fermitools / htgettoken

Gets OIDC authentication tokens for High Throughput Computing via a Hashicorp vault server
Other
5 stars 4 forks source link

--nobearertoken option not working with ssh authentication token renewal #94

Closed kurtjstrosahl-jlab closed 8 months ago

kurtjstrosahl-jlab commented 1 year ago

We are using ssh keys to renew tokens for a service account, and when I attempt to use --nobearertoken to only renew the vault token I get the following error:

htgettoken --nobearertoken --nooidc -v -a htvault.jlab.org -i issuername -r role
Initializing kerberos client for host@htvault.jlab.org Kerberos init failed: GSSError: Unspecified GSS failure. Minor code may provide more information. SPNEGO cannot find mechanisms to negotiate.
Getting ssh nonce from https://htvault.jlab.org:8200/v1/auth/ssh/nonce Connecting to 129.57.198.176 Attempting to login with ssh key1 at https://htvault.jlab.org:8200/v1/auth/ssh/login
Logging in with ssh key1 failed: HTTPError: HTTP Error 400: Bad Request: role must be provided
htgettoken: Failure getting token from https://htvault.jlab.org:8200