Merge pull request #274 from google/oidc_dev

node: add OAuth device flow for headless enrollment with browser-fail…

Author: aojea

agents/skills/sam-mesh/SKILL.md

@@ -34,9 +34,15 @@ approve it before running anything.
    log file, and how to stop it. It is idempotent, so run it again whenever you
    need to confirm a node is up.
 3. If step 2 reports that the node is not enrolled, run the command it prints,
-   `sam-node join --headless <control-plane-url>`. That prints a URL and a
-   code: show both to the user and wait while they complete the login, then
-   repeat step 2. Enrollment is a one-time step per machine.
+   `sam-node join --headless <control-plane-url>`. In headless mode SAM now
+   prefers OAuth device flow automatically when the OIDC provider supports it,
+   so no pasted callback code is required: it prints a verification URL/code
+   and polls until login completes. If the provider does not expose a device
+   endpoint, SAM falls back to OOB code-paste flow; show the URL/code to the
+   user, wait for completion, then repeat step 2. For deterministic automation,
+   force the flow with `--auth-mode device` (also `oob`, `browser`, or the
+   default `auto`); `--auth-mode device` fails fast if the provider has no
+   device endpoint. Enrollment is a one-time step per machine.
 4. Read the node API token from the file named in step 2, then register the MCP
    endpoint `http://127.0.0.1:8080/mcp` with the header
    `X-Sam-Authentication: Bearer <token>`. Claude Code:

cmd/sam-box/main.go

@@ -71,6 +71,7 @@ var (
 	audienceFlag              string
 	dataDirFlag               string
 	headlessFlag              bool
+	authModeFlag              string
 	offlineAccessFlag         bool
 	logLevelFlag              string
 	keyGracePeriodFlag        time.Duration
@@ -424,12 +425,21 @@ func main() {
 				fmt.Printf("Client ID discovered: %s\n", controlPlaneInfo.ClientId)
 
 				logger.Info("Discovering OIDC endpoints...")
-				tokenURL, authURL, err := dummyNode.DiscoverEndpoints(ctx, controlPlaneInfo.OidcIssuer)
+				endpoints, err := dummyNode.DiscoverEndpointsWithDevice(ctx, controlPlaneInfo.OidcIssuer)
 				if err != nil {
 					logger.Fatalf("Failed to discover OIDC endpoints: %v", err)
 				}
+				deviceAuthURL := endpoints.DeviceAuthURL
+				if deviceAuthURLFlag != "" {
+					deviceAuthURL = deviceAuthURLFlag
+				}
+
+				mode, err := node.ParseAuthMode(authModeFlag)
+				if err != nil {
+					logger.Fatalf("Invalid --auth-mode: %v", err)
+				}
 
-				jwtStr, err = dummyNode.InteractiveLogin(ctx, authURL, tokenURL, controlPlaneInfo.ClientId, controlPlaneInfo.Audience, offlineAccessFlag, headlessFlag)
+				jwtStr, err = dummyNode.InteractiveLoginWithMode(ctx, endpoints.AuthURL, endpoints.TokenURL, deviceAuthURL, controlPlaneInfo.ClientId, controlPlaneInfo.Audience, offlineAccessFlag, headlessFlag, mode)
 				if err != nil {
 					logger.Fatalf("Failed to get token: %v", err)
 				}
@@ -550,6 +560,7 @@ func main() {
 	rootCmd.PersistentFlags().StringVar(&audienceFlag, "audience", api.DefaultAudience, "OIDC Audience")
 	rootCmd.PersistentFlags().StringVar(&dataDirFlag, "data-dir", "", "Override directory for the agent store (defaults to OS user config dir)")
 	rootCmd.PersistentFlags().BoolVar(&headlessFlag, "headless", false, "Force headless out-of-band (OOB) authentication flow")
+	rootCmd.PersistentFlags().StringVar(&authModeFlag, "auth-mode", "auto", "Interactive enrollment auth mode: auto, device, oob, or browser")
 
 	rootCmd.AddCommand(runCmd)
 	rootCmd.AddCommand(joinCmd)

cmd/sam-node/main.go

@@ -73,6 +73,7 @@ var (
 	audienceFlag              string
 	dataDirFlag               string
 	headlessFlag              bool
+	authModeFlag              string
 	daemonizeFlag             bool
 	resetAllFlag              bool
 	assumeYesFlag             bool
@@ -276,12 +277,21 @@ func interactiveJoin(ctx context.Context, store *node.Store, targetControlPlane
 	fmt.Printf("Client ID discovered: %s\n", info.ClientId)
 
 	logger.Info("Discovering OIDC endpoints...")
-	tokenURL, authURL, err := dummyNode.DiscoverEndpoints(ctx, info.OidcIssuer)
+	endpoints, err := dummyNode.DiscoverEndpointsWithDevice(ctx, info.OidcIssuer)
 	if err != nil {
 		return "", nil, fmt.Errorf("failed to discover OIDC endpoints: %w", err)
 	}
+	deviceAuthURL := endpoints.DeviceAuthURL
+	if deviceAuthURLFlag != "" {
+		deviceAuthURL = deviceAuthURLFlag
+	}
+
+	mode, err := node.ParseAuthMode(authModeFlag)
+	if err != nil {
+		return "", nil, fmt.Errorf("invalid --auth-mode: %w", err)
+	}
 
-	jwtStr, err := dummyNode.InteractiveLogin(ctx, authURL, tokenURL, info.ClientId, info.Audience, offlineAccessFlag, headlessFlag)
+	jwtStr, err := dummyNode.InteractiveLoginWithMode(ctx, endpoints.AuthURL, endpoints.TokenURL, deviceAuthURL, info.ClientId, info.Audience, offlineAccessFlag, headlessFlag, mode)
 	if err != nil {
 		return "", nil, fmt.Errorf("failed to get token: %w", err)
 	}
@@ -935,6 +945,7 @@ func main() {
 	rootCmd.PersistentFlags().StringVar(&audienceFlag, "audience", api.DefaultAudience, "OIDC Audience")
 	rootCmd.PersistentFlags().StringVar(&dataDirFlag, "data-dir", "", "Override directory for the agent store (defaults to OS user config dir)")
 	rootCmd.PersistentFlags().BoolVar(&headlessFlag, "headless", false, "Force headless out-of-band (OOB) authentication flow")
+	rootCmd.PersistentFlags().StringVar(&authModeFlag, "auth-mode", "auto", "Interactive enrollment auth mode: auto, device, oob, or browser")
 
 	rootCmd.AddCommand(runCmd)
 	rootCmd.AddCommand(joinCmd)