Allow "scope" to be set in the token

[lindseyburnett]

We've come across an observatorium instance that needs to have a token including scope in the payload, or else it fails to authenticate.

Verified change by including --scope="openid offline_access --file="token.out" and verifying the "token.out" file contains a jwt. When decoded, the payload data includes:

  "scope": "openid offline_access",

[saswatamcode]

Thanks! Generally LGTM, just one comment!

[saswatamcode]

Probably a good idea to use flag.StringSliceVar here, as there might be multiple scopes to include?

[lindseyburnett]

Multiple scopes are supported by a single "scope" key, and the value being a string with each scope separated by spaces. If you simply change to StringSliceVar and the corresponding data types to []string, it tries to send multiple scope parameters, you get the following error:

level=error name=token-refresher ts=2023-09-18T15:08:05.355519306Z caller=main.go:244 msg="failed to get token" err="oauth2: cannot fetch token: 400 Bad Request\nResponse: {\"error\":\"invalid_request\",\"error_description\":\"duplicated parameter\"}"

My latest change now supports multiple scopes in the following ways:

--scope="openid offline_access"
--scope="openid,offline_access"
--scope="openid" --scope="offline_access"

[squat]

Suggested change

	flag.StringSliceVar(&cfg.scope, "scope", []string{""}, "The scope to be included in the payload data of the token. Scopes can either be comma-separated or space-separated.")
	flag.StringSliceVar(&cfg.scope, "scope", []string{""}, "The scope to be included in the payload data of the token. Scopes can either be comma-separated or space-separated.")

[squat]

@lindseyburnett I don't think that the values to the flag can be space-separated. The shell will interpret the second or third scopes as separate arguments to the program and Go will parse them as additional arguments that are not associated to the flag. Perhaps they can be space-separated if the scopes are wrapped in quotes to indicate that it's one single value. pflag definitely allows for comma-separation and specifying the flag multiple times, e.g. --scope X --scope Y --scope Z

[lindseyburnett]

You're absolutely right. Space-separated will need to be wrapped in quotes. All three of these variations worked for me:

--scope="openid offline_access"
--scope=openid,offline_access
--scope=openid --scope=offline_access

Personally, my first choice would be to use the first variation because it's so similar to how I would manually get a token via the command line.

TOKEN=$(curl --request POST \
    --url https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/token \
    --header 'content-type: application/x-www-form-urlencoded' \
    --data scope='openid offline_access' \
    --data grant_type=client_credentials \
    --data client_id=REDACTED \
    --data client_secret=REDACTED | jq .access_token | tr -d '"')

[saswatamcode]

Yup, as per StringSliceVar goDoc comment all of these are valid. :)

[saswatamcode]

LGTM!