Conversation
So far, CaPyCli only supported config files in current dir, but for credentials etc., having one central config file in your home dir would be better.
Replace lengthy if chain with lookup dict CONFIG_KEY_ALIASES. Note this also removes the "oa" alias as I don't expect anyone to use short commandline options in the config file.
…eters In the config file, we expect internal argument names which in some cases deviate from the commandline options, so provide aliases in all such cases.
18e2090 to
d645eda
Compare
|
Discussed with @t-graf and he has another perspective on the config file, mostly using it for per-project settings like e.g. name and paths for reports. In that case, there's a major risk that such files are pushed to VCS together with other code changes, probably making env variables a better place to store credentials. So the clear recommendation for storing credentials in files is only valid if config file is used for credentials and stored in $HOME. Having the per-project use case would however need config setting merging... |
d645eda to
fce6a10
Compare
fce6a10 to
dd66bcc
Compare
|
@t-graf, I just pushed an updated version which now also discusses the risks of tokens in a config file and recommends to either use the environment variables for client_secret or a specifically a config file in your home directory. Following the discussion in #245, I now also added a NOTE clarifying that CaPyCli will automatically request read or write tokens as needed from keycloak. |
|
Had a read through the docs here, very clear and well written 👍 Thanks for this Gernot. The unconventional mixed lowercast/uppercase environment variable naming feels a bit strange if I'm honest, but that's not a problem with the documentation, just an observation. |
3 participants
With the last release, handling of Keycloak client_id and client_secret was added which requires special care to avoid leaking these long-lived tokens. I think using the config file is the best solution here, so I tried to document this feature better and also added a corresponding warning if the user passes keycloak tokens on the commandline.