Skip to content

profile command group

profile manages the {{ product_name }} alpine-admin-cli connection state on the local machine. It has two subgroups: profile hosts describes where to connect (the gRPC endpoint, TLS material, and timeouts), and profile authn describes how to authenticate (OIDC logins whose tokens are sealed on disk). Every command in this group is local and offline: it reads and writes files only and never contacts a server.

Local, pre-connection commands

profile hosts and profile authn are the only command groups (besides init) that need no prior profile authn login. Every other alpine-admin-cli command is a remote gRPC client and requires both a host profile (profile hosts create) and an authenticated login (profile authn login).

Local profile model

The CLI stores two kinds of artifact under ${HOME}/.config/alpinepki/:

Artifact Location Managed by Contents
Host connection profile ${HOME}/.config/alpinepki/hosts/ profile hosts gRPC host/port, plaintext flag, per-call and termination timeouts, optional TLS trust anchors and mTLS client certificate/key (stored as file paths, not bytes), optional description
OIDC login Embedded in the host profile under ${HOME}/.config/alpinepki/hosts/ profile authn Named OIDC client configuration (issuer, client id, flow, scopes) plus sealed access/refresh tokens; an optional stored seal PIN for automation

A host profile can hold several named OIDC logins, so a single endpoint is never duplicated per identity. Secrets are always redacted in command output, and tokens are sealed with a PIN you enter at login time.

Commands in this group

Command Purpose Reference
profile hosts Manage gRPC host connection profiles (endpoint, TLS, timeouts) profile hosts
profile authn Manage the embedded OIDC logins of a host profile profile authn

profile hosts subcommands

Command Purpose
profile hosts create Create a new host connection profile
profile hosts update Update an existing host connection profile (partial)
profile hosts delete Delete a host connection profile
profile hosts list List all host connection profiles
profile hosts view View a single host connection profile
profile hosts set-default Mark a host profile as the default connection

profile authn subcommands

Command Purpose
profile authn login Log in via OIDC (device code or PKCE) and store sealed tokens on a host login
profile authn view View a named OIDC login of a host profile
profile authn logout Clear stored tokens of a named OIDC login (keep its config)
profile authn delete Remove a named OIDC login from a host profile
profile authn list List the OIDC logins of a host profile
profile authn set-default Select the default OIDC login used to authenticate against a host

Typical lifecycle

  1. Create a host profile that points at the gRPC endpoint:

    bin/admin.sh profile hosts create \
  -n default-admin \
  --host pki.example.com \
  --port 8443 \
  --trust-anchors ./server-ca.pem \
  -f yaml

  2. Log in with OIDC and seal the tokens onto a named login of that host. You are prompted for a seal PIN:

    bin/admin.sh profile authn login \
  -n default-admin \
  --login admin \
  --oidc-issuer https://idp.example.com/realms/alpine \
  --oidc-client-id alpine-admin-cli \
  --oidc-flow DEVICE_CODE \
  -f yaml

  3. Select the default login so server-backed commands know which identity to present:

    bin/admin.sh profile authn set-default -n default-admin --login admin

  4. Run server-backed commands. They reuse the default host profile and its default login automatically; the sealed access token is refreshed on demand and sent as the bearer credential.

Selecting a profile for one command

The global -p/--profile option (default default-admin) chooses the host profile for a single invocation and is placed before the command path, for example bin/admin.sh -p staging tenant list. See Global options.

Group help

bin/admin.sh profile --help
bin/admin.sh profile hosts --help
bin/admin.sh profile authn --help

Standard CLI options are documented in Global options.

FAQ

Do profile hosts and profile authn commands contact the server?

No. Every command in the profile group is local and offline. It only reads and writes files under ${HOME}/.config/alpinepki/. Only the subsequent server-backed commands open a gRPC connection.

Where are host profiles and OIDC logins stored?

Host connection profiles — including their embedded OIDC logins — are stored under ${HOME}/.config/alpinepki/hosts/. Each login is held inside its host profile, and its OIDC tokens are sealed with a PIN; secrets are redacted from command output.

What is the difference between a host profile and an OIDC login?

A host profile (profile hosts) describes the gRPC endpoint, TLS material, and timeouts. An OIDC login (profile authn) describes an authenticated identity for that endpoint. One host profile can hold several named logins, and profile authn set-default chooses which one authenticates server-backed commands.

Can I store the seal PIN for unattended automation?

Yes. Pass --store-pin to profile authn login to persist the seal PIN in the profile. This is less secure and is intended only for automation contexts.