Ignore Env Vars when --user and --password is set

[spralexx]

Description

when using ``ìonosctl login --user $USERNAME --password $PASSWORD``` the $IONOS_USERNAME and $IONOS_PASSWORD env variables are not ignored.

Expected behavior

I would expect the env vars to be ignored since I have set the username and password to be used explicitly.

Ionosctl version:

6.7.9

[avirtopeanu-ionos]

Hi! Thanks for opening this issue!

I can't seem to reproduce the bug: The command still seems to use the values for the flags, and not the env vars. (So, the env vars are ignored)

 % i version 
v6.7.9

 % export IONOS_USERNAME=... IONOS_PASSWORD=...
          
 % i whoami
<correct-account>

 % i whoami -p
Authentication layers, in order of priority:
  [1] Global Flags (--token)
* [2] Environment Variables (IONOS_TOKEN, IONOS_USERNAME, IONOS_PASSWORD) (USED)
    - Using username and password for authentication.
    - Using https://api.ionos.com as the API URL.
  [3] Config file settings (userdata.token, userdata.name, userdata.password)

 % export USERNAME=baduser PASSWORD=badpass                                        

 % IONOS_LOG_LEVEL=trace i login --user $USERNAME --password $PASSWORD
Authorization: Basic YmFkdXNlcjpiYWRwYXNz
Error: failed building config data: failed using username and password to generate a token: 401 Unauthorized {"httpStatus":401,"messages":[{"errorCode":"315","message":"Unauthorized"}]}

As you can see the Authorization header is set to baduser:badpass (in base64) as expected

Can you please specify more info, what OS are you running, how did you install ionosctl. Can you also debug the login command with IONOS_LOG_LEVEL=trace, and verify the Authorization header?

[spralexx]

We are running tofu as part of our gitlab CI jobs.
The jobs are executed using a self build Docker image

#Use Alpine as base image
FROM alpine:3.19.6

#install custom software
RUN apk add helm kubectl opentofu ansible curl python3 py3-pip 

RUN pip3 install j2cli --break-system-packages

#install ionosctl from github release
RUN wget https://github.com/ionos-cloud/ionosctl/releases/download/v6.7.9/ionosctl-6.7.9-linux-amd64.tar.gz && tar -zxvf ionosctl-6.7.9-linux-amd64.tar.gz ionosctl && mv ionosctl /usr/bin/ && rm ionosctl-6.7.9-linux-amd64.tar.gz

For authentication we build a custom gitlab component:

# yamllint disable rule:document-start
# Perform IONOS authentication

# Provides kubeconfig file under the path given for `kubeconfig`
# Needs username and password for IONOS DCD
spec:
  inputs:
    stage:
      default: .pre
    ionos_username:
      default: ''
      description: IONOS DCD username
      type: string
    ionos_password:
      default: ''
      description: IONOS DCD password
      type: string
    deployment_container_tag:
      default: v0.0.7
      description: Image tag for deployment base image
      type: string
    token_file:
      default: /tmp/ionos.token
      description: Path to store token for IONOS authentication
      type: string
    token_ttl:
      default: 2h
      description: TTL for Token to autoexpire
      type: string
---

variables:
  __AUTH_IONOS_USERNAME: $[[ inputs.ionos_username ]]
  __AUTH_IONOS_PASSWORD: $[[ inputs.ionos_password ]]
  DEPLOYMENT_CONTAINER_TAG: $[[ inputs.deployment_container_tag ]]
  __AUTH_IONOS_TOKEN: $[[ inputs.token_file ]]

pre:set_ionos_auth_token_before_script:
  image:
    name: $CI_REGISTRY/devops/images/deployment:$DEPLOYMENT_CONTAINER_TAG
    entrypoint: ["/bin/sh", "-c"]
  stage: $[[ inputs.stage ]]
  script:
    - unset IONOS_USERNAME
    - unset IONOS_PASSWORD
    - ionosctl login --user $__AUTH_IONOS_USERNAME --password $__AUTH_IONOS_PASSWORD
    - ionosctl token generate --ttl $[[ inputs.token_ttl ]]  > $__AUTH_IONOS_TOKEN
    - echo TF_VAR_ionos_token=$(cat $__AUTH_IONOS_TOKEN) >> .env
  artifacts:
    reports:
      dotenv: .env

Our Gitlab project structure defines IONOS_USERNANE and IONOS_PASSWORD as global main group variables.
On a subgroup we override those and use even others as inputs for the above component.

Without

- unset IONOS_USERNAME
- unset IONOS_PASSWORD  

The credentials inside this variables have been used.

Hope this clarifies our setup.

[avirtopeanu-ionos]

My hunch, is that the login is actually working as expected. But that the following steps don't have the unset IONOS_USERNAME and IONOS_PASSWORD - and therefore the env vars keep being used.

NOTE: IONOS_USERNAME and IONOS_PASSWORD always have priority over the config file if both exist! ionosctl login simply generates a config file with a JWT.

To confirm that the config file (generated by ionosctl login) is used, you need to have this output:

 % i whoami -p
Authentication layers, in order of priority:
  [1] Global Flags (--token)
  [2] Environment Variables (IONOS_TOKEN, IONOS_USERNAME, IONOS_PASSWORD)
* [3] Config file settings (userdata.token, userdata.name, userdata.password) (USED)
    - Using token for authentication.
    - Using https://api.ionos.com as the API URL.

Can you please try debugging the CI pipeline without the unset commands?

If the logs are private, you can set IONOS_LOG_LEVEL=trace (⚠ Warning: Your password will appear as a base64-encoded string) to inspect the Authorization header.

Additionally, could you add a debugging step with ionosctl whoami and ionosctl whoami --provenance? This will help confirm if the environment variables are being prioritized.

Maybe the least useful but worth mentioning, would be cat-ing the ionosctl config location and parsing the generated JWT and seeing which user it belongs to?

For now, we will also improve the login text, telling you which user you have logged in as, after doing ionosctl login.