Fix --showbearerurl in combination with --nobearertoken

htgettoken.1

@@ -234,7 +234,9 @@ need the rest of the
 functionality.
 .TP
 .B \-\-nobearertoken
-Skip getting a bearer token; only get a vault token.
+Skip getting a bearer token.  Always gets a vault token except in
+combination with 
+.BR \-\-showbearerurl .
 .TP
 .BR \-o\ path , \ \-\-out=path
 The path of the file used to store the bearer token on the local

htgettoken.spec

@@ -74,6 +74,9 @@ rm -rf $RPM_BUILD_ROOT
 
 
 %changelog
+# - Again fix --showbearerurl to work in combination with --nobearertoken.
+#   That was fixed in 1.17 but broken in 1.21 and 2.0.
+
 * Fri Jun 20 2025 Dave Dykstra <[email protected]> 2.4-1
 - Add the new -s and -f options to the htdecodetoken usage summary.
 - Add a -v option to htdecodetoken to show the token source.

htgettoken/__init__.py

@@ -816,7 +816,7 @@ def main(args=None):
                     response = {'auth' : {'client_token': vaulttoken}}
                     vaulttoken = getVaultToken(vaulttokensecs, response)
                     writeTokenSafely("vault", vaulttoken, vaulttokenfile)
-                elif options.nobearertoken:
+                elif options.nobearertoken and not options.showbearerurl:
                     # force getting a new vault token
                     tryget = False
                 elif vaulttokenminsecs > 0:

tests/013-showbearerurl/main

@@ -1,4 +1,4 @@
-URL="$(htgettoken --nooidc -a $VAULTSERVER -i $ISSUER --showbearerurl --nobearertoken)"
+URL="$(htgettoken --nooidc --nokerberos --nossh -a $VAULTSERVER -i $ISSUER --showbearerurl --nobearertoken)"
 
 if [ -z "$URL" ]; then
     echo "Nothing came from stdout!"