for the key pair contain Windows style line breaks (CR+LF). It would be desirable for the error message to specifically point out that the carriage return characters must not be present and prompt user to use line feed character only.

Alternatively, the command could accept the Windows style by treating the CR+LF pairs as if they were LF alone.

dchiba@DCHIBA-FOOBAR3 MINGW64 ~/.oci
$ oci os ns get
ServiceError:
{
"client_version": "Oracle-PythonSDK/2.112.1, Oracle-PythonCLI/3.33.1",
"code": "NotAuthenticated",
"logging_tips": "Please run the OCI CLI command using --debug flag to find more debug information.",
"message": "The required information to complete authentication was not provided.",
"opc-request-id": "foo-1:yCjGuV1rB5ZsrZYnYSA7aqMxzZ9dsn3dOSMMnDzXlE7FWxmV61N6ucthrXJilIJM",
"operation_name": "get_namespace",
"request_endpoint": "GET https://objectstorage.us-phoenix-1.oraclecloud.com/n",
"status": 401,
"target_service": "object_storage",
"timestamp": "2024-03-13T17:01:00.753459+00:00",
"troubleshooting_tips": "See [https://docs.oracle.com/iaas/Content/API/References/apierrors.htm] for more information about resolving this error. If you are unable to resolve this issue, run this CLI command with --debug option and contact Oracle support and provide them the full error message."
}

dchiba@DCHIBA-FOOBAR3 MINGW64 ~/.oci
$ cp oci_api_public_key.pem.LFalone oci_api_public_key.pem

dchiba@DCHIBA-FOOBAR3 MINGW64 ~/.oci
$ cp oci_api_key.pem.LFalone oci_api_key.pem

dchiba@DCHIBA-FOOBAR3 MINGW64 ~/.oci
$ oci os ns get
{
"data": "foobarbazbiz"
}

dchiba@DCHIBA-FOOBAR3 MINGW64 ~/.oci
$ ll pem
-rw-r--r-- 1 dchiba 197121 1679 Mar 13 10:01 oci_api_key.pem
-rw-r--r-- 1 dchiba 197121 1706 Sep 20 11:46 oci_api_key.pem.CRLF
-rw-r--r-- 1 dchiba 197121 1679 Mar 13 09:58 oci_api_key.pem.LFalone
-rw-r--r-- 1 dchiba 197121 451 Mar 13 10:01 oci_api_public_key.pem
-rw-r--r-- 1 dchiba 197121 460 Mar 12 16:50 oci_api_public_key.pem.CRLF
-rw-r--r-- 1 dchiba 197121 451 Mar 13 09:58 oci_api_public_key.pem.LFalone

dchiba@DCHIBA-FOOBAR3 MINGW64 ~/.oci

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the failure with the CRLF and LF-only .pem files shown in the issue, using oci os ns get. Trace the CLI's key-file authentication path; done requires an agreed behavior for CRLF files and a result that no longer presents the generic 401 without explaining the line-ending problem.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authentication, cli, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.