Implement support for Client Credentials flow
m-mohr opened this issue · comments
The OIDC client credentials flow for long machine-to-machine workflows would be nice.
Can probably be supported through req_oauth_client_credentials in httr2
USGS is seeking to automate daily Sentinel-1 and -2 imagery access to support wildlife management at remote sites across the Pacific Arctic.
I understand that a (semi-)automated workflow is available within the python data access toolset (https://open-eo.github.io/openeo-python-client/auth.html#oidc-authentication-dynamic-method-selection).
However, the USGS IT security environment limits our ability to use python for these automated processes.
Please advise if this workflow may be advanced for the r scripting environment.
Yes, implementing the Clients Credentials Flow should be possible, but we have no funding to implement new features at the moment. PRs are also welcome, of course. Don't forget that the Flow also needs to be supported by the backend that you plan to connect to.
For contractual information please see https://mohr.ws/contracting.html
This should be a fairly small task (1-2 days).
Could you please let me know which backend you plan to work against? Is it a public one such as CDSE for example? Have you ensured that they support the Client Credentials Flow? Thanks.
@soxofaan As you asked recently about this for the Web Editor, would this also be of interest to VITO/CDSE/...?
hmm I don't think we already had R users that requested client credentials.
However, the USGS IT security environment limits our ability to use python for these automated processes.
Please advise if this workflow may be advanced for the r scripting environment.
@afischbach
If you are working in constrained environments like this, I also like to point out that you don't have to use any of the official openeo client libraries to interact with an openeo backend. You basically just need a tool or language that can do HTTP requests. Resolving the client credentials is essentially also just a single HTTP request.
Obviously you have to do some more work that the official openeo clients do for you. But you could prepare a lot in advance outside of the constrained environment, with the tech of your choice, e.g. to produce process graph templates. At run time you then just have to fill in some placeholders and do a couple of HTTP requests.
I probably make it sound easier than it is, but I just wanted to point out that this is an option to consider if you have the resources to do that.