search

temporalio / cli

Command-line interface for running Temporal Server and interacting with Workflows, Activities, Namespaces, and other parts of Temporal
https://docs.temporal.io/cli
MIT License
252 stars 38 forks source link

[Feature Request] SSO Authentication via the CLI #198

Open gmintoco opened 1 year ago

gmintoco commented 1 year ago

Is your feature request related to a problem? Please describe.

It is time consuming to distribute certificates to developers so they can use temporal CLI. It is also a potential security concern as these are long lived credentials stored on developers laptops.

Describe the solution you'd like

Ideally you would be able to authenticate using the browser SSO to collect a short term token that would allow authentication to the Temporal Server. This would make the user experience much smoother. Similar to how gcloud auth or aws sso works.

Additional context

feedmeapples commented 1 year ago

ty for the request, discussing with the team

feedmeapples commented 1 year ago

currently there is no plan to authenticate CLI using browser SSO to not incentivize people doing that in their pipelines. As an option a JWT server could be used to provide the token to CLI, ex https://github.com/temporalio/samples-go/tree/main/serverjwtauth#using-tctl-and-registering-the-default-namespace . The example uses tctl, in temporal CLI the alternative to tctl's --auth flag is --grpc-meta

gmintoco commented 1 year ago

Hey @feedmeapples just was having a look at this again. I am curious as to why it would be unwanted to facilitate OAuth via the CLI within pipelines or not?

In my mind running tctl auth would trigger an OAuth flow from the CLI client to get the user to authenticate to cloud.temporal.io, the CLI would then get a token it could use as a JWT to authenticate to the server endpoint. This would be a really easy user experience for developers and reduce the burden of maintain TLS keys.

I took a look through the JWT option you mentioned above a) doesn't seem possible for use with Temporal Cloud and b) is rather complex operationally.

Perhaps I should have clarified as well is that we are using Temporal Cloud with Google SSO.

Thanks :)

tlalfano commented 1 year ago

Re-opening for consideration.

kobybum commented 1 year ago

+1 for the request A perfect example of this would be aws cli, which has aws sso login The user is redirected to the web browser and granted a temporary token. It's not possible to run this in CI, as it uses an OTP through the web UI

bergundy commented 1 year ago

Could you explain a bit more what type of solution you're expecting? Is this for Temporal Cloud or self-hosted?