OCI: support profiles that authenticate with a security token - #4308
Open
fede-kamel wants to merge 1 commit into
Open
fede-kamel wants to merge 1 commit into
fede-kamel wants to merge 1 commit into
Conversation
`get_client_config` returns the profile as the SDK config and every OCI client is then built from it without a signer, so the SDK builds its default API key signer. A profile created by `oci session authenticate` carries a short-lived security token and an ephemeral key pair rather than a registered API key, and has no `user` entry, so that signer cannot authenticate with it: configuring the backend fails with `creds_valid()` returning False even though the same profile works with the OCI CLI. Build an `oci.auth.signers.SecurityTokenSigner` when the config has `security_token_file`, and pass it to every client the backend constructs. API key profiles keep using the SDK default signer. Verified against a session token profile: `creds_valid` now returns True, the backend configures, and offers are returned.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Steps to reproduce
Create an OCI profile with
oci session authenticate(the flow the OCI docs recommend for federated/SSO logins) and point theocibackend at it:Actual behaviour
The backend cannot be configured. The credentials are reported invalid even though the same profile works with the OCI CLI:
get_client_configreturns the profile as the SDK config, andregion.pythen builds every client from it without a signer, so the SDK constructs its default API key signer. A profile written byoci session authenticatehas a short-livedsecurity_token_fileand an ephemeral key pair instead of a registered API key, and nouserentry, so that signer cannot sign for it.Expected behaviour
Session token profiles authenticate, like they do with the OCI CLI and the OCI SDK when it is given a
SecurityTokenSigner.Change
Build an
oci.auth.signers.SecurityTokenSignerwhen the config carriessecurity_token_file, and pass it to every client the backend constructs. API key profiles are unaffected:get_signerreturnsNoneand the SDK keeps building its default signer.Tests
New
src/tests/_internal/core/backends/oci/test_auth.pycovering the API key case, the security token case, and token whitespace handling. OCI backend suite 23 passed, whole backends suite 453 passed,ruff checkandruff formatclean.Verified against a real session token profile:
creds_validreturns True, the backend configures, offers are returned, and a run provisions.Note
Security tokens are short-lived (about an hour). The signer reads the token file when a client is constructed, so a token refreshed with
oci session refreshis picked up by later clients, but a server holding a backend open across an expiry will still see failures. Happy to look at refresh handling separately if you think it is worth it.