add secure cross-platform OIDC login - #3
Merged
Merged
Conversation
- add Entra ID authorization-code login with PKCE and loopback callback - add interactive device-code login for headless environments - exchange Entra ID tokens for scoped OTC Keystone tokens - support default and explicitly selected browsers for OIDC - add macOS, Linux, and Windows browser backends - preserve legacy SAML login for clouds without OIDC configuration - restrict Safari credential extraction to trusted OTC HTTPS origins - prevent credential probes from running in unrelated Safari tabs - validate callback state, login arguments, and temporary credentials - make callback listener cleanup non-fatal after receiving an auth code - force-close the callback listener when graceful shutdown times out - add HTTP timeouts, response limits, and redirect protection - require secure HTTPS authentication URLs for OIDC - avoid reporting OTC success before token exchange completes - add debug diagnostics without exposing token values - secure browser profiles with mode 0700 - enforce mode 0600 whenever clouds.yaml is updated - write clouds.yaml atomically to prevent truncated configuration - preserve symbolic links when updating clouds.yaml - reject unknown cloud names and unsupported output formats - validate output format before configuration and API calls - restore -f/--format as a persistent global flag - document OIDC, SAML limitations, token storage, and file permissions - document cross-platform builds and authentication behavior - align GitHub Actions with the Go version declared in go.mod - add authentication, configuration, format, and platform tests Verified with go test, race detection, go vet, cross-compiled tests, and macOS, Linux, and Windows builds for amd64 and arm64.
Use USERPROFILE when isolating the Windows home directory, keep the 0600 assertion on Unix where POSIX modes are meaningful, and document Windows ACL behavior.
starek4
approved these changes
Aug 17, 2026
added 3 commits
September 1, 2026 09:42
- removed unused method after merge
- ability to call cli using env variables
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Verified with go test, race detection, go vet, cross-compiled tests, and macOS, Linux, and Windows builds for amd64 and arm64.