ibm-cloud-sdk-core 2.15.1 → 2.16.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.secrets.baseline +13 -21
- package/Authentication.md +291 -107
- package/CHANGELOG.md +7 -0
- package/auth/authenticators/iam-authenticator.d.ts +0 -7
- package/auth/authenticators/iam-authenticator.js +0 -9
- package/auth/authenticators/iam-request-based-authenticator.d.ts +7 -0
- package/auth/authenticators/iam-request-based-authenticator.js +9 -0
- package/auth/token-managers/iam-request-based-token-manager.d.ts +17 -0
- package/auth/token-managers/iam-request-based-token-manager.js +24 -0
- package/auth/token-managers/iam-token-manager.d.ts +0 -17
- package/auth/token-managers/iam-token-manager.js +0 -24
- package/package.json +1 -1
package/.secrets.baseline
CHANGED
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
"files": "package-lock.json|^.secrets.baseline$",
|
|
4
4
|
"lines": null
|
|
5
5
|
},
|
|
6
|
-
"generated_at": "2021-10-
|
|
6
|
+
"generated_at": "2021-10-20T21:45:37Z",
|
|
7
7
|
"plugins_used": [
|
|
8
8
|
{
|
|
9
9
|
"name": "AWSKeyDetector"
|
|
@@ -70,31 +70,23 @@
|
|
|
70
70
|
"hashed_secret": "91dfd9ddb4198affc5c194cd8ce6d338fde470e2",
|
|
71
71
|
"is_secret": false,
|
|
72
72
|
"is_verified": false,
|
|
73
|
-
"line_number":
|
|
73
|
+
"line_number": 73,
|
|
74
74
|
"type": "Secret Keyword",
|
|
75
75
|
"verified_result": null
|
|
76
76
|
},
|
|
77
77
|
{
|
|
78
|
-
"hashed_secret": "
|
|
78
|
+
"hashed_secret": "98635b2eaa2379f28cd6d72a38299f286b81b459",
|
|
79
79
|
"is_secret": false,
|
|
80
80
|
"is_verified": false,
|
|
81
|
-
"line_number":
|
|
81
|
+
"line_number": 334,
|
|
82
82
|
"type": "Secret Keyword",
|
|
83
83
|
"verified_result": null
|
|
84
84
|
},
|
|
85
85
|
{
|
|
86
|
-
"hashed_secret": "
|
|
87
|
-
"is_secret": false,
|
|
88
|
-
"is_verified": false,
|
|
89
|
-
"line_number": 136,
|
|
90
|
-
"type": "Secret Keyword",
|
|
91
|
-
"verified_result": null
|
|
92
|
-
},
|
|
93
|
-
{
|
|
94
|
-
"hashed_secret": "32e8612d8ca77c7ea8374aa7918db8e5df9252ed",
|
|
86
|
+
"hashed_secret": "47fcf185ee7e15fe05cae31fbe9e4ebe4a06a40d",
|
|
95
87
|
"is_secret": false,
|
|
96
88
|
"is_verified": false,
|
|
97
|
-
"line_number":
|
|
89
|
+
"line_number": 372,
|
|
98
90
|
"type": "Secret Keyword",
|
|
99
91
|
"verified_result": null
|
|
100
92
|
}
|
|
@@ -232,7 +224,7 @@
|
|
|
232
224
|
"hashed_secret": "f84f793e0af9ade37c8b927bc5091e98f35bf821",
|
|
233
225
|
"is_secret": false,
|
|
234
226
|
"is_verified": false,
|
|
235
|
-
"line_number":
|
|
227
|
+
"line_number": 83,
|
|
236
228
|
"type": "Secret Keyword",
|
|
237
229
|
"verified_result": null
|
|
238
230
|
},
|
|
@@ -240,7 +232,7 @@
|
|
|
240
232
|
"hashed_secret": "45c43fe97e3a06ab078b0eeff6fbe622cc417a25",
|
|
241
233
|
"is_secret": false,
|
|
242
234
|
"is_verified": false,
|
|
243
|
-
"line_number":
|
|
235
|
+
"line_number": 120,
|
|
244
236
|
"type": "Secret Keyword",
|
|
245
237
|
"verified_result": null
|
|
246
238
|
},
|
|
@@ -248,7 +240,7 @@
|
|
|
248
240
|
"hashed_secret": "99833a8b234b57b886a9aef1dba187fdd7ceece8",
|
|
249
241
|
"is_secret": false,
|
|
250
242
|
"is_verified": false,
|
|
251
|
-
"line_number":
|
|
243
|
+
"line_number": 122,
|
|
252
244
|
"type": "Secret Keyword",
|
|
253
245
|
"verified_result": null
|
|
254
246
|
}
|
|
@@ -258,7 +250,7 @@
|
|
|
258
250
|
"hashed_secret": "8f4bfc22c4fd7cb884f94ec175ff4a3284a174a1",
|
|
259
251
|
"is_secret": false,
|
|
260
252
|
"is_verified": false,
|
|
261
|
-
"line_number":
|
|
253
|
+
"line_number": 58,
|
|
262
254
|
"type": "Secret Keyword",
|
|
263
255
|
"verified_result": null
|
|
264
256
|
},
|
|
@@ -266,7 +258,7 @@
|
|
|
266
258
|
"hashed_secret": "0358c67856fb6a21c4767daf02fcb8fe4dc0a318",
|
|
267
259
|
"is_secret": false,
|
|
268
260
|
"is_verified": false,
|
|
269
|
-
"line_number":
|
|
261
|
+
"line_number": 61,
|
|
270
262
|
"type": "Secret Keyword",
|
|
271
263
|
"verified_result": null
|
|
272
264
|
},
|
|
@@ -274,7 +266,7 @@
|
|
|
274
266
|
"hashed_secret": "dbb19b8ae3b78f908e1467721fe4c9f0b0529d9b",
|
|
275
267
|
"is_secret": false,
|
|
276
268
|
"is_verified": false,
|
|
277
|
-
"line_number":
|
|
269
|
+
"line_number": 62,
|
|
278
270
|
"type": "Secret Keyword",
|
|
279
271
|
"verified_result": null
|
|
280
272
|
}
|
|
@@ -532,7 +524,7 @@
|
|
|
532
524
|
}
|
|
533
525
|
]
|
|
534
526
|
},
|
|
535
|
-
"version": "0.13.1+ibm.
|
|
527
|
+
"version": "0.13.1+ibm.40.dss",
|
|
536
528
|
"word_list": {
|
|
537
529
|
"file": null,
|
|
538
530
|
"hash": null
|
package/Authentication.md
CHANGED
|
@@ -1,19 +1,25 @@
|
|
|
1
1
|
# Authentication
|
|
2
2
|
The node-sdk-core project supports the following types of authentication:
|
|
3
3
|
- Basic Authentication
|
|
4
|
-
- Bearer Token
|
|
5
|
-
- Identity and Access Management (IAM)
|
|
6
|
-
-
|
|
7
|
-
-
|
|
4
|
+
- Bearer Token Authentication
|
|
5
|
+
- Identity and Access Management (IAM) Authentication
|
|
6
|
+
- Container Authentication
|
|
7
|
+
- Cloud Pak for Data Authentication
|
|
8
8
|
- No Authentication
|
|
9
9
|
|
|
10
|
-
The SDK user configures the appropriate type of authentication for use with service instances.
|
|
11
|
-
|
|
12
|
-
|
|
10
|
+
The SDK user configures the appropriate type of authentication for use with service instances.
|
|
11
|
+
The authentication types that are appropriate for a particular service may vary from service to service,
|
|
12
|
+
so it is important for the SDK user to consult with the appropriate service documentation to understand
|
|
13
|
+
which authentication types are supported for that service.
|
|
13
14
|
|
|
14
15
|
The node-sdk-core allows an authenticator to be specified in one of two ways:
|
|
15
|
-
1. programmatically - the SDK user invokes the appropriate function(s) to create an instance of the
|
|
16
|
-
|
|
16
|
+
1. programmatically - the SDK user invokes the appropriate function(s) to create an instance of the
|
|
17
|
+
desired authenticator and then passes the authenticator instance when constructing an instance of the service client.
|
|
18
|
+
2. configuration - the SDK user provides external configuration information (in the form of environment variables
|
|
19
|
+
or a credentials file) to indicate the type of authenticator, along with the configuration of the necessary properties
|
|
20
|
+
for that authenticator.
|
|
21
|
+
The SDK user then invokes the configuration-based service client constructor method
|
|
22
|
+
to construct an instance of the authenticator and service client that reflect the external configuration information.
|
|
17
23
|
|
|
18
24
|
The sections below will provide detailed information for each authenticator
|
|
19
25
|
which will include the following:
|
|
@@ -25,6 +31,7 @@ configuration information. The configuration examples below will use
|
|
|
25
31
|
environment variables, although the same properties could be specified in a
|
|
26
32
|
credentials file instead.
|
|
27
33
|
|
|
34
|
+
|
|
28
35
|
## Basic Authentication
|
|
29
36
|
The `BasicAuthenticator` is used to add Basic Authentication information to
|
|
30
37
|
each outbound request in the `Authorization` header in the form:
|
|
@@ -34,30 +41,51 @@ each outbound request in the `Authorization` header in the form:
|
|
|
34
41
|
```
|
|
35
42
|
|
|
36
43
|
### Properties
|
|
44
|
+
|
|
37
45
|
- username: (required) the basic auth username
|
|
46
|
+
|
|
38
47
|
- password: (required) the basic auth password
|
|
39
48
|
|
|
40
49
|
### Programming example
|
|
41
50
|
```js
|
|
42
|
-
|
|
51
|
+
const { BasicAuthenticator } = require('ibm-cloud-sdk-core');
|
|
52
|
+
const ExampleServiceV1 = require('<sdk-package-name>/example-service/v1');
|
|
43
53
|
|
|
44
54
|
const authenticator = new BasicAuthenticator({
|
|
45
|
-
username: '
|
|
46
|
-
password: '
|
|
55
|
+
username: 'myuser',
|
|
56
|
+
password: 'mypassword',
|
|
47
57
|
});
|
|
58
|
+
|
|
59
|
+
const options = {
|
|
60
|
+
authenticator,
|
|
61
|
+
};
|
|
62
|
+
|
|
63
|
+
const service = new ExampleServiceV1(options);
|
|
64
|
+
|
|
65
|
+
// 'service' can now be used to invoke operations.
|
|
48
66
|
```
|
|
49
67
|
|
|
50
|
-
###
|
|
68
|
+
### Configuration example
|
|
69
|
+
External configuration:
|
|
70
|
+
```
|
|
71
|
+
export EXAMPLE_SERVICE_AUTH_TYPE=basic
|
|
72
|
+
export EXAMPLE_SERVICE_USERNAME=myuser
|
|
73
|
+
export EXAMPLE_SERVICE_PASSWORD=mypassword
|
|
74
|
+
```
|
|
75
|
+
Application code:
|
|
51
76
|
```js
|
|
52
|
-
|
|
77
|
+
const ExampleServiceV1 = require('<sdk-package-name>/example-service/v1');
|
|
78
|
+
|
|
79
|
+
const options = {
|
|
80
|
+
serviceName: 'example_service',
|
|
81
|
+
};
|
|
53
82
|
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
//
|
|
57
|
-
// MY_SERVICE_PASSWORD=mypassword
|
|
58
|
-
const basicAuthenticator = getAuthenticatorFromEnvironment('my-service');
|
|
83
|
+
const service = ExampleServiceV1.newInstance(options);
|
|
84
|
+
|
|
85
|
+
// 'service' can now be used to invoke operations.
|
|
59
86
|
```
|
|
60
87
|
|
|
88
|
+
|
|
61
89
|
## Bearer Token Authentication
|
|
62
90
|
The `BearerTokenAuthenticator` will add a user-supplied bearer token to
|
|
63
91
|
each outbound request in the `Authorization` header in the form:
|
|
@@ -67,112 +95,130 @@ each outbound request in the `Authorization` header in the form:
|
|
|
67
95
|
```
|
|
68
96
|
|
|
69
97
|
### Properties
|
|
98
|
+
|
|
70
99
|
- bearerToken: (required) the bearer token value
|
|
71
100
|
|
|
72
101
|
### Programming example
|
|
73
102
|
```js
|
|
74
|
-
|
|
103
|
+
const { BearerTokenAuthenticator } = require('ibm-cloud-sdk-core');
|
|
104
|
+
const ExampleServiceV1 = require('<sdk-package-name>/example-service/v1');
|
|
75
105
|
|
|
106
|
+
const bearerToken = // ... obtain bearer token value ...
|
|
76
107
|
const authenticator = new BearerTokenAuthenticator({
|
|
77
|
-
bearerToken:
|
|
108
|
+
bearerToken: bearerToken,
|
|
78
109
|
});
|
|
110
|
+
|
|
111
|
+
const options = {
|
|
112
|
+
authenticator,
|
|
113
|
+
};
|
|
114
|
+
|
|
115
|
+
const service = new ExampleServiceV1(options);
|
|
116
|
+
|
|
117
|
+
// 'service' can now be used to invoke operations.
|
|
118
|
+
...
|
|
119
|
+
// Later, if your bearer token value expires, you can set a new one like this:
|
|
120
|
+
newToken = // ... obtain new bearer token value
|
|
121
|
+
authenticator.bearerToken = newToken;
|
|
79
122
|
```
|
|
80
123
|
|
|
81
|
-
###
|
|
124
|
+
### Configuration example
|
|
125
|
+
External configuration:
|
|
126
|
+
```
|
|
127
|
+
export EXAMPLE_SERVICE_AUTH_TYPE=bearertoken
|
|
128
|
+
export EXAMPLE_SERVICE_BEARER_TOKEN=<the bearer token value>
|
|
129
|
+
```
|
|
130
|
+
Application code:
|
|
82
131
|
```js
|
|
83
|
-
|
|
132
|
+
const ExampleServiceV1 = require('<sdk-package-name>/example-service/v1');
|
|
133
|
+
|
|
134
|
+
const options = {
|
|
135
|
+
serviceName: 'example_service',
|
|
136
|
+
};
|
|
137
|
+
|
|
138
|
+
const service = ExampleServiceV1.newInstance(options);
|
|
84
139
|
|
|
85
|
-
//
|
|
86
|
-
// MY_SERVICE_AUTH_TYPE=bearerToken
|
|
87
|
-
// MY_SERVICE_BEARER_TOKEN=somebearertoken
|
|
88
|
-
const bearerTokenAuthenticator = getAuthenticatorFromEnvironment('my-service');
|
|
140
|
+
// 'service' can now be used to invoke operations.
|
|
89
141
|
```
|
|
90
142
|
|
|
91
|
-
Note that the use of external configuration is not as useful with the `BearerTokenAuthenticator` as it
|
|
143
|
+
Note that the use of external configuration is not as useful with the `BearerTokenAuthenticator` as it
|
|
144
|
+
is for other authenticator types because bearer tokens typically need to be obtained and refreshed
|
|
145
|
+
programmatically since they normally have a relatively short lifespan before they expire. This
|
|
146
|
+
authenticator type is intended for situations in which the application will be managing the bearer
|
|
147
|
+
token itself in terms of initial acquisition and refreshing as needed.
|
|
92
148
|
|
|
93
|
-
## Identity and Access Management Authentication (IAM)
|
|
94
|
-
The `IamAuthenticator` will accept a user-supplied api key and will perform the necessary interactions with the IAM token service to obtain a suitable bearer token for the specified api key. The authenticator will also obtain a new bearer token when the current token expires. The bearer token is then added to each outbound request in the `Authorization` header in the form:
|
|
95
149
|
|
|
150
|
+
## Identity and Access Management Authentication (IAM)
|
|
151
|
+
The `IamAuthenticator` will accept a user-supplied api key and will perform
|
|
152
|
+
the necessary interactions with the IAM token service to obtain a suitable
|
|
153
|
+
bearer token for the specified api key. The authenticator will also obtain
|
|
154
|
+
a new bearer token when the current token expires. The bearer token is
|
|
155
|
+
then added to each outbound request in the `Authorization` header in the
|
|
156
|
+
form:
|
|
96
157
|
```
|
|
97
158
|
Authorization: Bearer <bearer-token>
|
|
98
159
|
```
|
|
99
160
|
|
|
100
161
|
### Properties
|
|
162
|
+
|
|
101
163
|
- apikey: (required) the IAM api key
|
|
102
|
-
|
|
103
|
-
-
|
|
104
|
-
|
|
105
|
-
|
|
164
|
+
|
|
165
|
+
- url: (optional) The base endpoint URL of the IAM token service.
|
|
166
|
+
The default value of this property is the "prod" IAM token service endpoint
|
|
167
|
+
(`https://iam.cloud.ibm.com`).
|
|
168
|
+
|
|
169
|
+
- clientId/clientSecret: (optional) The `clientId` and `clientSecret` fields are used to form a
|
|
170
|
+
"basic auth" Authorization header for interactions with the IAM token server. If neither field
|
|
171
|
+
is specified, then no Authorization header will be sent with token server requests. These fields
|
|
172
|
+
are optional, but must be specified together.
|
|
173
|
+
|
|
174
|
+
- scope: (optional) the scope to be associated with the IAM access token.
|
|
175
|
+
If not specified, then no scope wil be associated with the access token.
|
|
176
|
+
|
|
177
|
+
- disableSslVerification: (optional) A flag that indicates whether verificaton of the server's SSL
|
|
178
|
+
certificate should be disabled or not. The default value is `false`.
|
|
179
|
+
|
|
180
|
+
- headers: (optional) A set of key/value pairs that will be sent as HTTP headers in requests
|
|
181
|
+
made to the IAM token service.
|
|
106
182
|
|
|
107
183
|
### Programming example
|
|
108
184
|
```js
|
|
109
|
-
|
|
185
|
+
const { IamAuthenticator } = require('ibm-cloud-sdk-core');
|
|
186
|
+
const ExampleServiceV1 = require('<sdk-package-name>/example-service/v1');
|
|
110
187
|
|
|
111
188
|
const authenticator = new IamAuthenticator({
|
|
112
|
-
apikey: '
|
|
189
|
+
apikey: 'myapikey',
|
|
113
190
|
});
|
|
114
|
-
```
|
|
115
191
|
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
192
|
+
const options = {
|
|
193
|
+
authenticator,
|
|
194
|
+
};
|
|
119
195
|
|
|
120
|
-
|
|
121
|
-
// MY_SERVICE_AUTH_TYPE=iam
|
|
122
|
-
// MY_SERVICE_APIKEY=myapikey
|
|
123
|
-
const iamAuthenticator = getAuthenticatorFromEnvironment('my-service');
|
|
124
|
-
```
|
|
196
|
+
const service = new ExampleServiceV1(options);
|
|
125
197
|
|
|
126
|
-
|
|
127
|
-
|
|
198
|
+
// 'service' can now be used to invoke operations.
|
|
199
|
+
```
|
|
128
200
|
|
|
201
|
+
### Configuration example
|
|
202
|
+
External configuration:
|
|
129
203
|
```
|
|
130
|
-
|
|
204
|
+
export EXAMPLE_SERVICE_AUTH_TYPE=iam
|
|
205
|
+
export EXAMPLE_SERVICE_APIKEY=myapikey
|
|
131
206
|
```
|
|
132
|
-
|
|
133
|
-
### Properties
|
|
134
|
-
- username: (required) the username used to obtain a bearer token.
|
|
135
|
-
- password: (password or apikey required) the password used to obtain a bearer token.
|
|
136
|
-
- apikey: (password or apikey required) the API key used to obtain a bearer token.
|
|
137
|
-
- url: (required) The URL representing the Cloud Pak for Data token service endpoint.
|
|
138
|
-
- disableSslVerification: (optional) A flag that indicates whether verificaton of the server's SSL certificate should be disabled or not. The default value is `false`.
|
|
139
|
-
- headers: (optional) A set of key/value pairs that will be sent as HTTP headers in requests made to the IAM token service.
|
|
140
|
-
|
|
141
|
-
### Programming examples
|
|
207
|
+
Application code:
|
|
142
208
|
```js
|
|
143
|
-
|
|
209
|
+
const ExampleServiceV1 = require('<sdk-package-name>/example-service/v1');
|
|
144
210
|
|
|
145
|
-
const
|
|
146
|
-
|
|
147
|
-
|
|
148
|
-
url: '{url}',
|
|
149
|
-
});
|
|
150
|
-
```
|
|
211
|
+
const options = {
|
|
212
|
+
serviceName: 'example_service',
|
|
213
|
+
};
|
|
151
214
|
|
|
152
|
-
|
|
153
|
-
import { CloudPakForDataAuthenticator } from 'ibm-cloud-sdk-core';
|
|
215
|
+
const service = ExampleServiceV1.newInstance(options);
|
|
154
216
|
|
|
155
|
-
|
|
156
|
-
username: '{username}',
|
|
157
|
-
apikey: '{apikey}',
|
|
158
|
-
url: '{url}',
|
|
159
|
-
});
|
|
217
|
+
// 'service' can now be used to invoke operations.
|
|
160
218
|
```
|
|
161
219
|
|
|
162
|
-
### External configuration example
|
|
163
|
-
```js
|
|
164
|
-
import { getAuthenticatorFromEnvironment } from 'ibm-cloud-sdk-core';
|
|
165
|
-
|
|
166
|
-
// env vars
|
|
167
|
-
// MY_SERVICE_AUTH_TYPE=cp4d
|
|
168
|
-
// MY_SERVICE_AUTH_URL=<url>
|
|
169
|
-
// MY_SERVICE_USERNAME=<username>
|
|
170
|
-
// MY_SERVICE_PASSWORD=<password>
|
|
171
|
-
// MY_SERVICE_APIKEY=<apikey>
|
|
172
|
-
const cp4dAuthenticator = getAuthenticatorFromEnvironment('my-service');
|
|
173
|
-
```
|
|
174
220
|
|
|
175
|
-
## Container
|
|
221
|
+
## Container Authentication
|
|
176
222
|
The `ContainerAuthenticator` is intended to be used by application code
|
|
177
223
|
running inside a compute resource managed by the IBM Kubernetes Service (IKS)
|
|
178
224
|
in which a secure compute resource token (CR token) has been stored in a file
|
|
@@ -195,51 +241,189 @@ The IAM access token is added to each outbound request in the `Authorization` he
|
|
|
195
241
|
```
|
|
196
242
|
|
|
197
243
|
### Properties
|
|
198
|
-
|
|
199
|
-
-
|
|
200
|
-
|
|
201
|
-
|
|
202
|
-
|
|
203
|
-
-
|
|
204
|
-
|
|
244
|
+
|
|
245
|
+
- crTokenFilename: (optional) the name of the file containing the injected CR token value.
|
|
246
|
+
If not specified, then `/var/run/secrets/tokens/vault-token` is used as the default value.
|
|
247
|
+
The application must have `read` permissions on the file containing the CR token value.
|
|
248
|
+
|
|
249
|
+
- iamProfileName: (optional) the name of the linked trusted IAM profile to be used when obtaining the
|
|
250
|
+
IAM access token (a CR token might map to multiple IAM profiles).
|
|
251
|
+
One of `iamProfileName` or `iamProfileId` must be specified.
|
|
252
|
+
|
|
253
|
+
- iamProfileId: (optional) the id of the linked trusted IAM profile to be used when obtaining the
|
|
254
|
+
IAM access token (a CR token might map to multiple IAM profiles).
|
|
255
|
+
One of `iamProfileName` or `iamProfileId` must be specified.
|
|
256
|
+
|
|
257
|
+
- url: (optional) The base endpoint URL of the IAM token service.
|
|
258
|
+
The default value of this property is the "prod" IAM token service endpoint
|
|
259
|
+
(`https://iam.cloud.ibm.com`).
|
|
260
|
+
|
|
261
|
+
- clientId/clientSecret: (optional) The `clientId` and `clientSecret` fields are used to form a
|
|
262
|
+
"basic auth" Authorization header for interactions with the IAM token service. If neither field
|
|
263
|
+
is specified, then no Authorization header will be sent with token server requests. These fields
|
|
264
|
+
are optional, but must be specified together.
|
|
265
|
+
|
|
266
|
+
- scope: (optional) the scope to be associated with the IAM access token.
|
|
267
|
+
If not specified, then no scope will be associated with the access token.
|
|
268
|
+
|
|
269
|
+
- disableSslVerification: (optional) A flag that indicates whether verificaton of the server's SSL
|
|
270
|
+
certificate should be disabled or not. The default value is `false`.
|
|
271
|
+
|
|
272
|
+
- headers: (optional) A set of key/value pairs that will be sent as HTTP headers in requests
|
|
273
|
+
made to the IAM token service.
|
|
274
|
+
|
|
275
|
+
- crTokenFilename: (optional) The name of the file containing the injected CR token value.
|
|
276
|
+
If not specified, then `/var/run/secrets/tokens/vault-token` is used as the default value.
|
|
277
|
+
The application must have `read` permissions on the file containing the CR token value.
|
|
205
278
|
|
|
206
279
|
### Programming example
|
|
207
280
|
```js
|
|
208
|
-
|
|
281
|
+
const { ContainerAuthenticator } = require('ibm-cloud-sdk-core');
|
|
282
|
+
const ExampleServiceV1 = require('<sdk-package-name>/example-service/v1');
|
|
209
283
|
|
|
210
284
|
const authenticator = new ContainerAuthenticator({
|
|
211
|
-
iamProfileName: '
|
|
285
|
+
iamProfileName: 'iam-user123',
|
|
212
286
|
});
|
|
287
|
+
|
|
288
|
+
const options = {
|
|
289
|
+
authenticator,
|
|
290
|
+
};
|
|
291
|
+
|
|
292
|
+
const service = new ExampleServiceV1(options);
|
|
293
|
+
|
|
294
|
+
// 'service' can now be used to invoke operations.
|
|
213
295
|
```
|
|
214
296
|
|
|
215
|
-
###
|
|
297
|
+
### Configuration example
|
|
298
|
+
External configuration:
|
|
299
|
+
```
|
|
300
|
+
export EXAMPLE_SERVICE_AUTH_TYPE=container
|
|
301
|
+
export EXAMPLE_SERVICE_IAM_PROFILE_NAME=iam-user123
|
|
302
|
+
```
|
|
303
|
+
Application code:
|
|
216
304
|
```js
|
|
217
|
-
|
|
305
|
+
const ExampleServiceV1 = require('<sdk-package-name>/example-service/v1');
|
|
306
|
+
|
|
307
|
+
const options = {
|
|
308
|
+
serviceName: 'example_service',
|
|
309
|
+
};
|
|
310
|
+
|
|
311
|
+
const service = ExampleServiceV1.newInstance(options);
|
|
312
|
+
|
|
313
|
+
// 'service' can now be used to invoke operations.
|
|
314
|
+
```
|
|
315
|
+
|
|
218
316
|
|
|
219
|
-
|
|
220
|
-
|
|
221
|
-
|
|
222
|
-
|
|
317
|
+
## Cloud Pak for Data Authentication
|
|
318
|
+
The `CloudPakForDataAuthenticator` will accept a user-supplied username value, along with either a
|
|
319
|
+
password or apikey, and will
|
|
320
|
+
perform the necessary interactions with the Cloud Pak for Data token service to obtain a suitable
|
|
321
|
+
bearer token. The authenticator will also obtain a new bearer token when the current token expires.
|
|
322
|
+
The bearer token is then added to each outbound request in the `Authorization` header in the
|
|
323
|
+
form:
|
|
324
|
+
```
|
|
325
|
+
Authorization: Bearer <bearer-token>
|
|
223
326
|
```
|
|
327
|
+
### Properties
|
|
328
|
+
|
|
329
|
+
- username: (required) the username used to obtain a bearer token.
|
|
330
|
+
|
|
331
|
+
- password: (required if apikey is not specified) the user's password used to obtain a bearer token.
|
|
332
|
+
Exactly one of password or apikey should be specified.
|
|
333
|
+
|
|
334
|
+
- apikey: (required if password is not specified) the user's apikey used to obtain a bearer token.
|
|
335
|
+
Exactly one of password or apikey should be specified.
|
|
336
|
+
|
|
337
|
+
- url: (required) The URL representing the Cloud Pak for Data token service endpoint's base URL string.
|
|
338
|
+
This value should not include the `/v1/authorize` path portion.
|
|
339
|
+
|
|
340
|
+
- disableSslVerification: (optional) A flag that indicates whether verificaton of the server's SSL
|
|
341
|
+
certificate should be disabled or not. The default value is `false`.
|
|
342
|
+
|
|
343
|
+
- headers: (optional) A set of key/value pairs that will be sent as HTTP headers in requests
|
|
344
|
+
made to the Cloud Pak for Data token service.
|
|
345
|
+
|
|
346
|
+
### Programming examples
|
|
347
|
+
```js
|
|
348
|
+
const { CloudPakForDataAuthenticator } = require('ibm-cloud-sdk-core');
|
|
349
|
+
const ExampleServiceV1 = require('<sdk-package-name>/example-service/v1');
|
|
350
|
+
|
|
351
|
+
const authenticator = new CloudPakForDataAuthenticator({
|
|
352
|
+
username: 'myuser',
|
|
353
|
+
apikey: 'myapikey',
|
|
354
|
+
url: 'https://mycp4dhost.com',
|
|
355
|
+
});
|
|
356
|
+
|
|
357
|
+
const options = {
|
|
358
|
+
authenticator,
|
|
359
|
+
};
|
|
360
|
+
|
|
361
|
+
const service = new ExampleServiceV1(options);
|
|
362
|
+
|
|
363
|
+
// 'service' can now be used to invoke operations.
|
|
364
|
+
```
|
|
365
|
+
|
|
366
|
+
### Configuration example
|
|
367
|
+
External configuration:
|
|
368
|
+
```
|
|
369
|
+
# Configure "example_service" with username/apikey.
|
|
370
|
+
export EXAMPLE_SERVICE_AUTH_TYPE=cp4d
|
|
371
|
+
export EXAMPLE_SERVICE_USERNAME=myuser
|
|
372
|
+
export EXAMPLE_SERVICE_APIKEY=myapikey
|
|
373
|
+
export EXAMPLE_SERVICE_URL=https://mycp4dhost.com
|
|
374
|
+
```
|
|
375
|
+
Application code:
|
|
376
|
+
```js
|
|
377
|
+
const ExampleServiceV1 = require('<sdk-package-name>/example-service/v1');
|
|
378
|
+
|
|
379
|
+
const options = {
|
|
380
|
+
serviceName: 'example_service',
|
|
381
|
+
};
|
|
382
|
+
|
|
383
|
+
const service = ExampleServiceV1.newInstance(options);
|
|
384
|
+
|
|
385
|
+
// 'service' can now be used to invoke operations.
|
|
386
|
+
```
|
|
387
|
+
|
|
224
388
|
|
|
225
389
|
## No Auth Authentication
|
|
226
|
-
The `NoAuthAuthenticator` is a placeholder authenticator which performs no actual authentication function.
|
|
390
|
+
The `NoAuthAuthenticator` is a placeholder authenticator which performs no actual authentication function.
|
|
391
|
+
It can be used in situations where authentication needs to be bypassed, perhaps while developing
|
|
392
|
+
or debugging an application or service.
|
|
227
393
|
|
|
228
394
|
### Properties
|
|
229
395
|
None
|
|
230
396
|
|
|
231
397
|
### Programming example
|
|
232
398
|
```js
|
|
233
|
-
|
|
399
|
+
const { NoAuthAuthenticator } = require('ibm-cloud-sdk-core');
|
|
400
|
+
const ExampleServiceV1 = require('<sdk-package-name>/example-service/v1');
|
|
234
401
|
|
|
235
402
|
const authenticator = new NoAuthAuthenticator();
|
|
403
|
+
|
|
404
|
+
const options = {
|
|
405
|
+
authenticator,
|
|
406
|
+
};
|
|
407
|
+
|
|
408
|
+
const service = new ExampleServiceV1(options);
|
|
409
|
+
|
|
410
|
+
// 'service' can now be used to invoke operations.
|
|
236
411
|
```
|
|
237
412
|
|
|
238
|
-
###
|
|
413
|
+
### Configuration example
|
|
414
|
+
External configuration:
|
|
415
|
+
```
|
|
416
|
+
export EXAMPLE_SERVICE_AUTH_TYPE=noauth
|
|
417
|
+
```
|
|
418
|
+
Application code:
|
|
239
419
|
```js
|
|
240
|
-
|
|
420
|
+
const ExampleServiceV1 = require('<sdk-package-name>/example-service/v1');
|
|
421
|
+
|
|
422
|
+
const options = {
|
|
423
|
+
serviceName: 'example_service',
|
|
424
|
+
};
|
|
425
|
+
|
|
426
|
+
const service = ExampleServiceV1.newInstance(options);
|
|
241
427
|
|
|
242
|
-
//
|
|
243
|
-
// MY_SERVICE_AUTH_TYPE=noauth
|
|
244
|
-
const noAuthAuthenticator = getAuthenticatorFromEnvironment('my-service');
|
|
428
|
+
// 'service' can now be used to invoke operations.
|
|
245
429
|
```
|
package/CHANGELOG.md
CHANGED
|
@@ -1,3 +1,10 @@
|
|
|
1
|
+
# [2.16.0](https://github.com/IBM/node-sdk-core/compare/v2.15.1...v2.16.0) (2021-10-20)
|
|
2
|
+
|
|
3
|
+
|
|
4
|
+
### Features
|
|
5
|
+
|
|
6
|
+
* add support for retrieving refresh tokens from iam-based authenticators ([#173](https://github.com/IBM/node-sdk-core/issues/173)) ([e7f11fc](https://github.com/IBM/node-sdk-core/commit/e7f11fce7bbbfff1273c289b9e9b8fba27c705dc))
|
|
7
|
+
|
|
1
8
|
## [2.15.1](https://github.com/IBM/node-sdk-core/compare/v2.15.0...v2.15.1) (2021-10-15)
|
|
2
9
|
|
|
3
10
|
|
|
@@ -55,13 +55,6 @@ export declare class IamAuthenticator extends IamRequestBasedAuthenticator {
|
|
|
55
55
|
* @throws {Error} When the configuration options are not valid.
|
|
56
56
|
*/
|
|
57
57
|
constructor(options: Options);
|
|
58
|
-
/**
|
|
59
|
-
* Return the most recently stored refresh token.
|
|
60
|
-
*
|
|
61
|
-
* @public
|
|
62
|
-
* @returns {string}
|
|
63
|
-
*/
|
|
64
|
-
getRefreshToken(): string;
|
|
65
58
|
/**
|
|
66
59
|
* Returns the authenticator's type ('iam').
|
|
67
60
|
*
|
|
@@ -74,15 +74,6 @@ var IamAuthenticator = /** @class */ (function (_super) {
|
|
|
74
74
|
_this.tokenManager = new token_managers_1.IamTokenManager(options);
|
|
75
75
|
return _this;
|
|
76
76
|
}
|
|
77
|
-
/**
|
|
78
|
-
* Return the most recently stored refresh token.
|
|
79
|
-
*
|
|
80
|
-
* @public
|
|
81
|
-
* @returns {string}
|
|
82
|
-
*/
|
|
83
|
-
IamAuthenticator.prototype.getRefreshToken = function () {
|
|
84
|
-
return this.tokenManager.getRefreshToken();
|
|
85
|
-
};
|
|
86
77
|
/**
|
|
87
78
|
* Returns the authenticator's type ('iam').
|
|
88
79
|
*
|
|
@@ -74,4 +74,11 @@ export declare class IamRequestBasedAuthenticator extends TokenRequestBasedAuthe
|
|
|
74
74
|
* @param {string} scope A space seperated string that makes up the scope parameter
|
|
75
75
|
*/
|
|
76
76
|
setScope(scope: string): void;
|
|
77
|
+
/**
|
|
78
|
+
* Return the most recently stored refresh token.
|
|
79
|
+
*
|
|
80
|
+
* @public
|
|
81
|
+
* @returns {string}
|
|
82
|
+
*/
|
|
83
|
+
getRefreshToken(): string;
|
|
77
84
|
}
|
|
@@ -88,6 +88,15 @@ var IamRequestBasedAuthenticator = /** @class */ (function (_super) {
|
|
|
88
88
|
// update properties in token manager
|
|
89
89
|
this.tokenManager.setScope(scope);
|
|
90
90
|
};
|
|
91
|
+
/**
|
|
92
|
+
* Return the most recently stored refresh token.
|
|
93
|
+
*
|
|
94
|
+
* @public
|
|
95
|
+
* @returns {string}
|
|
96
|
+
*/
|
|
97
|
+
IamRequestBasedAuthenticator.prototype.getRefreshToken = function () {
|
|
98
|
+
return this.tokenManager.getRefreshToken();
|
|
99
|
+
};
|
|
91
100
|
return IamRequestBasedAuthenticator;
|
|
92
101
|
}(token_request_based_authenticator_1.TokenRequestBasedAuthenticator));
|
|
93
102
|
exports.IamRequestBasedAuthenticator = IamRequestBasedAuthenticator;
|
|
@@ -31,6 +31,7 @@ export declare class IamRequestBasedTokenManager extends JwtTokenManager {
|
|
|
31
31
|
private clientId;
|
|
32
32
|
private clientSecret;
|
|
33
33
|
private scope;
|
|
34
|
+
protected refreshToken: string;
|
|
34
35
|
protected formData: any;
|
|
35
36
|
/**
|
|
36
37
|
*
|
|
@@ -71,6 +72,22 @@ export declare class IamRequestBasedTokenManager extends JwtTokenManager {
|
|
|
71
72
|
* @returns {void}
|
|
72
73
|
*/
|
|
73
74
|
setClientIdAndSecret(clientId: string, clientSecret: string): void;
|
|
75
|
+
/**
|
|
76
|
+
* Return the most recently stored refresh token.
|
|
77
|
+
*
|
|
78
|
+
* @public
|
|
79
|
+
* @returns {string}
|
|
80
|
+
*/
|
|
81
|
+
getRefreshToken(): string;
|
|
82
|
+
/**
|
|
83
|
+
* Extend this method from the parent class to extract the refresh token from
|
|
84
|
+
* the request and save it.
|
|
85
|
+
*
|
|
86
|
+
* @param tokenResponse - Response object from JWT service request
|
|
87
|
+
* @protected
|
|
88
|
+
* @returns {void}
|
|
89
|
+
*/
|
|
90
|
+
protected saveTokenInfo(tokenResponse: any): void;
|
|
74
91
|
/**
|
|
75
92
|
* Request an IAM token using an API key.
|
|
76
93
|
*
|
|
@@ -115,6 +115,30 @@ var IamRequestBasedTokenManager = /** @class */ (function (_super) {
|
|
|
115
115
|
logger_1.default.warn(CLIENT_ID_SECRET_WARNING);
|
|
116
116
|
}
|
|
117
117
|
};
|
|
118
|
+
/**
|
|
119
|
+
* Return the most recently stored refresh token.
|
|
120
|
+
*
|
|
121
|
+
* @public
|
|
122
|
+
* @returns {string}
|
|
123
|
+
*/
|
|
124
|
+
IamRequestBasedTokenManager.prototype.getRefreshToken = function () {
|
|
125
|
+
return this.refreshToken;
|
|
126
|
+
};
|
|
127
|
+
/**
|
|
128
|
+
* Extend this method from the parent class to extract the refresh token from
|
|
129
|
+
* the request and save it.
|
|
130
|
+
*
|
|
131
|
+
* @param tokenResponse - Response object from JWT service request
|
|
132
|
+
* @protected
|
|
133
|
+
* @returns {void}
|
|
134
|
+
*/
|
|
135
|
+
IamRequestBasedTokenManager.prototype.saveTokenInfo = function (tokenResponse) {
|
|
136
|
+
_super.prototype.saveTokenInfo.call(this, tokenResponse);
|
|
137
|
+
var responseBody = tokenResponse.result || {};
|
|
138
|
+
if (responseBody.refresh_token) {
|
|
139
|
+
this.refreshToken = responseBody.refresh_token;
|
|
140
|
+
}
|
|
141
|
+
};
|
|
118
142
|
/**
|
|
119
143
|
* Request an IAM token using an API key.
|
|
120
144
|
*
|
|
@@ -25,7 +25,6 @@ interface Options extends IamRequestOptions {
|
|
|
25
25
|
*/
|
|
26
26
|
export declare class IamTokenManager extends IamRequestBasedTokenManager {
|
|
27
27
|
protected requiredOptions: string[];
|
|
28
|
-
protected refreshToken: string;
|
|
29
28
|
private apikey;
|
|
30
29
|
/**
|
|
31
30
|
*
|
|
@@ -46,21 +45,5 @@ export declare class IamTokenManager extends IamRequestBasedTokenManager {
|
|
|
46
45
|
* @constructor
|
|
47
46
|
*/
|
|
48
47
|
constructor(options: Options);
|
|
49
|
-
/**
|
|
50
|
-
* Return the most recently stored refresh token.
|
|
51
|
-
*
|
|
52
|
-
* @public
|
|
53
|
-
* @returns {string}
|
|
54
|
-
*/
|
|
55
|
-
getRefreshToken(): string;
|
|
56
|
-
/**
|
|
57
|
-
* Extend this method from the parent class to extract the refresh token from
|
|
58
|
-
* the request and save it.
|
|
59
|
-
*
|
|
60
|
-
* @param tokenResponse - Response object from JWT service request
|
|
61
|
-
* @protected
|
|
62
|
-
* @returns {void}
|
|
63
|
-
*/
|
|
64
|
-
protected saveTokenInfo(tokenResponse: any): void;
|
|
65
48
|
}
|
|
66
49
|
export {};
|
|
@@ -66,30 +66,6 @@ var IamTokenManager = /** @class */ (function (_super) {
|
|
|
66
66
|
_this.formData.response_type = 'cloud_iam';
|
|
67
67
|
return _this;
|
|
68
68
|
}
|
|
69
|
-
/**
|
|
70
|
-
* Return the most recently stored refresh token.
|
|
71
|
-
*
|
|
72
|
-
* @public
|
|
73
|
-
* @returns {string}
|
|
74
|
-
*/
|
|
75
|
-
IamTokenManager.prototype.getRefreshToken = function () {
|
|
76
|
-
return this.refreshToken;
|
|
77
|
-
};
|
|
78
|
-
/**
|
|
79
|
-
* Extend this method from the parent class to extract the refresh token from
|
|
80
|
-
* the request and save it.
|
|
81
|
-
*
|
|
82
|
-
* @param tokenResponse - Response object from JWT service request
|
|
83
|
-
* @protected
|
|
84
|
-
* @returns {void}
|
|
85
|
-
*/
|
|
86
|
-
IamTokenManager.prototype.saveTokenInfo = function (tokenResponse) {
|
|
87
|
-
_super.prototype.saveTokenInfo.call(this, tokenResponse);
|
|
88
|
-
var responseBody = tokenResponse.result || {};
|
|
89
|
-
if (responseBody.refresh_token) {
|
|
90
|
-
this.refreshToken = responseBody.refresh_token;
|
|
91
|
-
}
|
|
92
|
-
};
|
|
93
69
|
return IamTokenManager;
|
|
94
70
|
}(iam_request_based_token_manager_1.IamRequestBasedTokenManager));
|
|
95
71
|
exports.IamTokenManager = IamTokenManager;
|