Support SSO authentication

[davidgeiger]

User story
As a CLI user, I want to authenticate with API Manager using the configured SSO mechanism.

Additional context
When (SAML-based) SSO is used to log into API Manager, regular users do not have a username and password. In order to use the CLI, everyone needs to create a technical user (~ service account), which is not scalable and potentially insecure, especially if password are stored locally. Ideally, the APIM CLI would support an (interactive?) login with API Manager using the configured SSO mechanism. Similar mechanisms are supported, for instance, by the Amplify Central CLI and the gcloud CLI.

[cwiechmann]

Hi @davidgeiger, this would be a big change, as the authentication would then have to be stored in an external token, which is a completely different concept than how it is done now.

And the CLI currently uses two users. So the default user (Org-Admin) and if specified an admin account (e.g. service account) which performs all the tasks the default user can't do. The admin account is then stored in the pipeline if necessary.

I am not sure how this can be brought together with the SSO concept. Any thoughts?

[gwandwingor]

@cwiechmann Maybe a simpler alternative (or intermediary) way to see this would be to allow decoupling the login part by providing the session cookie in an environment variable.
This way, in the apim-cli code, changes would be limited to using this env variable if present. On the other hand, the SSO login sequence would still have to be implemented somewhere but it would be a different custom development.

Just my 2 cents here

[emmanuel-galindo]

this. pls. but it can tricky, as org IDP might be enforcing browsers..

we can't issue local accounts to users.
another example, similar as above: other systems (openshift) allow you to issue a token from the ui

but something. pls.

[cwiechmann]

I think the CLI must support a command like: apim auth and perhaps supports then different options:
apim auth login --> Login as it works today, using a standard APIM account based on HTTP-Basic
apim auth loginsso --> Would then behave as the AMPLIFY-CLI

Ultimately the generated Session-ID returned by the API-Manager will be stored in a local config file, no matter which authentication option was used.
But Still the CLI will use, if given, an Admin-Account to create the required Admin-Session.

@emmanuel-galindo, can you please elaborate a bit more on this example?
another example, similar as above: other systems (openshift) allow you to issue a token from the ui

[davidgeiger]

Sounds good to me. I believe both of the above examples (Amplify and gcloud CLI) open a browser window for an interactive OAuth auth code flow. I assume a similar approach could be used to open a browser window for authentication with API Manager's SSO endpoint via a SAML flow. The resulting user authentication token would be a generated session cookie instead of an OAuth JWT.

[emmanuel-galindo]

opening a browser to get the token seems a good to me, and if you have already done for amplify-cli maybe it will avaialble soon?

@cwiechmann in ocp webadmin, you have a way to copy to your clipboard a string similar to:
occlient --token XXX login

[emmanuel-galindo]

@cwiechmann any update on this feature? or is there any plan to include some alternative to having to login with a non-sso api admin in the next releases?

[emmanuel-galindo]

@cwiechmann I just got to "2.2 Create a service account using the Amplify Central UI
" from https://docs.axway.com/bundle/axway-open-docs/page/docs/central/cli_central/cli_install/index.html and remembered about this issue, do you think something like that could be enabled for apim-cli? that would be awesome to have

[davidgeiger]

Same here, this would be an important feature to reduce the number of password-based "service accounts". They may still be required for technical clients that cannot obtain a SAML token, but anyone else - in particular the average org admin - should be able to use the CLI with their SSO identity.

@cwiechmann: Have you considered integrating the API Mgr CLI functionality into the Axway CLI given that it already supports interactive authentication? This would also reduce the number of CLIs that a user has to install. ;) Not sure if there is an efficient way to port or emulate the Java-based codebase.

[cwiechmann]

Unfortunately there was no time at all to work in this. As you may guess it's a major undertaking to implement this.
Making the apim-cli part of the axway-cli looks not feasible to me, as the Axway-CLI is based on node.Js vs. Java for the APIM-CLI.

[davidgeiger]

Haven't thought this through, but perhaps it is feasible to create a simple wrapper around the apim-cli in order to turn it into an Axway CLI extension? A command such as "axway apimgr import" would then trigger the apim-cli (JRE) execution. This could also be helpful.

Assuming that the available (interactive) authentication framework could be adjusted to interact with API Manager, it could pass the obtained SAML assertion as a parameter to the apim-cli. Leveraging the package manager for apim-cli installation also seems interesting.

[stale]

This issue has been automatically marked as stale because it has not had activity in the last 90 days. It will be closed in the next 30 days unless it is tagged "help wanted" or other activity occurs. Thank you for your contributions.