Generate a token using puppet-access

Use the puppet-access command to generate an authentication tokens from the command line of any workstation (Puppet-managed or not), without the need to SSH into the primary server.

Before you begin:
Install the PE client tools package and Configure puppet-access.

For information about modifying commands for Windows and privilege escalation, refer to Using example commands and Commands with elevated privileges.

  1. Choose one of the following options, depending on how long you need your token to last:
    • To generate a token with the default one-hour lifetime, run:
      sudo puppet-access login
    • To generate a token with a specific lifetime, run:
      sudo puppet-access login --lifetime <TIME_PERIOD>

      For example, to generate a token that lasts five hours, run:

      puppet-access login --lifetime 5h
  2. When prompted, enter the user name and password that you use to log into the PE console.
Results

The puppet-access command uses RBAC API v1 Tokens endpoints. If your login credentials are correct, the RBAC service generates a token.

The token is generated and stored in a file for later use. The default token storage location is ~/.puppetlabs/token. You can print the token at any time, such as in curl commands, by using puppet-access show.

You can continue to use this token until it expires, or until your access is revoked. The token has the same permissions as the user that generated it.

If you run the login command with the --debug flag, the client outputs the token, as well as the username and password. For security reasons, exercise caution when using the --debug flag with the login command.
If a remote user generates a token, and the user is then deleted from your external directory service, the deleted user cannot log into the console. However, because the token has already been authenticated, the RBAC service does not contact the external directory service again when the token is used in the future. To fully remove the token's access, you need to manually revoke or delete the user from PE.

Related information