OCI: support profiles that authenticate with a security token - #4308
fede-kamel wants to merge 1 commit into
Conversation
`get_client_config` returns the profile as the SDK config and every OCI client is then built from it without a signer, so the SDK builds its default API key signer. A profile created by `oci session authenticate` carries a short-lived security token and an ephemeral key pair rather than a registered API key, and has no `user` entry, so that signer cannot authenticate with it: configuring the backend fails with `creds_valid()` returning False even though the same profile works with the OCI CLI. Build an `oci.auth.signers.SecurityTokenSigner` when the config has `security_token_file`, and pass it to every client the backend constructs. API key profiles keep using the SDK default signer. Verified against a session token profile: `creds_valid` now returns True, the backend configures, and offers are returned.
So the backend configuration will be accepted and will work at first, but then break after an hour? I'm afraid this is rather counterintuitive and inconsistent with other backends.
If I understand correctly, refreshing the token may trigger user interaction in the browser, which doesn't work for So far, it looks like session tokens aren't a good choice for |
2 participants
Steps to reproduce
Create an OCI profile with
oci session authenticate(the flow the OCI docs recommend for federated/SSO logins) and point theocibackend at it:Actual behaviour
The backend cannot be configured. The credentials are reported invalid even though the same profile works with the OCI CLI:
get_client_configreturns the profile as the SDK config, andregion.pythen builds every client from it without a signer, so the SDK constructs its default API key signer. A profile written byoci session authenticatehas a short-livedsecurity_token_fileand an ephemeral key pair instead of a registered API key, and nouserentry, so that signer cannot sign for it.Expected behaviour
Session token profiles authenticate, like they do with the OCI CLI and the OCI SDK when it is given a
SecurityTokenSigner.Change
Build an
oci.auth.signers.SecurityTokenSignerwhen the config carriessecurity_token_file, and pass it to every client the backend constructs. API key profiles are unaffected:get_signerreturnsNoneand the SDK keeps building its default signer.Tests
New
src/tests/_internal/core/backends/oci/test_auth.pycovering the API key case, the security token case, and token whitespace handling. OCI backend suite 23 passed, whole backends suite 453 passed,ruff checkandruff formatclean.Verified against a real session token profile:
creds_validreturns True, the backend configures, offers are returned, and a run provisions.Note
Security tokens are short-lived (about an hour). The signer reads the token file when a client is constructed, so a token refreshed with
oci session refreshis picked up by later clients, but a server holding a backend open across an expiry will still see failures. Happy to look at refresh handling separately if you think it is worth it.