ssoosshd identity echo
Mints a one-time identity echo link and prints it. Whoever opens it signs in at the identity provider and sees the claims it sends: each authentication.fields entry and what it resolves to, whether the sign-in would succeed, candidates for the subject, username and groups claims and for admin.require_group, and YAML to copy or download. No admin role is needed and no mapping has to work yet; nothing is stored, and no session is created.
Run it on the server host as the service account, with the server running: the link opens the server’s own page. The code rides in the link’s fragment, so no access log or proxy sees it; the database holds only its SHA-256. It works once, until –ttl runs out, and minting another replaces it.
The command then waits and prints what happened: when and from which address the link was used and how the sign-in ended (an error from the code exchange or the token check, when there was one), or that it expired. It never prints claims. Ctrl-C retires an unused link. Exits non-zero unless the claims were shown.
Records auth.echo_code_minted, auth.echo_code_used and auth.echo_code_expired, whose actor for the first is local-cli. The database is never migrated: its schema must match this ssoosshd.
Synopsis
Section titled “Synopsis”ssoosshd identity echo [flags] [args]Options
Section titled “Options”| Flag | Type | Default | Description |
|---|---|---|---|
--ttl |
duration | 15m0s |
how long the link works |
Global options
Section titled “Global options”Inherited from ssoosshd and its parents.
| Flag | Type | Default | Description |
|---|---|---|---|
-c, --config |
string | path to the ssoosshd config file |