dianagudu/mccli

SSH client wrapper for SSH with OIDC access tokens

mccli

This is an SSH client wrapper that enables SSH with OIDC access tokens.

For server-side software, see motley_cue.

Compatibility

mccli works with Python 3 (>=3.7), and only Linux. Windows support is planned as plugins for popular SSH clients, such as PuTTY.

Documentation

The documentation is available at readthedocs.

Test server

You can test this tool against our test SSH server that supports OIDC-based authentication:

ssh-oidc-demo.data.kit.edu

The server accepts tokens from the following OIDC providers:

• EGI Check-in
• WLCG
• HELMHOLTZ AAI (production)
• HELMHOLTZ AAI (development)
• KIT
• DEEP Hybrid DataCloud
• Google

License

The source code is licensed under the MIT license.

The logo is licensed under the Creative Commons Attribution 4.0 International License .

mccli's Issues

"No Access Token found" when required scopes are missing

Check if `sshpass` is available

Withouth sshpass installed I get this error:

Usage: mccli [OPTIONS] COMMAND [ARGS]...

Error: No such command 'ssh-oidc-demo.data.kit.edu'.

Which makes sense, if you know the cause :)

Maybe adding a short "Prerequisites" section to installation.rst:

Prerequisites:
=============
Required dependencies:
- `sshpass`: This package is available on most linux distributions as `sshpass`
- `oidc-agent`: This package is available on most linux distributions as `oidc-agent` (use `oidc-agent-cli` on systems without GUI)
     

mccli options for top level command must be passed to subcommands

mccli --mc-endpoint http://some_url ssh hostname

is not the same as

mccli ssh --mc-endpoint http://some_url hostname

Only the second example uses the given mc_endpoint.

Solution: look into context passing for click

Use issuer supported by server without setting oa-account

If the server only supports one issuer, use that without asking the user to set the oidc-agent account or pass the AT. Depends on #2.

More info when no AT provided and multiple OPs supported on server

When no AT source is specified, mccli tries to get the list of supported OPs from motley_cue and, if only one is supported, tries using that to get an AT from the oidc-agent.

When multiple OPs are supported, make the error message more informative by printing the list of supported OPs.

Nice to have `mccli info`

mccli info <token> or `mccli info
could display output just like flaat-userinfo (because then people don't need to install flaat).

But this is really just nice to have.

Set issuer instead of oidc-agent account or AT

oidc-agent supports default accounts for each issuer.

Need to:

• minimise user interaction
• save oidc-agent configs to retrieve AT on subsequent calls

--oidc option instead of / in addition to --oa-account

urllib3 v2.0 support

From requests v2.3, support for urllib3 v2.0 was added, which breaks mccli on systems with OpenSSL older than 1.1.1 (e.g. CentOS 7).

Fix: use older urllib3 on those systems:

pip install  --force-reinstall -v "urllib3==1.26.15"

Wrong host name gives misleading error message

When using a wrong hostname, the error message is:

error: Could not infer motley_cue endpoint from command. Please specify motley_cue endpoint via --mc-endpoint.

It would make sense to first check two things and report them first:

• does the hostname resolve to an IP address?
• does the resolved IP address listen on the specified port?

Query server for supported issuers

User should be able to find out supported issuers & authorised groups.

port 443 vs 8080

mccli should first try 443. If that is not available, (e.g. because the server didn't install a certificate yet) it should

• try 8080
• issue a warning that encryption is not working yet
• ask the user to continue
• continue using 8080

mccli: Be more informative

Inform the user in cases such as:

• assurance was not sufficient
• token expired
• ...

And give recommendations on commands to run (expired token => use oidc-agent interface directly, ...)

AT larger than 1024B

check if the incoming AT is longer than 1023 (or 1024?) and issue an error about it

pip upgrade from <=0.2.9 to >=0.3.0 deletes the mccli binary

This is a consequence of renaming mc_ssh to mccli, which was done in 3 steps:

• git repository rename
• new pypi project mccli with version 0.3.0
• new release for mc_ssh on pypi (0.3.0) that makes the project inactive, contains only info on renaming, and pulls new mccli as dependency.

The problem is that both mc_ssh (<0.3.0) and mccli contain the binary mccli. Upgrading mc_ssh to 0.3.0 first:

• installs mccli dependency, then
• removes the old mc_ssh version (0.2.9, inclduing the mccli binary), and then
• installs the new mc_ssh (0.3.0, without the mccli binary)

Certificate verification error when fqdn is not used

Consider configuration in /etc/resolf.conf or /etc/hosts

Update local account on every login

Call feudal deploy on every login instead of just get_status -> even if user already exists, user groups might need to be updated