See if we can only procure vault token

[shreyb]

There's a --nobearertoken option or something like that for HTGETTOKEN. See if we can use that to not get bearer tokens at all. This will be a lot easier to investigate once #5 is done.

[shreyb]

This is very strange - if I ask for --nobearertoken, I don't get a vault token either:

[sbhat@fermicloud525 ~]$ kinit -k -t /path/to/keytab.keytab testuser/kerberos@PRINCIPAL.DOMAIN
[sbhat@fermicloud525 ~]$ export HTGETTOKENOPTS="--credkey=correct_credkey --nobearertoken"
[sbhat@fermicloud525 ~]$ htgettoken -a htvaultprod.fnal.gov -i mu2e -r production -v
Initializing kerberos client for host@htvaultprod.fnal.gov
Negotiating kerberos with https://htvaultprod.fnal.gov:8200
  at path auth/kerberos-mu2e_production
Connecting to 131.225.110.229
Attempting to get bearer token from https://htvaultprod.fnal.gov:8200
[sbhat@fermicloud525 ~]$ ls /tmp/vt*
ls: cannot access /tmp/vt*: No such file or directory

So there's no vault token either. If I take out --nobearertoken, then it gets both the vault and bearer token:

<re-export HTGETTOKENOPTS to exclude --nobearertoken>
[sbhat@fermicloud525 ~]$ htgettoken -a htvaultprod.fnal.gov -i mu2e -r production -v
Initializing kerberos client for host@htvaultprod.fnal.gov
Negotiating kerberos with https://htvaultprod.fnal.gov:8200
  at path auth/kerberos-mu2e_production
Connecting to 131.225.110.229
Attempting to get bearer token from https://htvaultprod.fnal.gov:8200
  at path SECRET_PATH
Storing vault token in /tmp/vt_u10610
Storing bearer token in /run/user/10610/bt_u10610

[shreyb]

This seems to work now with a current htgettoken:

[testuser@host ~]$ kinit -k -t /path/to/keytab.keytab userPrincipal@REALM
[testuser@host ~]$ export HTGETTOKENOPTS="--credkey=CORRECT_CREDKEY -r ROLE -i ISSUER -a VAULTSERVER --nobearertoken"
[testuser@host ~]$ htgettoken --vaulttokenfile=/tmp/test_vt_testuser
Attempting kerberos auth with VAULTSERVER:PORT ... succeeded
Storing vault token in /tmp/test_vt_testuser
[testuser@host ~]$ ls /tmp/test_vt_testuser
/tmp/test_vt_testuser


# GOOD. THIS IS WHAT WE EXPECT
# Now check that the bearer token we can get with this vault token is a good one

[testuser@host ~]$ export HTGETTOKENOPTS="--credkey=CORRECT_CREDKEY -r ROLE -i ISSUER -a VAULTSERVER"
[testuser@host ~]$ htgettoken --vaulttokenfile=/tmp/test_vt_testuser -o /tmp/test_bt_testuser
Attempting to get token from VAULTSERVER:PORT ... succeeded
Storing bearer token in /tmp/test_bt_testuser
[testuser@host ~]$ httokendecode -H /tmp/test_bt_testuser
{
GOOD TOKEN
}
[testuser@host ~]$

[shreyb]

This might still be a non-starter, because condor_vault_storer will still need the bearer token to authenticate to the condor credd:

fermitools/htgettoken#81 (comment)