cli/authn: Add options to view OIDC config and properly show RSA public key

Signed-off-by: Aaron Wilson <aawilson@nvidia.com>

Author: aaronnw

cmd/cli/cli/auth_hdlr.go

@@ -6,6 +6,7 @@
 package cli
 
 import (
+	"encoding/json"
 	"errors"
 	"fmt"
 	"os"
@@ -40,6 +41,7 @@ const (
 	flagsAuthRevokeToken = "revoke_token"
 	flagsAuthRoleShow    = "role_show"
 	flagsAuthConfShow    = "conf_show"
+	flagsAuthOIDCShow    = "oidc_show"
 )
 
 const authnUnreachable = `AuthN unreachable at %s. You may need to update AIS CLI configuration or environment variable %s`
@@ -53,7 +55,8 @@ var (
 		flagsAuthRevokeToken: {tokenFileFlag},
 		flagsAuthUserShow:    {nonverboseFlag, verboseFlag},
 		flagsAuthRoleShow:    {nonverboseFlag, verboseFlag, clusterFilterFlag},
-		flagsAuthConfShow:    {jsonFlag},
+		flagsAuthConfShow:    {jsonFlag, noHeaderFlag},
+		flagsAuthOIDCShow:    {jsonFlag, noHeaderFlag},
 	}
 
 	// define separately to allow for aliasing (see alias_hdlr.go)
@@ -88,6 +91,17 @@ var (
 				Flags:  sortFlags(authFlags[flagsAuthConfShow]),
 				Action: wrapAuthN(showAuthConfigHandler),
 			},
+			{
+				Name:   cmdAuthOIDC,
+				Usage:  "Show AuthN OIDC configuration",
+				Flags:  sortFlags(authFlags[flagsAuthOIDCShow]),
+				Action: wrapAuthN(showAuthOIDCHandler),
+			},
+			{
+				Name:   cmdAuthJWKS,
+				Usage:  "Show AuthN public JWKS",
+				Action: wrapAuthN(showAuthJWKSHandler),
+			},
 		},
 	}
 
@@ -727,6 +741,37 @@ func showAuthConfigHandler(c *cli.Context) (err error) {
 	}
 }
 
+func showAuthOIDCHandler(c *cli.Context) (err error) {
+	oidc, err := authn.GetOIDCConfig(authParams)
+	if err != nil {
+		return err
+	}
+	list := flattenJSON(oidc, "")
+	usejs := flagIsSet(c, jsonFlag)
+	switch {
+	case usejs:
+		return teb.Print(oidc, teb.PropValTmpl, teb.Jopts(usejs))
+	case flagIsSet(c, noHeaderFlag):
+		return teb.Print(list, teb.PropValTmplNoHdr)
+	default:
+		return teb.Print(list, teb.PropValTmpl)
+	}
+}
+
+func showAuthJWKSHandler(_ *cli.Context) (err error) {
+	rawJSON, err := authn.GetJWKS(authParams)
+	if err != nil {
+		return err
+	}
+
+	// Decode into a generic map for flattening / table output
+	var jwks any
+	if err := json.Unmarshal(*rawJSON, &jwks); err != nil {
+		return err
+	}
+	return teb.Print(jwks, teb.PropValTmpl, teb.Jopts(true))
+}
+
 func authNConfigFromArgs(c *cli.Context) (conf *authn.ConfigToUpdate, err error) {
 	conf = &authn.ConfigToUpdate{Server: &authn.ServerConfToSet{}}
 	items := c.Args()

cmd/cli/cli/const.go

@@ -192,6 +192,8 @@ const (
 	cmdAuthCluster = cmdCluster
 	cmdAuthToken   = "token"
 	cmdAuthConfig  = cmdConfig
+	cmdAuthOIDC    = "oidc"
+	cmdAuthJWKS    = "jwks"
 
 	// K8s subcommans
 	cmdK8s        = "kubectl"

cmd/cli/cli/utils.go

@@ -40,6 +40,7 @@ import (
 
 const (
 	keyAndValueSeparator = "="
+	pemKeyIndicator      = "-----BEGIN"
 
 	// Error messages
 	dockerErrMsgFmt = "Failed to discover docker proxy URL: %v.\nUsing default %q.\n"
@@ -728,6 +729,14 @@ func flattenBackends(backends []string) (flat nvpairList) {
 func _toStr(v any) (s string) {
 	m, ok := v.(map[string]any)
 	if !ok {
+		// handle string pointers
+		if strPtr, ok := v.(*string); ok {
+			if strPtr == nil {
+				return ""
+			}
+			val := *strPtr
+			return val
+		}
 		// feature flags: custom formatting
 		if f, ok := v.(feat.Flags); ok {
 			if f == 0 {
@@ -865,6 +874,10 @@ func authNConfPairs(conf *authn.Config, prefix string) (nvpairList, error) {
 			return nil, false
 		}
 		v := _toStr(field.Value())
+		// Format PEM keys with newline before content for better display
+		if v != "" && strings.Contains(v, pemKeyIndicator) {
+			v = "\n" + v
+		}
 		flat = append(flat, nvpair{Name: tag, Value: v})
 		return nil, false
 	}, opts)

cmd/cli/go.mod

@@ -3,7 +3,7 @@ module github.com/NVIDIA/aistore/cmd/cli
 go 1.25
 
 require (
-	github.com/NVIDIA/aistore v1.4.2-0.20251211214833-bb44f2179a0d
+	github.com/NVIDIA/aistore v1.4.2-0.20251217200016-682568197255
 	github.com/fatih/color v1.18.0
 	github.com/json-iterator/go v1.1.12
 	github.com/onsi/ginkgo/v2 v2.27.3

cmd/cli/go.sum

@@ -1,8 +1,8 @@
 github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
 github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
-github.com/NVIDIA/aistore v1.4.2-0.20251211214833-bb44f2179a0d h1:zImn644dfrdWckQRrpBfNQXY7jNNNymC+AH66+d7de4=
-github.com/NVIDIA/aistore v1.4.2-0.20251211214833-bb44f2179a0d/go.mod h1:kJn4g8Ea4kDhPOSyJz/8/CJx85i4e1BES2RTZ9yEThA=
+github.com/NVIDIA/aistore v1.4.2-0.20251217200016-682568197255 h1:gZ1DO2ePmP2iJhqOsdFrh1qzzv3s0ruwRf48vlapgYU=
+github.com/NVIDIA/aistore v1.4.2-0.20251217200016-682568197255/go.mod h1:kJn4g8Ea4kDhPOSyJz/8/CJx85i4e1BES2RTZ9yEThA=
 github.com/OneOfOne/xxhash v1.2.8 h1:31czK/TI9sNkxIKfaUfGlU47BAxQ0ztGgd9vPyqimf8=
 github.com/OneOfOne/xxhash v1.2.8/go.mod h1:eZbhyaAYD41SGSSsnmcpxVoRiQ/MPUTjUdIIOT9Um7Q=
 github.com/VividCortex/ewma v1.1.1/go.mod h1:2Tkkvm3sRDVXaiyucHiACn4cqf7DpdyLvmxzcbUokwA=