fix: add login skip validation and unified docs generation

Author: spbsoluble

CHANGELOG.md

@@ -8,6 +8,7 @@
   `ServerUsername`, `ServerPassword`, and store password values.
 - `stores import csv`: Preserve JSON-shaped secret values as secret strings instead of parsing them into nested
   request objects.
+- `login`: Add `--skip-validate` to save login configuration without validating credentials against Keyfactor Command.
 
 ### Docs
 
@@ -17,6 +18,8 @@
 - Add use-case documentation for migrating certificate store credentials from static values to a PAM provider.
 - Add generated per-store-type bulk create and update use-case guides.
 - Add generated PAM Operations use-case documentation for PAM type and provider creation.
+- `makedocs` now regenerates command docs, store-type use cases, and PAM operation use cases without date-based
+  generated footers.
 
 # v1.9.1
 

artifacts/pam/pam-create-template.json

@@ -26,6 +26,27 @@
         "DataType": 2,
         "InstanceLevel": false
       },
+      {
+        "Id": -1,
+        "Name": "ClientId",
+        "DisplayName": "Client ID",
+        "DataType": 2,
+        "InstanceLevel": false
+      },
+      {
+        "Id": -1,
+        "Name": "ClientSecret",
+        "DisplayName": "ClientSecret",
+        "DataType": 2,
+        "InstanceLevel": false
+      },
+      {
+        "Id": -1,
+        "Name": "GrantType",
+        "DisplayName": "Grant Type",
+        "DataType": 1,
+        "InstanceLevel": false
+      },
       {
         "Id": -1,
         "Name": "SecretId",
@@ -72,6 +93,36 @@
         "DataType": 1,
         "InstanceLevel": false
       }
+    },
+    {
+      "Value": "N/A",
+      "ProviderTypeParam": {
+        "Id": -1,
+        "Name": "ClientId",
+        "DisplayName": "Client ID",
+        "DataType": 2,
+        "InstanceLevel": false
+      }
+    },
+    {
+      "Value": "N/A",
+      "ProviderTypeParam": {
+        "Id": -1,
+        "Name": "ClientSecret",
+        "DisplayName": "ClientSecret",
+        "DataType": 2,
+        "InstanceLevel": false
+      }
+    },
+    {
+      "Value": "password",
+      "ProviderTypeParam": {
+        "Id": -1,
+        "Name": "GrantType",
+        "DisplayName": "Grant Type",
+        "DataType": 1,
+        "InstanceLevel": false
+      }
     }
   ]
-}
+}

cmd/login.go

@@ -19,6 +19,7 @@ import (
 	"fmt"
 	"os"
 	"path"
+	"strconv"
 	"strings"
 
 	"github.com/Keyfactor/keyfactor-auth-client-go/auth_providers"
@@ -28,6 +29,8 @@ import (
 	"golang.org/x/term"
 )
 
+var loginSkipValidate bool
+
 var loginCmd = &cobra.Command{
 	Use:        "login",
 	Aliases:    nil,
@@ -78,16 +81,27 @@ WARNING: This will write the environmental credentials to disk and will be store
 			kfcOAuth      *auth_providers.CommandConfigOauth
 			kfcBasicAuth  *auth_providers.CommandAuthConfigBasic
 		)
+		skipValidate := loginSkipValidate
 
 		log.Debug().Msg("calling getEnvConfig()")
-		envConfig, envErr := getServerConfigFromEnv()
+		var envConfig *auth_providers.Server
+		var envErr error
+		if skipValidate {
+			envConfig, envErr = getServerConfigFromEnvNoValidate()
+		} else {
+			envConfig, envErr = getServerConfigFromEnv()
+		}
 		if envErr == nil {
 			log.Debug().Msg("getEnvConfig() returned")
+			message := fmt.Sprintf("Login successful via environment variables to %s", envConfig.Host)
+			if skipValidate {
+				message = fmt.Sprintf("Login configuration saved from environment variables to %s; credential validation skipped", envConfig.Host)
+			}
 			log.Info().
 				Str("host", envConfig.Host).
 				Str("authType", envConfig.AuthType).
 				Msg("Login successful via environment variables")
-			outputResult(fmt.Sprintf("Login successful via environment variables to %s", envConfig.Host), outputFormat)
+			outputResult(message, outputFormat)
 			if profile == "" {
 				profile = "default"
 			}
@@ -227,13 +241,27 @@ WARNING: This will write the environmental credentials to disk and will be store
 					log.Error().Msg("unable to determine auth type from interactive configuration")
 				}
 			}
+			if !skipValidate {
+				skipValidate = !promptForInteractiveYesNo("Validate credentials with Keyfactor Command now?")
+			}
 		}
 
 		if !isValidConfig {
 			log.Debug().Msg("prompting for interactive login")
 			return fmt.Errorf("unable to determine valid configuration")
 		}
 
+		if skipValidate {
+			log.Info().
+				Str("profile", profile).
+				Str("configFile", configFile).
+				Str("host", outputServer.Host).
+				Str("authType", authType).
+				Msg("Login configuration saved; credential validation skipped")
+			outputResult(fmt.Sprintf("Login configuration saved to %s; credential validation skipped", outputServer.Host), outputFormat)
+			return nil
+		}
+
 		if authType == "oauth" {
 			log.Debug().
 				Str("profile", profile).
@@ -297,6 +325,98 @@ WARNING: This will write the environmental credentials to disk and will be store
 
 func init() {
 	RootCmd.AddCommand(loginCmd)
+	loginCmd.Flags().BoolVar(
+		&loginSkipValidate,
+		"skip-validate",
+		false,
+		"Save the login configuration without validating credentials against Keyfactor Command.",
+	)
+}
+
+func getServerConfigFromEnvNoValidate() (*auth_providers.Server, error) {
+	hostname, hOk := os.LookupEnv(auth_providers.EnvKeyfactorHostName)
+	if !hOk || hostname == "" {
+		return nil, fmt.Errorf("environment variable %s is required", auth_providers.EnvKeyfactorHostName)
+	}
+
+	apiPath := os.Getenv(auth_providers.EnvKeyfactorAPIPath)
+	if apiPath == "" {
+		apiPath = auth_providers.DefaultCommandAPIPath
+	}
+	skipVerify := skipVerifyFromEnv()
+
+	username, uOk := os.LookupEnv(auth_providers.EnvKeyfactorUsername)
+	password, pOk := os.LookupEnv(auth_providers.EnvKeyfactorPassword)
+	if uOk && pOk {
+		serverConfig := &auth_providers.Server{
+			Host:          hostname,
+			APIPath:       apiPath,
+			Username:      username,
+			Password:      password,
+			Domain:        os.Getenv(auth_providers.EnvKeyfactorDomain),
+			SkipTLSVerify: skipVerify,
+			AuthType:      "basic",
+		}
+		if _, err := serverConfig.GetBasicAuthClientConfig(); err != nil {
+			return nil, err
+		}
+		return serverConfig, nil
+	}
+
+	clientID, cOk := os.LookupEnv(auth_providers.EnvKeyfactorClientID)
+	clientSecret, csOk := os.LookupEnv(auth_providers.EnvKeyfactorClientSecret)
+	tokenURL, tOk := os.LookupEnv(auth_providers.EnvKeyfactorAuthTokenURL)
+	if cOk && csOk && tOk {
+		serverConfig := &auth_providers.Server{
+			Host:          hostname,
+			APIPath:       apiPath,
+			ClientID:      clientID,
+			ClientSecret:  clientSecret,
+			OAuthTokenUrl: tokenURL,
+			Scopes:        authScopesFromCSV(os.Getenv(auth_providers.EnvKeyfactorAuthScopes)),
+			Audience:      os.Getenv(auth_providers.EnvKeyfactorAuthAudience),
+			SkipTLSVerify: skipVerify,
+			AuthType:      "oauth",
+		}
+		if _, err := serverConfig.GetOAuthClientConfig(); err != nil {
+			return nil, err
+		}
+		return serverConfig, nil
+	}
+
+	return nil, fmt.Errorf(
+		"incomplete environment variable configuration, " +
+			"please provide basic auth credentials or oAuth credentials",
+	)
+}
+
+func skipVerifyFromEnv() bool {
+	if skipVerifyFlag {
+		return true
+	}
+	value := strings.ToLower(os.Getenv(auth_providers.EnvKeyfactorSkipVerify))
+	parsed, err := strconv.ParseBool(value)
+	if err == nil {
+		return parsed
+	}
+	return value == "yes" || value == "y"
+}
+
+func authScopesFromCSV(scopesCSV string) []string {
+	if scopesCSV == "" {
+		return auth_providers.DefaultScopes
+	}
+	var scopes []string
+	for _, scope := range strings.Split(scopesCSV, ",") {
+		scope = strings.TrimSpace(scope)
+		if scope != "" {
+			scopes = append(scopes, scope)
+		}
+	}
+	if len(scopes) == 0 {
+		return auth_providers.DefaultScopes
+	}
+	return scopes
 }
 
 func writeConfigFile(configFile *auth_providers.Config, configPath string) error {

cmd/login_test.go

@@ -96,7 +96,9 @@ func Test_LoginFileNoPrompt(t *testing.T) {
 			defer setBasicEnvVariables(username, password, domain)
 
 			npfCmd := RootCmd
-			npfCmd.SetArgs([]string{"login", "--no-prompt"})
+			npfCmd.SetArgs(
+				[]string{"login", "--no-prompt", "--skip-validate", "--config", configFilePath, "--profile", "default"},
+			)
 
 			output := captureOutput(
 				func() {
@@ -108,7 +110,7 @@ func Test_LoginFileNoPrompt(t *testing.T) {
 				},
 			)
 			t.Logf("output: %s", output)
-			assert.Contains(t, output, "Login successful to")
+			assert.Contains(t, output, "Login configuration saved")
 			testConfigExists(t, configFilePath, true)
 			testConfigValid(t)
 			//testLogout(t)
@@ -165,7 +167,7 @@ func testLogout(t *testing.T, configFilePath string, restoreConfig bool) {
 					t.FailNow()
 				}
 			}
-			testCmd.SetArgs([]string{"logout"})
+			testCmd.SetArgs([]string{"logout", "--no-prompt"})
 			output := captureOutput(
 				func() {
 					err := testCmd.Execute()
@@ -174,7 +176,7 @@ func testLogout(t *testing.T, configFilePath string, restoreConfig bool) {
 			)
 			t.Logf("output: %s", output)
 
-			assert.Contains(t, output, "Logged out successfully!")
+			assert.Contains(t, output, "Logged out successfully")
 
 			// Test that the config file does not exist
 			if _, fErr := os.Stat(configFile); !os.IsNotExist(fErr) {

cmd/pam.go

@@ -328,6 +328,7 @@ var pamProvidersUpdateCmd = &cobra.Command{
 
 		log.Debug().Msg("call: PAMProviderUpdatePamProvider()")
 		updateRequest := keyfactor.ProviderUpdateRequestLegacy{
+			Id:                      pamProvider.Id,
 			Name:                    pamProvider.Name,
 			Remote:                  pamProvider.Remote,
 			Area:                    pamProvider.Area,
@@ -339,8 +340,8 @@ var pamProvidersUpdateCmd = &cobra.Command{
 		updatedPamProvider, cErr := kfClient.UpdatePAMProvider(&updateRequest)
 
 		log.Debug().Msg("returned: PAMProviderUpdatePamProvider()")
-		if err != nil {
-			return err
+		if cErr != nil {
+			return cErr
 		}
 
 		log.Debug().Msg(convertResponseMsg)

cmd/pam_test.go

@@ -993,8 +993,7 @@ func testListPamProviders(t *testing.T) ([]any, error) {
 					assert.NotEmpty(t, providerConfig["Id"])
 					assert.NotEmpty(t, providerConfig["ProviderType"])
 
-					pTypeParams := providerConfig["ProviderType"].(map[string]any)["ProviderTypeParams"].([]any)
-					assert.NotEmpty(t, pTypeParams)
+					pTypeParams, _ := providerConfig["ProviderType"].(map[string]any)["ProviderTypeParams"].([]any)
 					assert.GreaterOrEqual(t, len(pTypeParams), 0)
 					if len(pTypeParams) > 0 {
 						for _, param := range pTypeParams {
@@ -1194,10 +1193,14 @@ func testFormatPamCreateConfig(t *testing.T, inputFileName string, providerName
 	case map[string]any:
 		aProviderType := apiProviderType.(map[string]any)
 		cProviderType["Id"] = aProviderType["Id"]
-		cProviderType["ProviderTypeParams"] = aProviderType["ProviderTypeParams"]
+		apiProviderTypeParams, ok := aProviderType["ProviderTypeParams"]
+		if !ok || apiProviderTypeParams == nil {
+			apiProviderTypeParams = aProviderType["Parameters"]
+		}
+		cProviderType["ProviderTypeParams"] = apiProviderTypeParams
 		nameToIdMap := make(map[string]int)
 		paramsFieldName := "ProviderTypeParams"
-		_, ok := cProviderType[paramsFieldName]
+		_, ok = cProviderType[paramsFieldName]
 		if ok && cProviderType[paramsFieldName] != nil {
 			t.Logf("PAM definition is v10 or earlier")
 			for _, cParam := range cProviderType[paramsFieldName].([]any) {