search

XSEDE / oauth-ssh

SSH with Globus Auth
Apache License 2.0
28 stars 11 forks source link

Trying to setup oauth-ssh pam module with scitokens #76

Closed sharper73 closed 2 years ago

sharper73 commented 3 years ago

Hi, I've installed the oauth-ssh pam module and pulled in scitokens-cpp from EPEL, but I can't find the oauth-ssh.conf file anywhere. I'm trying to get this running on CentOS 7, but the file the documentation mentions doesn't exist. Can you point out where I'm going wrong?

Thanks, Steve Harper s.harper@utah.edu

sharper73 commented 3 years ago

I tried to set this up registering things with Globus auth as the instructions describe, but now if I put in "https://auth.globus.org/v2/web/auth-code" as the redirect it says this redirect is only supported for native clients. Then if you register it as a native client it does not allow you to obtain a client_id and a client_secret. I guess there's a reason everyone is still using gsi-ssh.

Steve Harper

JasonAlt commented 2 years ago

can't find the oauth-ssh.conf file anywhere

The file is actually called /etc/oauth_ssh/globus-ssh.conf. The intent was that scitoken (and other token implementations) would land in separate config files. It looks like the scitoken merge reused globus-ssh.conf and the documents were not update correctly. At the very least, this is a documentation bug.

I tried to set this up registering things with Globus auth as the instructions describe, but now if I put in "https://auth.globus.org/v2/web/auth-code" as the redirect it says this redirect is only supported for native clients.

This is a dup of #77 and is a documentation bug.

I guess there's a reason everyone is still using gsi-ssh

This made me laugh. The frustration is understandable. There is no development targeting this repo. It should likely be archived.

JasonAlt commented 2 years ago

Great news though. After some internal discussions we are planning to put more development effort into this project. No timelines yet, stay tuned!

JasonAlt commented 2 years ago

Documentation updated in server/README.md on master to clear up how to fill out the redirect field and the corrected configuration file name.