[OSDOCS-12792]More Secure Auth Flows in ROSA CLIs by mletalie · Pull Request #90006 · openshift/openshift-docs

mletalie · 2025-03-10T21:26:49Z

Version(s):

4.18+
Issue:

https://issues.redhat.com/browse/OSDOCS-12792
Link to docs preview:

OSD Docs: https://90006--ocpdocs-pr.netlify.app/openshift-dedicated/latest/osd_planning/gcp-ccs.html#ccs-gcp-customer-procedure-wif_gcp-ccs
https://90006--ocpdocs-pr.netlify.app/openshift-rosa/latest/cli_reference/rosa_cli/rosa-get-started-cli.html#rosa-login_rosa-getting-started-cli
QE review:

QE has approved this change.

Additional information:

ocpdocs-previewbot · 2025-03-10T22:09:22Z

🤖 Fri Mar 21 19:55:54 - Prow CI generated the docs preview:

https://90006--ocpdocs-pr.netlify.app/openshift-dedicated/latest/osd_planning/gcp-ccs.html
https://90006--ocpdocs-pr.netlify.app/openshift-rosa-hcp/latest/cli_reference/rosa_cli/rosa-get-started-cli.html
https://90006--ocpdocs-pr.netlify.app/openshift-rosa/latest/cli_reference/rosa_cli/rosa-get-started-cli.html

ocpdocs-vale-bot · 2025-03-13T17:12:32Z


 [id="rosa-login_{context}"]
 == login
+There are several methods you can use to log into your Red{nbsp}Hat account using the {product-title} (ROSA) CLI (`rosa`).These methods are described in detail below.


🤖 [error] RedHat.TermsErrors: Use 'log in to' rather than 'log into'. For more information, see RedHat.TermsErrors.

ocpdocs-vale-bot · 2025-03-13T17:12:33Z

+=== login with single sign-on (SSO) authorization code
+If your system supports a web-based browser, you can log in to the ROSA CLI (`rosa`) with a Red{nbsp}Hat single sign-on (SSO) authorization code.
+
+. To log into the ROSA CLI (`rosa`) with a Red{nbsp}Hat single sign-on authorization code, run the following command:


🤖 [error] RedHat.TermsErrors: Use 'log in to' rather than 'log into'. For more information, see RedHat.TermsErrors.

ocpdocs-vale-bot · 2025-03-19T19:45:26Z

+[id="rosa-login-token_{context}"]
+=== login with an offline token
+
+Log in to your Red{nbsp}Hat account, saving the credentials to the `rosa` configuration file. To use offline tokens for automation or other purposes, you can download the OpenShift Cluster Manager API token from the link:https://console.redhat.com/openshift/token/rosa[OpenShift Cluster Manager API Token] page.


🤖 [error] OpenShiftAsciiDoc.SuggestAttribute: Use the AsciiDoc attribute '{cluster-manager}' rather than the plain text product term 'OpenShift Cluster Manager', unless your use case is an exception.

ocpdocs-vale-bot · 2025-03-19T19:45:27Z

+[id="rosa-login-token_{context}"]
+=== login with an offline token
+
+Log in to your Red{nbsp}Hat account, saving the credentials to the `rosa` configuration file. To use offline tokens for automation or other purposes, you can download the OpenShift Cluster Manager API token from the link:https://console.redhat.com/openshift/token/rosa[OpenShift Cluster Manager API Token] page.


🤖 [error] OpenShiftAsciiDoc.SuggestAttribute: Use the AsciiDoc attribute '{cluster-manager}' rather than the plain text product term 'OpenShift Cluster Manager', unless your use case is an exception.

mletalie · 2025-03-19T20:32:56Z

@yuwang-RH
Could please get a QE review for this PR? Thanks!

ocpdocs-vale-bot · 2025-03-19T21:09:20Z

+
+Log in to your Red{nbsp}Hat account, saving the credentials to the `rosa` configuration file.
+
+To use offline tokens for automation purposes, you can download the OpenShift Cluster Manager API token from the link:https://console.redhat.com/openshift/token/rosa[OpenShift Cluster Manager API Token] page.


🤖 [error] OpenShiftAsciiDoc.SuggestAttribute: Use the AsciiDoc attribute '{cluster-manager}' rather than the plain text product term 'OpenShift Cluster Manager', unless your use case is an exception.

ocpdocs-vale-bot · 2025-03-19T21:09:21Z

+
+Log in to your Red{nbsp}Hat account, saving the credentials to the `rosa` configuration file.
+
+To use offline tokens for automation purposes, you can download the OpenShift Cluster Manager API token from the link:https://console.redhat.com/openshift/token/rosa[OpenShift Cluster Manager API Token] page.


🤖 [error] OpenShiftAsciiDoc.SuggestAttribute: Use the AsciiDoc attribute '{cluster-manager}' rather than the plain text product term 'OpenShift Cluster Manager', unless your use case is an exception.

yuwang-RH · 2025-03-20T08:14:11Z

/lgtm

AedinC · 2025-03-20T10:03:06Z

/label peer-review-in-progress

AedinC

/remove-label peer-review-in-progress
/label peer-review-done

AedinC · 2025-03-20T10:06:39Z

+$ ocm login --use-auth-code
+----
+
+Running this command will redirect you to the Red Hat SSO login.


Wonder if it's of any benefit to add something like ' Log in with your Red{nbsp}Hat login or email' or is that overkill?

AedinC · 2025-03-20T10:08:20Z

+----
+$ ocm login --use-device-code
+----
+Running this command will redirect you to the Red Hat SSO login and provide a log in code.


Suggested change

Running this command will redirect you to the Red Hat SSO login and provide a log in code.

Running this command will redirect you to the Red{nbsp}Hat SSO login and provide a log in code.

AedinC · 2025-03-20T10:09:23Z

+
+
+
+To switch accounts, logout from https://sso.redhat.com and run the `ocm logout` command before attempting to login again.


Suggested change

To switch accounts, logout from https://sso.redhat.com and run the `ocm logout` command before attempting to login again.

To switch accounts, logout from https://sso.redhat.com and run the `ocm logout` command in your terminal before attempting to login again.

AedinC · 2025-03-20T10:12:36Z


 [id="rosa-login_{context}"]
 == login
+There are several methods you can use to log into your Red{nbsp}Hat account using the {product-title} (ROSA) CLI (`rosa`).These methods are described in detail below.


Suggested change

There are several methods you can use to log into your Red{nbsp}Hat account using the {product-title} (ROSA) CLI (`rosa`).These methods are described in detail below.

There are several methods you can use to log into your Red{nbsp}Hat account using the {product-title} (ROSA) CLI (`rosa`). These methods are described in detail below.

AedinC · 2025-03-20T10:13:20Z

-Log in to your Red{nbsp}Hat account, saving the credentials to the `rosa` configuration file. You must provide a token when logging in. You can copy your token from link:https://console.redhat.com/openshift/token/rosa[the ROSA token page].
+[IMPORTANT]
+====
+An offline authentication token is long-lived, stored on your operating system, and cannot be revoked. These factors increase overall security risks and the likelihood of unauthorized access to your account. Alternatively, the Red{nbsp}Hat secure browser-based single sign-on (SSO) method automatically sends your CLI instance a refresh token that is valid for 10 hours. Because this authorization code is unique and temporary, it is more secure and the Red{nbsp}Hat recommended method of authentication.


Suggested change

An offline authentication token is long-lived, stored on your operating system, and cannot be revoked. These factors increase overall security risks and the likelihood of unauthorized access to your account. Alternatively, the Red{nbsp}Hat secure browser-based single sign-on (SSO) method automatically sends your CLI instance a refresh token that is valid for 10 hours. Because this authorization code is unique and temporary, it is more secure and the Red{nbsp}Hat recommended method of authentication.

An offline authentication token is long-lived, stored on your operating system, and cannot be revoked. These factors increase overall security risks and the likelihood of unauthorized access to your account. Alternatively, the Red{nbsp}Hat secure browser-based single sign-on (SSO) method automatically sends your CLI instance a refresh token that is valid for 10 hours. Because this authorization code is unique and temporary, it is more secure and is the Red{nbsp}Hat recommended method of authentication.

AedinC · 2025-03-20T10:15:33Z

+$ rosa login --use-auth-code
+----
+
+Running this command will redirect you to the Red{nbsp}Hat SSO login.


Maybe a line similar to the one above about logging in with Red Hat login and email?

AedinC · 2025-03-20T10:17:42Z

+
+|===
+
+To switch accounts, logout from link:https://sso.redhat.com[https://sso.redhat.com] and run the command `$ rosa logout` before attempting to login again.


Suggested change

To switch accounts, logout from link:https://sso.redhat.com[https://sso.redhat.com] and run the command `$ rosa logout` before attempting to login again.

To switch accounts, logout from link:https://sso.redhat.com[https://sso.redhat.com] and run the `rosa logout` command in your terminal before attempting to login again.

AedinC · 2025-03-20T10:18:15Z

+
+|===
+
+To switch accounts, logout from link:https://sso.redhat.com[https://sso.redhat.com] and run `rosa logout` before attempting to login again.


Suggested change

To switch accounts, logout from link:https://sso.redhat.com[https://sso.redhat.com] and run `rosa logout` before attempting to login again.

To switch accounts, logout from link:https://sso.redhat.com[https://sso.redhat.com] and run the `rosa logout` command in your terminal before attempting to login again.

AedinC · 2025-03-20T10:39:39Z

+Red{nbsp}Hat recommends using service accounts for automation purposes.
+====

 The ROSA CLI (`rosa`) looks for a token in the following priority order:


This is out of scope but I have read this sentence and the 4 directly after it many times and I am still unsure what exactly is being said and how useful it is for the user to know this info.

Also out of scope, but could you edit the final login option so it matches the rest of the methods .' To log in to ROSA CLI (rosa) with a Red{nbsp}Hat offline token, run the following command:'

To make point #2 work going to remove the info proceeding as not needed.

AedinC · 2025-03-20T10:44:18Z

Hey @mletalie great job. Just a few nit picks and suggestions.

ocpdocs-vale-bot · 2025-03-20T16:56:04Z


 [id="rosa-login_{context}"]
 == login
+There are several methods you can use to log into your Red{nbsp}Hat account using the {product-title} (ROSA) CLI (`rosa`). These methods are described in detail below.


🤖 [error] RedHat.TermsErrors: Use 'log in to' rather than 'log into'. For more information, see RedHat.TermsErrors.

yuwang-RH · 2025-03-21T01:24:11Z

/lgtm

openshift-ci · 2025-03-21T19:35:27Z

New changes are detected. LGTM label has been removed.

openshift-ci · 2025-03-21T19:56:44Z

@mletalie: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

mletalie · 2025-03-25T20:12:19Z

PM signed off: https://redhat-internal.slack.com/archives/D0741AL3JUQ/p1742932956520089

bmcelvee · 2025-03-25T22:04:09Z

/cherrypick enterprise-4.18

openshift-cherrypick-robot · 2025-03-25T22:05:00Z

@bmcelvee: new pull request created: #91092

Details

In response to this:

/cherrypick enterprise-4.18

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

bmcelvee · 2025-03-25T22:07:16Z

/cherrypick enterprise-4.19

openshift-cherrypick-robot · 2025-03-25T22:08:04Z

@bmcelvee: new pull request created: #91093

Details

In response to this:

/cherrypick enterprise-4.19

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci Bot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Mar 10, 2025

mletalie force-pushed the OSDOCS-12792 branch from 8209053 to 9f605b7 Compare March 10, 2025 21:27

mletalie changed the title ~~Osdocs 12792~~ [OSDOCS-12792]More Secure Auth Flows in ROSA CLIs Mar 10, 2025

mletalie force-pushed the OSDOCS-12792 branch from 9f605b7 to 1da94df Compare March 11, 2025 12:34

mletalie closed this Mar 11, 2025

mletalie reopened this Mar 11, 2025

mletalie force-pushed the OSDOCS-12792 branch from 1da94df to 1687b89 Compare March 13, 2025 17:02

openshift-ci Bot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Mar 13, 2025

ocpdocs-vale-bot reviewed Mar 13, 2025

View reviewed changes

mletalie force-pushed the OSDOCS-12792 branch 2 times, most recently from c15b7c9 to 39681d5 Compare March 17, 2025 21:13

openshift-ci Bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Mar 17, 2025

mletalie force-pushed the OSDOCS-12792 branch 5 times, most recently from a94ead7 to e00887d Compare March 19, 2025 18:42

ocpdocs-vale-bot reviewed Mar 19, 2025

View reviewed changes

mletalie force-pushed the OSDOCS-12792 branch from da911bd to 852eb2a Compare March 19, 2025 20:22

ocpdocs-vale-bot reviewed Mar 19, 2025

View reviewed changes

openshift-ci Bot assigned yuwang-RH Mar 20, 2025

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Mar 20, 2025

openshift-ci Bot added the peer-review-in-progress Signifies that the peer review team is reviewing this PR label Mar 20, 2025

AedinC reviewed Mar 20, 2025

View reviewed changes

openshift-ci Bot added peer-review-done Signifies that the peer review team has reviewed this PR and removed peer-review-in-progress Signifies that the peer review team is reviewing this PR labels Mar 20, 2025

mletalie force-pushed the OSDOCS-12792 branch from b6ed63d to 9398199 Compare March 20, 2025 16:29

openshift-ci Bot removed the lgtm Indicates that a PR is ready to be merged. label Mar 20, 2025

mletalie force-pushed the OSDOCS-12792 branch from 9398199 to c4bec33 Compare March 20, 2025 16:44

ocpdocs-vale-bot reviewed Mar 20, 2025

View reviewed changes

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Mar 21, 2025

mletalie force-pushed the OSDOCS-12792 branch from c4bec33 to 4a5a89c Compare March 21, 2025 19:35

openshift-ci Bot removed the lgtm Indicates that a PR is ready to be merged. label Mar 21, 2025

auth code

6207d22

mletalie force-pushed the OSDOCS-12792 branch from c49cd48 to 6207d22 Compare March 21, 2025 19:47

bmcelvee added branch/enterprise-4.18 branch/enterprise-4.19 labels Mar 25, 2025

bmcelvee merged commit 7a50009 into openshift:main Mar 25, 2025

openshift-cherrypick-robot mentioned this pull request Mar 25, 2025

[enterprise-4.18] [OSDOCS-12792]More Secure Auth Flows in ROSA CLIs #91092

Merged

openshift-cherrypick-robot mentioned this pull request Mar 25, 2025

[enterprise-4.19] [OSDOCS-12792]More Secure Auth Flows in ROSA CLIs #91093

Merged


		Log in to your Red{nbsp}Hat account, saving the credentials to the `rosa` configuration file.

		To use offline tokens for automation purposes, you can download the OpenShift Cluster Manager API token from the link:https://console.redhat.com/openshift/token/rosa[OpenShift Cluster Manager API Token] page.

	Running this command will redirect you to the Red Hat SSO login and provide a log in code.
	Running this command will redirect you to the Red{nbsp}Hat SSO login and provide a log in code.


		+

		To switch accounts, logout from https://sso.redhat.com and run the `ocm logout` command before attempting to login again.

	There are several methods you can use to log into your Red{nbsp}Hat account using the {product-title} (ROSA) CLI (`rosa`).These methods are described in detail below.
	There are several methods you can use to log into your Red{nbsp}Hat account using the {product-title} (ROSA) CLI (`rosa`). These methods are described in detail below.

	To switch accounts, logout from link:https://sso.redhat.com[https://sso.redhat.com] and run the command `$ rosa logout` before attempting to login again.
	To switch accounts, logout from link:https://sso.redhat.com[https://sso.redhat.com] and run the `rosa logout` command in your terminal before attempting to login again.

Conversation

mletalie commented Mar 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ocpdocs-previewbot commented Mar 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mletalie commented Mar 19, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yuwang-RH commented Mar 20, 2025

Uh oh!

AedinC commented Mar 20, 2025

Uh oh!

AedinC left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AedinC commented Mar 20, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yuwang-RH commented Mar 21, 2025

Uh oh!

openshift-ci Bot commented Mar 21, 2025

Uh oh!

openshift-ci Bot commented Mar 21, 2025

Uh oh!

mletalie commented Mar 25, 2025

Uh oh!

bmcelvee commented Mar 25, 2025

Uh oh!

openshift-cherrypick-robot commented Mar 25, 2025

Uh oh!

bmcelvee commented Mar 25, 2025

Uh oh!

openshift-cherrypick-robot commented Mar 25, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

mletalie commented Mar 10, 2025 •

edited

Loading

ocpdocs-previewbot commented Mar 10, 2025 •

edited

Loading