|
| 1 | +# Authentication Guide |
| 2 | + |
| 3 | +This document describes how you can configure authentication for the STACKIT CLI. |
| 4 | + |
| 5 | +## Service account |
| 6 | + |
| 7 | +You can use a [service account](https://docs.stackit.cloud/stackit/en/service-accounts-134415819.html) to authenticate to the STACKIT CLI. |
| 8 | +The CLI will search for service account credentials similarly to the [STACKIT SDK](https://github.com/stackitcloud/stackit-sdk-go) and [Terraform Provider](https://github.com/stackitcloud/terraform-provider-stackit), so if you have setup you environment previously for those tools, you can just run: |
| 9 | + |
| 10 | +```bash |
| 11 | +$ ./bin/stackit auth activate-service-account |
| 12 | +``` |
| 13 | + |
| 14 | +You can also configure the service account credentials directly in the CLI. To get help and to get a list of the available options run the command with the `-h` flag. |
| 15 | + |
| 16 | +### Overview |
| 17 | + |
| 18 | +If you dont have a service account, create one in the STACKIT Portal an assign it the necessary permissions, e.g. `project.owner`. There are two ways to authenticate: |
| 19 | + |
| 20 | +- Key flow (recommended) |
| 21 | +- Token flow |
| 22 | + |
| 23 | +When setting up authentication, the CLI will always try to use the key flow first and search for credentials in several locations, following a specific order: |
| 24 | + |
| 25 | +1. Explicitly provided credentials, e.g. by using the flag `--service-account-key-path` |
| 26 | +2. Environment variable, e.g. by setting `STACKIT_SERVICE_ACCOUNT_KEY_PATH` |
| 27 | +3. Credentials file |
| 28 | + |
| 29 | + The CLI will check the credentials file located in the path defined by the `STACKIT_CREDENTIALS_PATH` env var, if specified, |
| 30 | + or in `$HOME/.stackit/credentials.json` as a fallback. |
| 31 | + The credentials file should be a JSON and each credential should be set using the name of the respective environment variable, as stated below in each flow. Example: |
| 32 | + |
| 33 | + ```json |
| 34 | + { |
| 35 | + "STACKIT_SERVICE_ACCOUNT_TOKEN": "foo_token", |
| 36 | + "STACKIT_SERVICE_ACCOUNT_KEY_PATH": "path/to/sa_key.json" |
| 37 | + } |
| 38 | + ``` |
| 39 | + |
| 40 | +### Key flow |
| 41 | + |
| 42 | + The following instructions assume that you have created a service account and assigned it the necessary permissions, e.g. `project.owner`. |
| 43 | + |
| 44 | +To use the key flow, you need to have a service account key, which must have an RSA key-pair attached to it. |
| 45 | + |
| 46 | +When creating the service account key, a new RSA key-pair can be created automatically, which will be included in the service account key. This will make it much easier to configure the key flow authentication in the CLI, by just providing the service account key. |
| 47 | + |
| 48 | +**Optionally**, you can provide your own private key when creating the service account key, which will then require you to also provide it explicitly to the CLI, additionaly to the service account key. Check the STACKIT Knowledge Base for an [example of how to create your own key-pair](https://docs.stackit.cloud/stackit/en/usage-of-the-service-account-keys-in-stackit-175112464.html#UsageoftheserviceaccountkeysinSTACKIT-CreatinganRSAkey-pair). |
| 49 | + |
| 50 | +To configure the key flow, follow this steps: |
| 51 | + |
| 52 | +1. Create a service account key: |
| 53 | + |
| 54 | +- In the CLI, run `stackit service-account key create --email <SERVICE_ACCOUNT_EMAIL>` |
| 55 | +- As an alternative, use the STACKIT Portal: go to the `Service Accounts` tab, choose a `Service Account` and go to `Service Account Keys` to create a key. For more details, see [Create a service account key](https://docs.stackit.cloud/stackit/en/create-a-service-account-key-175112456.html) |
| 56 | + |
| 57 | +2. Save the content of the service account key by copying it and saving it in a JSON file. |
| 58 | + |
| 59 | +The expected format of the service account key is a **json** with the following structure: |
| 60 | + |
| 61 | +```json |
| 62 | +{ |
| 63 | + "id": "uuid", |
| 64 | + "publicKey": "public key", |
| 65 | + "createdAt": "2023-08-24T14:15:22Z", |
| 66 | + "validUntil": "2023-08-24T14:15:22Z", |
| 67 | + "keyType": "USER_MANAGED", |
| 68 | + "keyOrigin": "USER_PROVIDED", |
| 69 | + "keyAlgorithm": "RSA_2048", |
| 70 | + "active": true, |
| 71 | + "credentials": { |
| 72 | + "kid": "string", |
| 73 | + |
| 74 | + "sub": "uuid", |
| 75 | + "aud": "string", |
| 76 | + (optional) "privateKey": "private key when generated by the SA service" |
| 77 | + } |
| 78 | +} |
| 79 | +``` |
| 80 | + |
| 81 | +3. Configure the service account key for authentication in the CLI by following one of the alternatives below: |
| 82 | + |
| 83 | + - using the flag `--service-account-key-path` |
| 84 | + - setting the environment variable `STACKIT_SERVICE_ACCOUNT_KEY_PATH` |
| 85 | + - setting `STACKIT_SERVICE_ACCOUNT_KEY_PATH` in the credentials file (see above) |
| 86 | + |
| 87 | +> **Optionally, only if you have provided your own RSA key-pair when creating the service account key**, you also need to configure your private key (takes precedence over the one included in the service account key, if present). **The private key must be PEM encoded** and can be provided using one of the options below: |
| 88 | +> |
| 89 | +> - using the flag `--private-key-path` |
| 90 | +> - setting the environment variable `STACKIT_PRIVATE_KEY_PATH` |
| 91 | +> - setting `STACKIT_PRIVATE_KEY_PATH` in the credentials file (see above) |
| 92 | +
|
| 93 | +4. The CLI will search for the keys and, if valid, will use them to get access and refresh tokens which will be used to authenticate all the requests. |
| 94 | + |
| 95 | +### Token flow |
| 96 | + |
| 97 | +Using this flow is less secure since the token is long-lived. You can provide the token in several ways: |
| 98 | + |
| 99 | +1. Providing the flag `--service-account-token` |
| 100 | +2. Setting the environment variable `STACKIT_SERVICE_ACCOUNT_TOKEN` |
| 101 | +3. Setting `STACKIT_SERVICE_ACCOUNT_TOKEN` in the credentials file (see above) |
0 commit comments