oidc-token - gets OIDC access token from oidc-agent
oidc-token [OPTION...] ACCOUNT_SHORTNAME |
ISSUER_URL
oidc-token -- A client for oidc-agent for getting OIDC
access tokens.
- General:
- -a, --all
- Return all available information (token, issuer, expiration time). Each
value is printed in one line.
- -c, --env
- This will get all available information (same as -a), but will
print shell commands that export environment variables (default names).
The result for this option is the same as for using 'oidc-token
-oie'. With the -o -i and -e options the name
of each environment variable can be changed.
- -e,
--expires-at[=OIDC_EXP]
- Return the expiration time for the requested access token. If neither
-i nor -o is set and OIDC_EXP is not passed, the expiration
time is printed to stdout. Otherwise shell commands are printed that will
export the value into an environment variable. The name of this variable
can be set with OIDC_EXP.
- -f,
--force-new
- Forces that a new access token is issued and returned.
- -i,
--issuer[=OIDC_ISS]
- Return the issuer associated with the requested access token. If neither
-e nor -o is set and OIDC_ISS is not passed, the issuer is
printed to stdout. Otherwise shell commands are printed that will export
the value into an environment variable. The name of this variable can be
set with OIDC_ISS.
- -o,
--token[=OIDC_AT]
- Return the requested access token. If neither -i nor -e is
set and OIDC_AT is not passed, the token is printed to stdout (Same
behaviour as without this option). Otherwise shell commands are printed
that will export the value into an environment variable. The name of this
variable can be set with OIDC_AT.
- -t,
--time=SECONDS
- Minimum number of seconds the access token should be valid
- Advanced:
- --aud=AUDIENCE
- Audience for the requested access token. Multiple audiences can be
provided as a space separated list
- --id-token
- Returns an id-token instead of an access token. This option is meant as a
development tool. ID-tokens should not be passed as authorization to
resources.
- --name=NAME
- This option is intended for other applications / scripts that call
oidc-token to obtain an access token. NAME is the name of this application
and might be displayed to the user.
- --seccomp
- Enables seccomp system call filtering; allowing only predefined system
calls.
- -s,
--scope=SCOPE
- Scope to be requested for the requested access token. Multiple scopes can
be provided as a space separated list or by using the option multiple
times.
- Help:
- -?, --help
- Give this help list
- --usage
- Give a short usage message
- -V, --version
- Print program version
Mandatory or optional arguments to long options are also mandatory
or optional for any corresponding short options.
oidc-token does not read or write any files.
oidc-token example
Gets an access token for the 'example' account
configuration.
oidc-token example -t 60
Gets an access token for the 'example' account
configuration which will be valid for at least 60 seconds.
oidc-token example -i
Gets the issuer url associated to the requested access
token.
oidc-token example -a
Gets an access token, the associated issuer url, and the
expiration date of the token. One information per line.
eval `oidc-token example -c`
Sets environment variables with the access token, the
associated issuer url, and the expiration date of the token.
oidc-token example --scope=openid --scope=profile
Gets an access token for the 'example' account
configuration which will be only valid for the 'openid' and 'profile'
scope.
Report bugs to
<https://github.com/indigo-dc/oidc-agent/issues>
Subscribe to our mailing list to receive important updates about oidc-agent:
<https://www.lists.kit.edu/sympa/subscribe/oidc-agent-user>.
oidc-agent(1), oidc-add(1), oidc-gen(1)
Low-traffic mailing list with updates such as critical security
incidents and new releases:
https://www.lists.kit.edu/sympa/subscribe/oidc-agent-user
Full documentation can be found at
https://indigo-dc.gitbooks.io/oidc-agent/user/oidc-token