search

opentdf / otdfctl

OpenTDF command line interface
BSD 3-Clause Clear License
7 stars 4 forks source link

When connected to platform with insecure TLS certs (i.e. self-signed), CLI should provide better context #407

Open jakedoublev opened 1 month ago

jakedoublev commented 1 month ago

Background

At present, if connected to a platform running with insecure self-signed certs or over http, the CLI will report Failed to get platform configuration. Is the platform accepting connections at '$HOST'? when using client credentials, or ERROR An error occurred during login. Please check your credentials and try again: platform configuration not found when trying to directly authenticate the profile through client credentials.

These errors are misleading, as the true error is that the well-known config is available but the cert failed. This is due to logic here: https://github.com/opentdf/otdfctl/blob/cdaae409c98fe54b58d6d35dba9c990929d8145a/cmd/root.go#L146

We should check if the reason the SDK errored out was due to not passing --tls-no-verify and instruct the CLI user helpfully about the situation.

Acceptance Criteria

  1. CLI should check for a failed connection due to a TLS issue
  2. CLI should report on the failed TLS connection and warn the user that they may need to insecurely skip TLS verification
  3. e2e test