[Feature request] Import clients on startup

[janekolszak]

Can we have an option to import clients when hydra's starting? Something like:

hydra host --import clients.json

and clients.json:

[
{ client_1},
{ client_2}
]

There's hydra clients import client.json, but it needs client's credentials and I don't want to paste this every time from command line.

Use case:

• On hydra's startup I need to add couple of predefined clients for IDPs and have hydra add them to the database.
• On next startup hydra should ensure that all clients from the list are present, possibly update the configuration.

[aeneasr]

what rights should the imported clients have?

[janekolszak]

You mean scopes?

[aeneasr]

by default, clients aren't allowed to read/write json web keys, create new clients, ...

[janekolszak]

Oh, I thought that's the "hydra" scope. Of course I need those rights to be added to the imported clients. Those are the clients for the IDP instances.

hydra host --idp idp_clients.json

and idp_clients.json:

[
{ client_1},
{ client_2}
]

Alll other clients that don't need admin rights will be created with hydra clients import.

[aeneasr]

we should figure out some better semantics - --idp doesn't really imply that it's an administrative account. i also don't really like the idea of the file being looked up on every host boot. wouldn't it be enough to specify the id and secret on first boot?

[aeneasr]

something like:

FORCE_CLIENT_CREDENTIALS=base64(foo:bar) hydra host

[janekolszak]

If this client is only described by id/secret then a file is pointless and parameters will leak via /proc.

So maybe good old env variable checked when client is starting?

[aeneasr]

Ok just to check - so this would be fine for you?

FORCE_CLIENT_CREDENTIALS=base64(foo:bar) hydra host

[janekolszak]

• What's the base64 function? You mean base64 of id:secret?
• hydra host are the scopes?

[aeneasr]

What's the base64 function? You mean base64 of id:secret?

Yes, base64 of id:secret. Thought it might help with binary passwords.

hydra host are the scopes?

No, that's the hydra host command! In Unix you can set environment variables per process with KEY=VALUE <command>

[janekolszak]

Oh yes, sorry. Looked like a peculiar env export :)
It's ok. I will define that in docker-compose file.

I don't think accepting binary passwords is worth the extra function invocation.
People will get confused (yet another step, just to pass the temporary, most probably developer credentials)

[janekolszak]

And with base64() I won't be able to fit this into docker-compose file...

[aeneasr]

I don't think accepting binary passwords is worth the extra function invocation.
People will get confused (yet another step, just to pass the temporary, most probably developer credentials)

You're right - let's keep it simple :)