39 lines
1.4 KiB
Bash
39 lines
1.4 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
# Interactive diagnosis of the contained platform-admin OIDC login.
|
||
|
|
# Shows bao's own messages (Warden swallows them). Stores the token only in a
|
||
|
|
# throwaway helper, revokes it, and prints metadata — never the token.
|
||
|
|
set -euo pipefail
|
||
|
|
export BAO_ADDR="${BAO_ADDR:-http://127.0.0.1:18200}"
|
||
|
|
export VAULT_ADDR="${VAULT_ADDR:-$BAO_ADDR}"
|
||
|
|
mkdir -p "${HOME}/.warden-attended-login"
|
||
|
|
chmod 700 "${HOME}/.warden-attended-login"
|
||
|
|
ROOT="$(mktemp -d "${HOME}/.warden-attended-login/diag-XXXXXX")"
|
||
|
|
chmod 700 "$ROOT"
|
||
|
|
helper="$ROOT/.vault-token"
|
||
|
|
cleanup() {
|
||
|
|
if [[ -s "$helper" ]]; then
|
||
|
|
HOME="$ROOT" bao token revoke -self >/dev/null 2>&1 || true
|
||
|
|
fi
|
||
|
|
rm -rf "$ROOT"
|
||
|
|
}
|
||
|
|
trap cleanup EXIT
|
||
|
|
touch "$helper"
|
||
|
|
chmod 600 "$helper"
|
||
|
|
echo "BAO_ADDR=$BAO_ADDR"
|
||
|
|
echo "NTPSynchronized=$(timedatectl show -p NTPSynchronized --value 2>/dev/null || echo unknown)"
|
||
|
|
echo "isolated_home=$ROOT"
|
||
|
|
echo "starting bao login -no-print -method=oidc -path=netkingdom role=platform-admin"
|
||
|
|
echo "(complete the browser flow; this process must stay running for the callback)"
|
||
|
|
set +e
|
||
|
|
HOME="$ROOT" bao login -no-print -method=oidc -path=netkingdom role=platform-admin
|
||
|
|
rc=$?
|
||
|
|
set -e
|
||
|
|
mode=$(stat -c '%a' "$helper" 2>/dev/null || echo missing)
|
||
|
|
size=$(stat -c '%s' "$helper" 2>/dev/null || echo 0)
|
||
|
|
echo "login_exit=$rc helper_mode=$mode helper_bytes=$size"
|
||
|
|
if [[ "$rc" -eq 0 && "$size" -gt 0 ]]; then
|
||
|
|
echo "login_ok_helper_populated"
|
||
|
|
else
|
||
|
|
echo "login_failed_or_helper_empty"
|
||
|
|
fi
|