Retrieve Access Tokens

To use ARTESCA data management endpoints, you need to retrieve access tokens to get authorization. For authorization purposes, ARTESCA uses OpenID Connect (OIDC) protocol to authenticate users.

Follow this procedure to retrieve access tokens.

Prerequisites

• kubectl, jq, and curl are installed.

• The user has logged in to the management UI at least once and set a permanent password. Newly provisioned users have a temporary password and cannot retrieve tokens programmatically until it is changed via the UI.

Procedure

Note

In the following procedure, https://ui.<base-domain-name> is the URL for making the request to the OIDC service. By default, the OIDC realm is artesca and the client-ID is zenko-ui.

In the following commands, replace <username> and <password> with the user credentials provisioned for the OIDC service.

1. Declare variables.

   Note

   The MFA_CODE variable is only required when multi-factor authentication (MFA) is enabled for the user.

   [artesca-os@bootstrap ~]$
   

   OIDC_REALM='artesca'
   OIDC_CLIENT_ID='zenko-ui'
   OIDC_USER='<username>'
   OIDC_USER_PASSWORD='<password>'
   MFA_CODE='<mfa-code>'
   

2. Retrieve the URL for the management UI.

   [artesca-os@bootstrap ~]$
   

   URL=$(sudo salt-call metalk8s_network.get_control_plane_ingress_endpoint --out=json | jq -cr '.local')
   

3. Retrieve TOKEN.

   Note

   If you have changed the default domain of your ARTESCA-installation, you must reflect that change in the following command.

   1. Retrieve the access token.

      [artesca-os@bootstrap ~]$
      

      TOKEN=$(
         curl -s -k "${URL}/auth/realms/${OIDC_REALM}/protocol/openid-connect/token" \
                 -d "client_id=${OIDC_CLIENT_ID}" \
                 -d "username=${OIDC_USER}" \
                 -d "password=${OIDC_USER_PASSWORD}" \
                 -d "otp=${MFA_CODE}" \
                 -d "scope=openid" \
                 -d "grant_type=password" | \
                 jq -cr '.access_token'
      )
      

   2. Confirm the token is retrieved.

      [artesca-os@bootstrap ~]$
      

      echo $TOKEN
      

4. Retrieve INSTANCE_ID.

   [artesca-os@bootstrap ~]$
   

   INSTANCE_ID=$(
    sudo kubectl --kubeconfig=/etc/kubernetes/admin.conf \
    get -n zenko zenko artesca-data -o jsonpath='{.status.instanceID}')