htgettoken gets OIDC bearer access tokens by interacting with a
Hashicorp vault server configured for retrieving and storing OIDC
refresh tokens using the
htvault-config package.
For details on its usage please see the man page.
Packaging for Red Hat Enterprise Linux systems is included. Rpms are distributed in the Open Science Grid yum repositories. After enabling the OSG repositories, do this as root to install it:
yum install htgettoken
htgettoken and Vault are also integrated with HTCondor. It is currently available in htcondor-9.0.x in the OSG 3.5 osg-upcoming yum repository, in the OSG 3.6 osg yum repository, and in htcondor's own version 9.0.6 and later.
See this paper submitted to vCHEP 2021 for a description of htgettoken, htvault-config, and their HTCondor integration.
An additional small script called httokendecode is bundled with
htgettoken. It decodes JSON Web Tokens that it finds either according
to a given filename (- for stdin) or based on the
WLCG Bearer Token Discovery
standard if no filename is given.