Ferriskeyclient
Manage OAuth2 clients within a realm.
ferris-ctl client <subcommand>Every subcommand accepts --realm <name> to choose the realm the command acts on; otherwise the context’s realm is used. The CLI always signs in to the context’s realm, so the context must have one even when you pass --realm. See Authentication.
Known limit: only the first page of clients is read
The server returns clients in pages of 20 by default (100 at most), and ferris-ctl reads the first page only. In a realm with more than 20 clients, client list shows a subset. client get, client delete, and client secret look the client up by an exact client_id match in that same page, so they answer client '<id>' not found for a client that is not in it. The API reaches the rest with its page and limit parameters, and so does the admin console.
client list
List clients in a realm.
ferris-ctl client list [--realm <realm>]Table columns: CLIENT_ID, ID, NAME.
client get
Show a client’s details.
ferris-ctl client get <client_id> [--realm <realm>]| Argument | Required | Description |
|---|---|---|
<client_id> | yes | Client identifier |
--realm | no | Realm (defaults to the context realm) |
Returns id, client_id, name, realm, enabled, protocol, public_client, service_accounts_enabled, and direct_access_grants_enabled. The secret is not part of it: use client secret.
client create
Create a client.
ferris-ctl client create <name> [flags]| Argument | Default | Description |
|---|---|---|
<name> | Client name (required) | |
--client-id | <name> | Client identifier |
--realm | context realm | Realm |
--type | public | Client type: public, confidential, or system |
--enabled | off | Create the client enabled. Without the flag it is created disabled, and a disabled client cannot authenticate anyone |
--protocol | openid-connect | Protocol used by the client |
--direct-access-grants | off | Enable direct access grants |
The client type controls a few defaults:
| Type | public_client | Service account |
|---|---|---|
public | true | disabled |
confidential | false | enabled |
system | false | enabled |
ferris-ctl client create backend \
--type confidential \
--enabled \
--direct-access-grantsThe command prints the created client. It sets nothing else: no redirect URIs, no web origins, and the OAuth 2.0 device authorization grant is always off. Set those in the admin console, or describe the client in a description file and import it.
client secret
Print the secret of a confidential client.
ferris-ctl client secret <client_id> [--realm <realm>]| Argument | Required | Description |
|---|---|---|
<client_id> | yes | Client identifier |
--realm | no | Realm (defaults to the context realm) |
The secret goes to standard output on its own line, with nothing else around it, so you can capture it:
ferris-ctl client secret backend > backend.secret
SECRET="$(ferris-ctl client secret backend)"-o has no effect here. Only confidential clients have a secret. Reading it takes more than reading the client: the signed-in identity needs manage_clients (or manage_realm), and every call records a client_secret_viewed security event on the server.
client delete
Delete a client. Prompts for confirmation, naming the client and its id, unless --force is passed.
ferris-ctl client delete <client_id> [--realm <realm>] [--force]| Argument | Required | Description |
|---|---|---|
<client_id> | yes | Client identifier |
--realm | no | Realm (defaults to the context realm) |
--force / -f | no | Skip the confirmation prompt (required in non-interactive shells) |