Support auth_code, client_credentials, device_code authentication #143

wesleymccollam · 2025-10-30T16:27:56Z

Change Description

Add support for three OAuth2 authentication flows: authorization_code, client_credentials, and device_code
Implement dual token storage: macOS/Linux keychain (primary) with JSON file fallback (~/.pingcli/credentials/)
Add --use-keychain flag to login and export commands for storage control
Add interactive login flow with automatic token validation and refresh
Retain worker app authentication for backward compatibility
Update authentication documentation with OAuth2 flow examples
Generate AsciiDoc portal documentation for all commands
Enhance Makefile with auth-specific test targets

Change Characteristics

This PR contains beta functionality
This PR requires introduction of breaking changes

Checklist

All full (or complete) PRs that need review prior to merge should have the following box checked.

If contributing a partial or incomplete change (expecting the development team to complete the remaining work) please leave the box unchecked

Check to confirm: I have performed a review of my PR against the PR checklist and confirm that:
- Changes have proper unit and acceptance test coverage (including regression tests)
- Impacted command, parameter and flag descriptions have been reviewed and updated
- Impacted command examples have been reviewed and updated
- Impacted documentation files have been reviewed and updated
- Does not introduce breaking changes to commands, parameters or flags (unless required to do so)
- I am aware that changes to generated code may not be merged

Required SDK Upgrades

https://github.com/pingidentity/pingone-go-client v0.5.1

Testing

This PR has been tested with:

Unit tests (please paste commands and results below)
Acceptance tests (please paste commands and results below)
End-to-end tests (please paste the link to the actions workflow runs)
Not applicable (no evidences needed)

Shell Command(s)

make test-auth

Testing Results

Expand Results

  > Env: Checking PingOne test variables...
echo "✅ Required PingOne test variables are set."
✅ Required PingOne test variables are set.
  > Test: Running auth tests sequentially to avoid shared resource conflicts...
    -> ./internal/auth/...
ok      github.com/pingidentity/pingcli/internal/auth   6.481s
    -> ./cmd/auth/...
ok      github.com/pingidentity/pingcli/cmd/auth        6.062s
✅ All auth tests passed.

End-to-end Tests Workflow Links

N/A

… methods

- Detect cached vs new tokens by comparing AccessToken before/after SDK call in PerformDeviceCodeLogin, PerformAuthCodeLogin, PerformClientCredentialsLogin - Add GetAuthMethodKeyFromConfig() to extract grant type from Configuration instead of reading from config file (fixes incorrect auth method detection) - Fix device_code nil pointer by always calling WithDeviceCodeScopes() - Alphabetize PingOne authentication flags in platform export command - Update test assertions and clean up unused parameters Login commands now correctly show "Already authenticated" for cached tokens and "Successfully logged in" only for new authentication.

- Use Cobra flag validation (MarkFlagsMutuallyExclusive/MarkFlagsOneRequired) - Consolidate duplicate switch statements and applyRegionConfiguration functions - Validate auth methods against SDK grant type enums - Use errors.Join() in ClearToken() - Add error handling in GetAuthMethodKey() - Remove worker type support and unused test helpers - Clean up commented code blocks and fix linting issues All three OAuth2 methods tested and working with proper cache detection.

…authentication Add comprehensive OAuth2 authentication support with three methods: - Authorization code flow (auth_code) - now default when no flag specified - Client credentials flow (client_credentials) - Device code flow (device_code) Changes: - Add auth method flags to login command: --auth-code/-a, --client-credentials/-c, --device-code/-d - Make auth_code the default authentication method (no flag required) - Add auth method flags to logout command for targeted credential clearing - Implement keychain storage per auth method using SDK's GenerateKeychainAccountName - Replace custom token key hashing with SDK's built-in implementation - Add comprehensive integration tests for all three authentication flows - Update unit tests with table-driven approach for better coverage - Simplify token verification in tests (SDK handles keychain storage internally)

…code-authentication

- Token validation: Check cached tokens before re-authenticating (all 3 auth methods) - Dual storage: System keychain (primary) + ~/.pingcli/credentials/ (fallback) - --use-keychain flag (default: true) with PINGCLI_AUTH_USE_KEYCHAIN env var - Per-method token storage using hash-based keys to prevent conflicts - Logout clears both keychain and file storage - Updated messages to reflect "storage" instead of "Keychain" * Update 18 auth tests to handle automatic authentication behavior * Fix platform export tests to use correct static error definitions * Add comprehensive test coverage (auth_services_test.go, workflow tests) * Resolve all linting violations (err113, errorlint, nlreturn, gocritic, staticcheck) * Use newly implemented Errors package Enables: pingcli login --auth_code | --client_credentials | --device_code All 83 tests passing (50 command + 33 auth). UAT verified.

Implements dual storage strategy for OAuth2 tokens to ensure reliability across all environments (SSH, containers, CI/CD, desktop). Token Storage: - Primary: OS credential stores (Keychain/Credential Manager/Secret Service) - Secondary: File storage at ~/.pingcli/credentials/*.json - Tokens saved to BOTH locations on authentication - One file per auth method (device-code-token.json, auth-code-token.json, etc.) New --use-keychain Flag: - Controls token retrieval preference (default: true with fallback) - Added to: auth login, platform export, request commands - --use-keychain=true: Keychain only (fails if unavailable) - Default behavior: Try keychain first, fallback to file automatically Commands Updated: - platform export: Added --use-keychain and PingOne auth flags - request: Added --use-keychain and PingOne auth flags Testing: - New test-auth Makefile target for sequential auth test execution - Prevents parallel test resource conflicts - Refactored list_keys_test.go to table-driven pattern Documentation: - Updated README.md with improved installation instructions - Added comprehensive dual storage documentation - Updated auth docs (login.md, logout.md) with storage behavior - Removed redundant overview.md Code Cleanup: - Removed deprecated legacy worker token caching - Removed unused generateLegacyWorkerTokenKey function - Removed unused crypto/sha256 import - Removed local go.mod replacement line

Makefile

cmd/auth/login.go

internal/commands/platform/export_internal.go

internal/configuration/services/pingone.go

internal/customtypes/auth_services.go

henryrecker-pingidentity · 2025-10-30T21:06:05Z

internal/profiles/validate.go

 		case options.PINGONE_REGION_CODE:
 			switch typedValue := vValue.(type) {
-			case *customtypes.PingOneRegionCode:
+			case *customtypes.String:


Why is this changed?

this has been reverted

- refactor redirectURI to include path and port for auth_code flow, update tests - revert auth-specific parallel tests, run all tests in parallel - replace --use-keychain flag with --file-storage flag, which disables keychain usage - remove unused ClearPingOneClientCache method - correct login_interactive file name

* add storage location type * update file storage flag

* move login and logout logic to internal package * add debug message for failed keychain * remove unneeded auth services * fix issue where file storage did not occur along with keychain saving in default behavior

Makefile

internal/commands/auth/credentials.go

internal/commands/auth/login_interactive_internal.go

internal/commands/auth/logout_internal.go

* clear any previous token keychain entries or files if previous use of the same grant type was found on login and logout * use new WithStorageName method * update package name call for top level domain * correct context in internal auth method * use GetOptionValue methods to retrieve auth method values * remove redundant login and logout logic based on auth type * return missing configuration error, do not ask user if they'd like to reconfigure * remove unreliable isMissingConfigError, return authentication failed error instead * correct some errors to use PingCLI error type * update logout output message to include where token storage method was removed * correct login and logout documentation * improve error handling and logic in credentials.go * correct comment lines * remove unused pingfederate and pingone files * remove unneeded legacy methods * remove old test-auth references from Makefile * use ParseBool for file storage option * remove redundant check for cached token * require redirecturi port when using device code flow * store profile name and auth method in json file name, adding ability to clean up and remove past used token files. Added test coverage for this as well.

…code, use one environment id for all grant types

…remove unused clearAllTokenFiles function

…t for worker applications

…ction Add token expiry tracking to distinguish between new authentication and cached token reuse. Improve user messaging to clearly indicate when tokens are being refreshed automatically vs. using existing valid tokens.

…ling

… flag

…and, add fallback for worker environment id, change storage flag to only login command, fix Makefile formatting

…d in tests

…when not in CI environment

henryrecker-pingidentity · 2026-01-15T20:49:23Z

Makefile

 	protoc --proto_path=./internal/proto --go_out=./internal --go-grpc_out=./internal ./internal/proto/*.proto
 	echo "✅ gRPC code generated."

-test: _check_ping_env ## Run all tests


Why is this removed?

henryrecker-pingidentity · 2026-01-15T20:59:53Z

internal/commands/auth/credentials.go

+	if s == "" {
+		return true // default to keychain
+	}
+	// Back-compat: boolean handling (true => file_system, false => secure_local)


Remove usage of s here.

henryrecker-pingidentity · 2026-01-15T21:03:31Z

internal/commands/auth/credentials.go

+// Format: token-<hash>_<service>_<grantType>_<profile>.json
+// The hash is based on service:environmentID:clientID:grantType for uniqueness
+// Service and profile name are added as suffixes to enable service-specific token management and cleanup
+func generateTokenKey(providerName, profileName, environmentID, clientID, grantType string) string {


This method is not used.

henryrecker-pingidentity · 2026-01-15T21:10:35Z

internal/commands/auth/credentials.go

+			authType = "device_code"
+		case "authorizationCode":
+			authType = "authorization_code"
+		case "authorization_code":


This case doesn't do anything

henryrecker-pingidentity · 2026-01-15T21:12:15Z

internal/commands/auth/credentials.go

+		authType = "device_code"
+	case "authorizationCode":
+		authType = "authorization_code"
+	case "authorization_code":


henryrecker-pingidentity · 2026-01-15T21:36:46Z

internal/commands/auth/login_internal.go

+		}
+
+		// Determine which authentication method was requested and convert to auth type format
+		// If flags were provided, they take precedence. Otherwise, preserve configured authType (including legacy 'worker').


This doesn't seem to preserve the configured auth type. Update comment and include case in the switch specific for auth code.

henryrecker-pingidentity · 2026-01-16T17:25:12Z

docs/authentication/logout.md

+   - **Linux**: Secret Service API (GNOME Keyring/KDE KWallet)
+
+2. **File Storage:**
+   - `~/.pingcli/credentials/<env-id>_<client-id>_<method>.json` - Encrypted token files


These aren't encrypted

henryrecker-pingidentity · 2026-01-16T17:28:16Z

internal/commands/auth/utils.go

+	}
+
+	// Get and set the environment ID for API endpoints
+	// Prefer the environment ID already present on cfg; fallback to profile values.


This doesn't seem right for this method to handle. Remove env logic here

henryrecker-pingidentity · 2026-01-16T17:34:08Z

internal/commands/request/request_pingone.go

+	var tld string
+	switch regionCode {
+	case customtypes.ENUM_PINGONE_REGION_CODE_AP:
+		tld = "asia"


These domains are already defined in pingone_region_code.go

henryrecker-pingidentity · 2026-01-16T17:46:53Z

test

This file should be deleted

…eeded backwards compatability messages

wesleymccollam and others added 10 commits September 29, 2025 09:48

wip

73e3178

working client credentials

0be0973

working methods

1d347bb

support auth_code, client_credentials, and device_code authentication…

369337f

… methods

Merge branch 'main' into support-auth_code-client_credentials-device_…

a56efad

…code-authentication

wesleymccollam requested a review from a team as a code owner October 30, 2025 16:27

henryrecker-pingidentity reviewed Oct 30, 2025

View reviewed changes

wesleymccollam added 3 commits November 3, 2025 10:25

updates:

a1d4164

* add storage location type * update file storage flag

Updates:

5cc6e6f

* move login and logout logic to internal package * add debug message for failed keychain * remove unneeded auth services * fix issue where file storage did not occur along with keychain saving in default behavior

henryrecker-pingidentity reviewed Nov 5, 2025

View reviewed changes

wesleymccollam added 14 commits November 6, 2025 17:38

fix double-save to keychain, update/correct tests

872f8e8

use SDK for token name generation, rename auth code to authorization …

96b0148

…code, use one environment id for all grant types

various linting fixes, use errors package for various error outputs, …

601bc0a

…remove unused clearAllTokenFiles function

fix logout all methods bug

a53d603

remove redundant logic from login internal

dd3aafb

update login error handling to use pingcli errs package

e398a0c

update authentication documentation

6ae4ed6

update auth package error handling, remove unused method

715a749

add error prefix contant for token manager, add deprecation usage tex…

08fc116

…t for worker applications

lint fixes

6c65391

add --provider flag to login command

c9d3832

allow legacy worker authentication type - uses client_credentials

7a2699c

wesleymccollam and others added 27 commits December 18, 2025 11:17

fix worker auth when using requests, update tests, updated error hand…

1cfdc7c

…ling

corrected: set active profile message, authorization code env var and…

231a375

… flag

use keychain account name suffix method

e8f58d5

fix storage type

37908d4

align storage logic to client types

e4c284d

add validation input to interactive login

afcca99

fix login storage type validation

bd392a7

fix platform export with login

d829524

use correct auth type in platform export

1a5e2fc

linting, use new client release, doc updates

599462c

doc updates

96f4edc

local login docs

6223e9c

formatting

ea8323f

fix issue where file system storage value didn't work on request comm…

3011e3e

…and, add fallback for worker environment id, change storage flag to only login command, fix Makefile formatting

update login storage type env var name

d58ab3d

update storage flag to --storage-type

f4ce491

correct cobra parameter name for storage type

a2cd64f

update/fix tests

063aacd

bump golangclilint version, lint resource file fix

2c99bad

fix storage type none saving to file, test coverage added

df258a5

save token for correct storage type, lint fixes, correct env vars use…

48edf86

…d in tests

correct tests

3e58eed

update expected error lines, run authorization and device code tests …

d6e5fd3

…when not in CI environment

update tests

83841da

update/correct tests

414721f

lint fix

aa92478

doc correction, tests load env vars

71d2444

henryrecker-pingidentity reviewed Jan 16, 2026

View reviewed changes

wesleymccollam added 2 commits January 16, 2026 16:02

correct case logic for login flags, edit tests, doc edits, remove unn…

0e25c89

…eeded backwards compatability messages

lint fix, test edits, keychain function edit

5a3772f

Support auth_code, client_credentials, device_code authentication #143

Are you sure you want to change the base?

Support auth_code, client_credentials, device_code authentication #143

Uh oh!

Conversation

wesleymccollam commented Oct 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Change Description

Change Characteristics

Checklist

Required SDK Upgrades

Testing

Shell Command(s)

Testing Results

End-to-end Tests Workflow Links

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

wesleymccollam commented Oct 30, 2025 •

edited

Loading