Skip to content

profile authn

profile authn manages the OIDC client logins embedded in a {{ product_name }} host connection profile. Each host profile created with profile hosts create can hold several named OIDC logins; profile authn login runs the interactive OIDC flow (device code or PKCE) and stores the resulting tokens, sealed with AES-GCM, on that host.

These commands run entirely on the local machine. Host connection profiles — including their embedded OIDC logins (with PIN-sealed tokens) — are stored under ${HOME}/.config/alpinepki/hosts/. No server connection is required, so unlike server-touching commands they do not need a prior login themselves.

When you need a login

The {{ product_name }} admin CLI is a remote gRPC client. Server-touching commands require both a host profile (from profile hosts create) and an authenticated login created here with profile authn login. The only commands that need no prior login are init and the local profile hosts / profile authn commands.

Commands in this group

Command Purpose
profile authn login Run the OIDC flow and store sealed tokens on a host login
profile authn view Display a single named OIDC login (redacted)
profile authn logout Clear stored tokens of a login, keep its config
profile authn delete Remove a named OIDC login from a host profile
profile authn list List the OIDC logins of a host profile
profile authn set-default Select the default OIDC login used for a host

Command group help

bin/admin.sh profile authn --help

profile authn login

Run an OIDC client login (RFC 8628 device code, or authorization code with PKCE) against the configured issuer and store the resulting tokens on a named login of a host profile. The tokens are sealed with AES-GCM using a PIN you enter at the prompt.

Syntax

bin/admin.sh profile authn login [options]

Required options

Option Description
-n, --name Host connection profile name
--login OIDC login name within the host profile (for example admin)
--oidc-issuer OIDC issuer URL (the IdP endpoint)
--oidc-client-id OIDC client id (public client)

Optional options

Show optional options
Option Default Description
--oidc-flow DEVICE_CODE OIDC login flow: DEVICE_CODE or AUTH_CODE_PKCE
--oidc-scope openid,profile,offline_access Comma-separated OIDC scopes; keep offline_access to obtain a refresh token
--store-pin off Persist the seal PIN in the profile (automation; less secure)
-f, --out-format YAML Output format: JSON or YAML

--store-pin security tradeoff

By default the AES-GCM seal PIN is requested interactively each time the tokens must be unsealed, so the PIN never lands on disk. Passing --store-pin writes the PIN into the host profile alongside the sealed tokens so unattended automation can refresh without a prompt. This removes the protection the PIN provides: anyone who can read the profile file can unseal the tokens. Use it only on tightly controlled automation hosts.

Validation rules

  • --login must be a valid login name; the name is the on-disk key for the login within the host profile.
  • --oidc-issuer and --oidc-client-id must not be blank.
  • The host profile named by -n/--name must already exist (create it first with profile hosts create).
  • The flow value is one of DEVICE_CODE or AUTH_CODE_PKCE; PKCE uses a dynamic loopback callback, so no redirect-uri option is needed.

Example (device-code login)

bin/admin.sh profile authn login \
  -n default-admin \
  --login admin \
  --oidc-issuer https://idp.example.com/realms/alpine \
  --oidc-client-id alpine-admin-cli \
  --oidc-flow DEVICE_CODE \
  --oidc-scope openid,profile,offline_access \
  -f json

Example (PKCE login for unattended automation)

bin/admin.sh profile authn login \
  -n ci-runner \
  --login automation \
  --oidc-issuer https://idp.example.com/realms/alpine \
  --oidc-client-id alpine-admin-cli \
  --oidc-flow AUTH_CODE_PKCE \
  --store-pin \
  -f yaml

profile authn view

Print a single named OIDC login of a host profile, including its client configuration and token status, with secrets redacted.

Syntax

bin/admin.sh profile authn view [options]

Required options

Option Description
-n, --name Host connection profile name
--login OIDC login name within the host profile

Optional options

Show optional options
Option Default Description
-f, --out-format YAML Output format: JSON or YAML

Example

bin/admin.sh profile authn view -n default-admin --login admin -f json

profile authn logout

Clear the stored tokens (and any stored PIN) of a named OIDC login while keeping its client configuration, so you can log in again later without re-entering the OIDC parameters. If the login is the host's default login, the default-login pointer is cleared too, so the host does not silently fall back to token-less authentication.

Syntax

bin/admin.sh profile authn logout [options]

Required options

Option Description
-n, --name Host connection profile name
--login OIDC login name within the host profile

Optional options

Show optional options
Option Default Description
-f, --out-format YAML Output format: JSON or YAML

Example

bin/admin.sh profile authn logout -n default-admin --login admin -f yaml

profile authn delete

Remove a named OIDC login (its configuration and tokens) from a host profile, leaving the host endpoint intact. If the deleted login was the host's default login, the default-login pointer is cleared.

Syntax

bin/admin.sh profile authn delete [options]

Required options

Option Description
-n, --name Host connection profile name
--login OIDC login name within the host profile

Optional options

Show optional options
Option Default Description
-f, --out-format YAML Output format: JSON or YAML

Example

bin/admin.sh profile authn delete -n default-admin --login old-login -f json

profile authn list

List the OIDC logins configured on a host profile, with secrets redacted.

Syntax

bin/admin.sh profile authn list [options]

Required options

Option Description
-n, --name Host connection profile name

Optional options

Show optional options
Option Default Description
-f, --out-format YAML Output format: JSON or YAML

Example

bin/admin.sh profile authn list -n default-admin -f json

profile authn set-default

Select which OIDC login a host uses to authenticate server-backed commands. The selected login's access token (refreshed on demand) is sent as the bearer credential by the SDK when this host is the active host profile.

Syntax

bin/admin.sh profile authn set-default [options]

Required options

Option Description
-n, --name Host connection profile name
--login OIDC login name to set as the host default

Optional options

Show optional options
Option Default Description
-f, --out-format YAML Output format: JSON or YAML

Example

bin/admin.sh profile authn set-default -n default-admin --login admin -f yaml

Standard CLI options, including the global -p/--profile host selector, are documented in Global options.

FAQ

Which option selects the host profile for profile authn commands?

The command-local -n/--name option selects the host profile that the login belongs to. The global -p/--profile flag selects the default host for one-shot server commands and is placed before the command path.

How are the OIDC tokens protected on disk?

The tokens are sealed with AES-GCM using a PIN you enter at the prompt during profile authn login. The PIN is not stored unless you pass --store-pin.

What is the difference between profile authn logout and profile authn delete?

logout clears the stored tokens but keeps the login's OIDC configuration so you can log in again. delete removes the entire named login from the host profile.

Which OIDC login flows are supported?

DEVICE_CODE (RFC 8628 device authorization grant) and AUTH_CODE_PKCE (authorization code with PKCE and a dynamic loopback redirect). Select one with --oidc-flow; the default is DEVICE_CODE.