Option for password grant flow instead of authorization code flow

[heikoettelbruecksap]

KIND: Feature request

Currently kubelogin only supports the authorization code flow to retrieve ID tokens. This is helpful for interactive usage of human users where we can expect a web browser and typically an existing session with the OAuth server already (=> SSO). However, for automated scenarios where no browser is available, it would be helpful to be able to use the password grant flow instead.

I see the oauth2 library for go already supports the password grant flow (unfortunately with an compatibility to certain OAuth servers, but I hope this will be fixed - see golang/oauth2#320). That means, I assume it should be rather easy to add a command-line option to request the password grant flow as well as command-line parameters for user name and password.

Would this feature be generally appreciated? (before looking for the actual implementation)

[int128]

Sounds good.
That is Resource Owner Password Credentials Grant in OpenID Connect.
It is valuable that kubelogin supports password authentication as like oc login of OpenShift or cf login of CloudFoundry.

[heikoettelbruecksap]

Yes, exactly. The respective go function to perform this flow is https://godoc.org/golang.org/x/oauth2#Config.PasswordCredentialsToken (but keep in mind the issue in the library mentioned earlier).
Would you prefer to implement this option yourself or should we propose a concrete change? (Due to internal processes, this might take some time until approved.)

[int128]

Would you propose a pull request for this feature?
For now I don't have environment for testing OIDC flow. (I just destroyed my cluster and Keycloak last month...)

[Baykonur]

Hello @heikoettelbruecksap, any news on this?

[heikoettelbruecksap]

Sorry, I didn't follow up on that, since my company's approach has changed in the meanwhile, and we no longer need this feature. Feel free to leave this issue open or close it.

[Baykonur]

Thanks for the feedback.

[int128]

This feature is supported in v1.12.0.