)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":7186,"name":"Matthieu Huin","email":"mhuin@redhat.com","username":"mhu"},"change_message_id":"063f612f08d082cc2db0943af097462c067e8964","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":2,"id":"214826d3_58be0ba6","updated":"2022-03-04 16:42:15.000000000","message":"\u003e Patch Set 2: Code-Review-1\n\u003e \n\u003e There is a straightforward way of allowing cli authentication by using the tokens issued by a zuul admin, and you have the parent change to support direct access grants.\n\nDirect access grants are not recommended in production, as explained in the OAuth2.0 RFC:\n\n   This grant type carries a higher risk than other grant types because\n   it maintains the password anti-pattern this protocol seeks to avoid.\n   The client could abuse the password, or the password could\n   unintentionally be disclosed to an attacker (e.g., via log files or\n   other records kept by the client). [...]\n\n   The authorization server and client SHOULD minimize use of this grant\n   type and utilize other grant types whenever possible.\n\nSee https://datatracker.ietf.org/doc/html/rfc6749#section-10.7\n\n\u003e I\u0027m not sure I\u0027ve seen this JWT-to-localhost paradigm used before, and it seems complex, fragile and relies on a lot of things going right (localhost being added to the provider, being able to run in a location with a web server, etc).  Is it really worth the effort?\n\nIt is indeed troublesome, but this seems to be the accepted way to support OpenIDConnect with a CLI: \n\nhttps://medium.com/keycloak/using-keycloak-x-with-cli-applications-38bbff9f9c96\nhttps://devconfcz2022.sched.com/event/siIY/securing-command-line-applications-with-keycloak\n\n\u003e We\u0027ve put a lot of effort into bringing the web ui up to par with the client; why not accept it as the first-class method of interacting with zuul, and for sites that can\u0027t use either of the above methods, accept that the users are best served by using the web ui?\n\nTrue, given that if you can use the web auth workflow, you should also be able to use the GUI.","commit_id":"ff426499f6dc58471de489a1e2084ed981aa6061"}]}