Skip to content

Commit 6499498

Browse files
bergerhofferbergerhoffer
authored
Merge pull request #28506 from bergerhoffer/OSDOCS-1650
OSDOCS-1650: Adding docs for managing user oauth tokens
2 parents 81d1bfe + 62aec27 commit 6499498

File tree

5 files changed

+147
-0
lines changed

5 files changed

+147
-0
lines changed

‎_topic_map.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -572,6 +572,8 @@ Topics:
572572
File: configuring-internal-oauth
573573
- Name: Configuring OAuth clients
574574
File: configuring-oauth-clients
575+
- Name: Managing user-owned OAuth access tokens
576+
File: managing-oauth-access-tokens
575577
Distros: openshift-enterprise,openshift-webscale,openshift-origin
576578
- Name: Understanding identity provider configuration
577579
File: understanding-identity-provider

‎authentication/managing-oauth-access-tokens.adoc‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
[id="managing-oauth-access-tokens"]
2+
= Managing user-owned OAuth access tokens
3+
include::modules/common-attributes.adoc[]
4+
:context: managing-oauth-access-tokens
5+
6+
toc::[]
7+
8+
Users can review their own OAuth access tokens and delete any that are no longer needed.
9+
10+
// Listing user-owned OAuth access tokens
11+
include::modules/oauth-list-tokens.adoc[leveloffset=+1]
12+
13+
// Viewing the details of a user-owned OAuth access token
14+
include::modules/oauth-view-details-tokens.adoc[leveloffset=+1]
15+
16+
// Deleting user-owned OAuth access tokens
17+
include::modules/oauth-delete-tokens.adoc[leveloffset=+1]

‎modules/oauth-delete-tokens.adoc‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * authentication/managing-oauth-access-tokens.adoc
4+
5+
[id="oauth-delete-tokens_{context}"]
6+
= Deleting user-owned OAuth access tokens
7+
8+
The `oc logout` command only invalidates the OAuth token for the active session. You can use the following procedure to delete any user-owned OAuth tokens that are no longer needed.
9+
10+
Deleting an OAuth access token logs out the user from all sessions that use the token.
11+
12+
.Procedure
13+
14+
* Delete the user-owned OAuth access token:
15+
+
16+
[source,terminal]
17+
----
18+
$ oc delete useroauthaccesstokens <token_name>
19+
----
20+
+
21+
.Example output
22+
[source,terminal]
23+
----
24+
useroauthaccesstoken.oauth.openshift.io "<token_name>" deleted
25+
----

‎modules/oauth-list-tokens.adoc‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * authentication/managing-oauth-access-tokens.adoc
4+
5+
[id="oauth-list-tokens_{context}"]
6+
= Listing user-owned OAuth access tokens
7+
8+
You can list your user-owned OAuth access tokens. Token names are not sensitive and cannot be used to log in.
9+
10+
.Procedure
11+
12+
* List all user-owned OAuth access tokens:
13+
+
14+
[source,terminal]
15+
----
16+
$ oc get useroauthaccesstokens
17+
----
18+
+
19+
.Example output
20+
[source,terminal]
21+
----
22+
NAME CLIENT NAME CREATED EXPIRES REDIRECT URI SCOPES
23+
<token1> openshift-challenging-client 2021-01-11T19:25:35Z 2021-01-12 19:25:35 +0000 UTC https://oauth-openshift.apps.example.com/oauth/token/implicit user:full
24+
<token2> openshift-browser-client 2021-01-11T19:27:06Z 2021-01-12 19:27:06 +0000 UTC https://oauth-openshift.apps.example.com/oauth/token/display user:full
25+
<token3> console 2021-01-11T19:26:29Z 2021-01-12 19:26:29 +0000 UTC https://console-openshift-console.apps.example.com/auth/callback user:full
26+
----
27+
28+
* List user-owned OAuth access tokens for a particular OAuth client:
29+
+
30+
[source,terminal]
31+
----
32+
$ oc get useroauthaccesstokens --field-selector=clientName="console"
33+
----
34+
+
35+
.Example output
36+
[source,terminal]
37+
----
38+
NAME CLIENT NAME CREATED EXPIRES REDIRECT URI SCOPES
39+
<token3> console 2021-01-11T19:26:29Z 2021-01-12 19:26:29 +0000 UTC https://console-openshift-console.apps.example.com/auth/callback user:full
40+
----

‎modules/oauth-view-details-tokens.adoc‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * authentication/managing-oauth-access-tokens.adoc
4+
5+
[id="oauth-view-details-tokens_{context}"]
6+
= Viewing the details of a user-owned OAuth access token
7+
8+
You can view the details of a user-owned OAuth access token.
9+
10+
.Procedure
11+
12+
* Describe the details of a user-owned OAuth access token:
13+
+
14+
[source,terminal]
15+
----
16+
$ oc describe useroauthaccesstokens <token_name>
17+
----
18+
+
19+
.Example output
20+
[source,terminal]
21+
----
22+
Name: <token_name> <1>
23+
Namespace:
24+
Labels: <none>
25+
Annotations: <none>
26+
API Version: oauth.openshift.io/v1
27+
Authorize Token: sha256~Ksckkug-9Fg_RWn_AUysPoIg-_HqmFI9zUL_CgD8wr8
28+
Client Name: openshift-browser-client <2>
29+
Expires In: 86400 <3>
30+
Inactivity Timeout Seconds: 317 <4>
31+
Kind: UserOAuthAccessToken
32+
Metadata:
33+
Creation Timestamp: 2021-01-11T19:27:06Z
34+
Managed Fields:
35+
API Version: oauth.openshift.io/v1
36+
Fields Type: FieldsV1
37+
fieldsV1:
38+
f:authorizeToken:
39+
f:clientName:
40+
f:expiresIn:
41+
f:redirectURI:
42+
f:scopes:
43+
f:userName:
44+
f:userUID:
45+
Manager: oauth-server
46+
Operation: Update
47+
Time: 2021-01-11T19:27:06Z
48+
Resource Version: 30535
49+
Self Link: /apis/oauth.openshift.io/v1/useroauthaccesstokens/<token_name>
50+
UID: f9d00b67-ab65-489b-8080-e427fa3c6181
51+
Redirect URI: https://oauth-openshift.apps.example.com/oauth/token/display
52+
Scopes:
53+
user:full <5>
54+
User Name: <user_name> <6>
55+
User UID: 82356ab0-95f9-4fb3-9bc0-10f1d6a6a345
56+
Events: <none>
57+
----
58+
<1> The token name, which is the sha256 hash of the token. Token names are not sensitive and cannot be used to log in.
59+
<2> The client name, which describes where the token originated from.
60+
<3> The value in seconds from the creation time before this token expires.
61+
<4> If there is a token inactivity timeout set for the OAuth server, this is the value in seconds from the creation time before this token can no longer be used.
62+
<5> The scopes for this token.
63+
<6> The user name associated with this token.

0 commit comments

Comments
 (0)