19.6. Configuring short-lived access

Procedure

1. In the RHACS portal, go to Platform Configuration Integrations.
2. Scroll to the Authentication Tokens category, and then click Machine access configuration.
3. Click Create configuration.

4. Select the configuration type, choosing one of the following:

   • Generic if you use an arbitrary OIDC identity token issuer.
   • GitHub Actions if you plan to access RHACS from GitHub Actions.
5. Enter the OIDC identity token issuer.

6. Enter the token lifetime for tokens issued by the configuration.

   注意

   The format for the token lifetime is XhYmZs and you cannot set it for longer than 24 hours.

7. Add rules to the configuration:

   • The Key is the OIDC token’s claim to use.
   • The Value is the expected OIDC token claim value.

   • The Role is the role to assign to the token if the OIDC token claim and value exist.

     注意

     Rules are similar to Authentication Provider rules to assign roles based on claim values.

     As a general rule, Red Hat recommends to use unique, immutable claims within Rules. The general recommendation is to use the sub claim within the OIDC identity token. For more information about OIDC token claims, see the list of standard OIDC claims.

8. Click Save.

Procedure

1. Prepare the POST request’s JSON data:

   {
       "idToken": "<id_token>"
   }

2. Send a POST request to the API /v1/auth/m2m/exchange.

3. Wait for the API response:

   {
       "accessToken": "<access_token>"
   }

4. Use the returned access token to access the RHACS instance.