When VerificationURIComplete is present in the device authorization
response, the user code is already embedded in the URI. Printing
the code separately is redundant and potentially confusing.
This suppresses the code prompt in that case and shows only the
complete URI.
This is related to https://github.com/smallstep/cli/pull/1430, and
the behavior is in line with `kubelogin`
Change-Type: behavior
Release-Note: yes
Audience: user
Impact: low
Breaking: false
This command allows use use KMS URIs without using the `--kms` flag.
Those commands using cryptoutils package will read a key from a KMS if
the name is not a file and is one of the supported KMS types.
This commit suppresses the message "certificate does not need renewal"
on the `step certificate needs-renewal` and `step ssh needs-renewal`
unless the `--verbose` flag is passed.
The ACME-DA flow in the step ca certificate command expects all KMS parameters
to be provided through the `--attestation-uri` flag. Using the `--kms` flag at the
same time can lead to errors. For example, if the YubiKey PIN is set with the
`--kms` flag, the flow will ignore it and use the default one instead, resulting
in a PIN retry error.
Fixes#1492
This commit adds the `--pkix` flag to `step crypto key fingerprint` command.
This flag and the PKIX encoding of the key instead of the X.509 subjectPublicKey
format.
In the OIDC Device Authorization Flow in command/oauth, present the user
with VerificationURIComplete rather than VerificationURI if present, so
that the user doesn't have to manually type the code when using an IdP
that provides this feature.
Fixes#1424
This PR fixes the following issues:
- SCEP provisioners not detected in admin token flows
- Invalid provisioner selection logic when managing provisioner policies
- Unexpected error messages showing "issuer" instead or "provisioner" flag
- min-encryption-password-length
- provisioner
Enforce min-encryption-password-length, if set, in the 'step ssh
certificate' command.
Add flags.FirstStringOf returns value of first defined flag in input list
Add the `--set` and `--set-file` flags to the `step ca token` command,
allowing the user to set keys in the "user" claim in the resulting JWT.
Signed-off-by: Dan Fuhry <dan@fuhry.com>
