feat(cli): gateway auth methods

cli/go.mod

@@ -2,6 +2,8 @@ module github.com/Infisical/infisical-merge
 
 go 1.23.0
 
+replace github.com/infisical/go-sdk => ../../go-sdk
+
 toolchain go1.23.5
 
 require (
@@ -14,7 +16,7 @@ require (
 	github.com/fatih/semgroup v1.2.0
 	github.com/gitleaks/go-gitdiff v0.9.1
 	github.com/h2non/filetype v1.1.3
-	github.com/infisical/go-sdk v0.5.92
+	github.com/infisical/go-sdk v0.5.94
 	github.com/infisical/infisical-kmip v0.3.5
 	github.com/mattn/go-isatty v0.0.20
 	github.com/muesli/ansi v0.0.0-20221106050444-61f0cd9a192a

cli/go.sum

@@ -294,6 +294,8 @@ github.com/inconshreveable/mousetrap v1.0.1 h1:U3uMjPSQEBMNp1lFxmllqCPM6P5u/Xq7P
 github.com/inconshreveable/mousetrap v1.0.1/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/infisical/go-sdk v0.5.92 h1:PoCnVndrd6Dbkipuxl9fFiwlD5vCKsabtQo09mo8lUE=
 github.com/infisical/go-sdk v0.5.92/go.mod h1:ExjqFLRz7LSpZpGluqDLvFl6dFBLq5LKyLW7GBaMAIs=
+github.com/infisical/go-sdk v0.5.94 h1:wKBj+KpJEe+ZzOJ7koXQZDR0dLL9bt0Kqgf/1q+7tG4=
+github.com/infisical/go-sdk v0.5.94/go.mod h1:ExjqFLRz7LSpZpGluqDLvFl6dFBLq5LKyLW7GBaMAIs=
 github.com/infisical/infisical-kmip v0.3.5 h1:QM3s0e18B+mYv3a9HQNjNAlbwZJBzXq5BAJM2scIeiE=
 github.com/infisical/infisical-kmip v0.3.5/go.mod h1:bO1M4YtKyutNg1bREPmlyZspC5duSR7hyQ3lPmLzrIs=
 github.com/jedib0t/go-pretty v4.3.0+incompatible h1:CGs8AVhEKg/n9YbUenWmNStRW2PHJzaeDodcfvRAbIo=

cli/packages/cmd/gateway.go

@@ -7,16 +7,79 @@ import (
 	"os/exec"
 	"os/signal"
 	"runtime"
+	"sync/atomic"
 	"syscall"
 	"time"
 
+	"github.com/Infisical/infisical-merge/packages/api"
+	"github.com/Infisical/infisical-merge/packages/config"
 	"github.com/Infisical/infisical-merge/packages/gateway"
 	"github.com/Infisical/infisical-merge/packages/util"
+	infisicalSdk "github.com/infisical/go-sdk"
+	"github.com/pkg/errors"
 	"github.com/posthog/posthog-go"
 	"github.com/rs/zerolog/log"
 	"github.com/spf13/cobra"
 )
 
+func getInfisicalSdkInstance(cmd *cobra.Command) (infisicalSdk.InfisicalClientInterface, context.CancelFunc, error) {
+
+	ctx, cancel := context.WithCancel(cmd.Context())
+	infisicalClient := infisicalSdk.NewInfisicalClient(ctx, infisicalSdk.Config{
+		SiteUrl:   config.INFISICAL_URL,
+		UserAgent: api.USER_AGENT,
+	})
+
+	token, err := util.GetInfisicalToken(cmd)
+	if err != nil {
+		cancel()
+		return nil, nil, err
+	}
+
+	fmt.Printf("token: %+v\n", token)
+
+	// if the --token param is set, we use it directly for authentication
+	if token != nil {
+		infisicalClient.Auth().SetAccessToken(token.Token)
+		fmt.Printf("token from client: %+v\n", infisicalClient.Auth().GetAccessToken())
+		return infisicalClient, cancel, nil
+	}
+
+	// if the --token param is not set, we use the auth-method flag to determine the authentication method, and perform the appropriate login flow based on that
+	authMethod, err := cmd.Flags().GetString("auth-method")
+	if err != nil {
+		cancel()
+		return nil, nil, err
+	}
+
+	authMethodValid, strategy := util.IsAuthMethodValid(authMethod, false)
+	if !authMethodValid {
+		util.PrintErrorMessageAndExit(fmt.Sprintf("Invalid login method: %s", authMethod))
+	}
+
+	sdkAuthenticator := util.NewSdkAuthenticator(infisicalClient, cmd)
+
+	authStrategies := map[util.AuthStrategyType]func() (credential infisicalSdk.MachineIdentityCredential, e error){
+		util.AuthStrategy.UNIVERSAL_AUTH:    sdkAuthenticator.HandleUniversalAuthLogin,
+		util.AuthStrategy.KUBERNETES_AUTH:   sdkAuthenticator.HandleKubernetesAuthLogin,
+		util.AuthStrategy.AZURE_AUTH:        sdkAuthenticator.HandleAzureAuthLogin,
+		util.AuthStrategy.GCP_ID_TOKEN_AUTH: sdkAuthenticator.HandleGcpIdTokenAuthLogin,
+		util.AuthStrategy.GCP_IAM_AUTH:      sdkAuthenticator.HandleGcpIamAuthLogin,
+		util.AuthStrategy.AWS_IAM_AUTH:      sdkAuthenticator.HandleAwsIamAuthLogin,
+		util.AuthStrategy.OIDC_AUTH:         sdkAuthenticator.HandleOidcAuthLogin,
+		util.AuthStrategy.JWT_AUTH:          sdkAuthenticator.HandleJwtAuthLogin,
+	}
+
+	_, err = authStrategies[strategy]()
+
+	if err != nil {
+		cancel()
+		return nil, nil, err
+	}
+
+	return infisicalClient, cancel, nil
+}
+
 var gatewayCmd = &cobra.Command{
 	Use:   "gateway",
 	Short: "Run the Infisical gateway or manage its systemd service",
@@ -26,13 +89,18 @@ var gatewayCmd = &cobra.Command{
 	DisableFlagsInUseLine: true,
 	Args:                  cobra.NoArgs,
 	Run: func(cmd *cobra.Command, args []string) {
-		token, err := util.GetInfisicalToken(cmd)
-		if err != nil {
-			util.HandleError(err, "Unable to parse token flag")
-		}
 
-		if token == nil {
+		infisicalClient, cancelSdk, err := getInfisicalSdkInstance(cmd)
-			util.HandleError(fmt.Errorf("Token not found"))
+		if err != nil {
+			util.HandleError(err, "unable to get infisical client")
+		}
+		defer cancelSdk()
+
+		var accessToken atomic.Value
+		accessToken.Store(infisicalClient.Auth().GetAccessToken())
+
+		if accessToken.Load().(string) == "" {
+			util.HandleError(errors.New("no access token found"))
 		}
 
 		Telemetry.CaptureEvent("cli-command:gateway", posthog.NewProperties().Set("version", util.CLI_VERSION))
@@ -41,13 +109,14 @@ var gatewayCmd = &cobra.Command{
 		signal.Notify(sigCh, syscall.SIGINT, syscall.SIGTERM)
 		sigStopCh := make(chan bool, 1)
 
-		ctx, cancel := context.WithCancel(cmd.Context())
+		ctx, cancelCmd := context.WithCancel(cmd.Context())
-		defer cancel()
+		defer cancelCmd()
 
 		go func() {
 			<-sigCh
 			close(sigStopCh)
-			cancel()
+			cancelCmd()
+			cancelSdk()
 
 			// If we get a second signal, force exit
 			<-sigCh
@@ -55,6 +124,34 @@ var gatewayCmd = &cobra.Command{
 			os.Exit(1)
 		}()
 
+		var gatewayInstance *gateway.Gateway
+
+		// Token refresh goroutine - runs every 10 seconds
+		go func() {
+			tokenRefreshTicker := time.NewTicker(10 * time.Second)
+			defer tokenRefreshTicker.Stop()
+
+			for {
+				select {
+				case <-tokenRefreshTicker.C:
+					if ctx.Err() != nil {
+						return
+					}
+
+					newToken := infisicalClient.Auth().GetAccessToken()
+					if newToken != "" && newToken != accessToken.Load().(string) {
+						accessToken.Store(newToken)
+						if gatewayInstance != nil {
+							gatewayInstance.UpdateIdentityAccessToken(newToken)
+						}
+					}
+
+				case <-ctx.Done():
+					return
+				}
+			}
+		}()
+
 		// Main gateway retry loop with proper context handling
 		retryTicker := time.NewTicker(5 * time.Second)
 		defer retryTicker.Stop()
@@ -64,7 +161,7 @@ var gatewayCmd = &cobra.Command{
 				log.Info().Msg("Shutting down gateway")
 				return
 			}
-			gatewayInstance, err := gateway.NewGateway(token.Token)
+			gatewayInstance, err := gateway.NewGateway(accessToken.Load().(string))
 			if err != nil {
 				util.HandleError(err)
 			}
@@ -126,7 +223,7 @@ var gatewayInstallCmd = &cobra.Command{
 		}
 
 		if token == nil {
-			util.HandleError(fmt.Errorf("Token not found"))
+			util.HandleError(errors.New("Token not found"))
 		}
 
 		domain, err := cmd.Flags().GetString("domain")
@@ -183,7 +280,7 @@ var gatewayRelayCmd = &cobra.Command{
 		}
 
 		if relayConfigFilePath == "" {
-			util.HandleError(fmt.Errorf("Missing config file"))
+			util.HandleError(errors.New("Missing config file"))
 		}
 
 		gatewayRelay, err := gateway.NewGatewayRelay(relayConfigFilePath)
@@ -198,7 +295,19 @@ var gatewayRelayCmd = &cobra.Command{
 }
 
 func init() {
-	gatewayCmd.Flags().String("token", "", "Connect with Infisical using machine identity access token")
+	gatewayCmd.Flags().String("token", "", "connect with Infisical using machine identity access token. if not provided, you must set the auth-method flag")
+
+	gatewayCmd.Flags().String("auth-method", "", "login method [universal-auth, kubernetes, azure, gcp-id-token, gcp-iam, aws-iam, oidc-auth]. if not provided, you must set the token flag")
+
+	gatewayCmd.Flags().String("client-id", "", "client id for universal auth")
+	gatewayCmd.Flags().String("client-secret", "", "client secret for universal auth")
+
+	gatewayCmd.Flags().String("machine-identity-id", "", "machine identity id for kubernetes, azure, gcp-id-token, gcp-iam, and aws-iam auth methods")
+	gatewayCmd.Flags().String("service-account-token-path", "", "service account token path for kubernetes auth")
+	gatewayCmd.Flags().String("service-account-key-file-path", "", "service account key file path for GCP IAM auth")
+
+	gatewayCmd.Flags().String("jwt", "", "JWT for jwt-based auth methods [oidc-auth, jwt-auth]")
+
 	gatewayInstallCmd.Flags().String("token", "", "Connect with Infisical using machine identity access token")
 	gatewayInstallCmd.Flags().String("domain", "", "Domain of your self-hosted Infisical instance")
 

cli/packages/cmd/kmip.go

@@ -49,13 +49,13 @@ func startKmipServer(cmd *cobra.Command, args []string) {
 	var identityClientSecret string
 
 	if strategy == util.AuthStrategy.UNIVERSAL_AUTH {
-		identityClientId, err = util.GetCmdFlagOrEnv(cmd, "identity-client-id", util.INFISICAL_UNIVERSAL_AUTH_CLIENT_ID_NAME)
+		identityClientId, err = util.GetCmdFlagOrEnv(cmd, "identity-client-id", []string{util.INFISICAL_UNIVERSAL_AUTH_CLIENT_ID_NAME})
 
 		if err != nil {
 			util.HandleError(err, "Unable to parse identity client ID")
 		}
 
-		identityClientSecret, err = util.GetCmdFlagOrEnv(cmd, "identity-client-secret", util.INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET_NAME)
+		identityClientSecret, err = util.GetCmdFlagOrEnv(cmd, "identity-client-secret", []string{util.INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET_NAME})
 		if err != nil {
 			util.HandleError(err, "Unable to parse identity client secret")
 		}

cli/packages/cmd/login.go

@@ -49,97 +49,6 @@ type params struct {
 	keyLength   uint32
 }
 
-func handleUniversalAuthLogin(cmd *cobra.Command, infisicalClient infisicalSdk.InfisicalClientInterface) (credential infisicalSdk.MachineIdentityCredential, e error) {
-
-	clientId, err := util.GetCmdFlagOrEnv(cmd, "client-id", util.INFISICAL_UNIVERSAL_AUTH_CLIENT_ID_NAME)
-
-	if err != nil {
-		return infisicalSdk.MachineIdentityCredential{}, err
-	}
-
-	clientSecret, err := util.GetCmdFlagOrEnv(cmd, "client-secret", util.INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET_NAME)
-	if err != nil {
-		return infisicalSdk.MachineIdentityCredential{}, err
-	}
-
-	return infisicalClient.Auth().UniversalAuthLogin(clientId, clientSecret)
-}
-
-func handleKubernetesAuthLogin(cmd *cobra.Command, infisicalClient infisicalSdk.InfisicalClientInterface) (credential infisicalSdk.MachineIdentityCredential, e error) {
-
-	identityId, err := util.GetCmdFlagOrEnv(cmd, "machine-identity-id", util.INFISICAL_MACHINE_IDENTITY_ID_NAME)
-	if err != nil {
-		return infisicalSdk.MachineIdentityCredential{}, err
-	}
-
-	serviceAccountTokenPath, err := util.GetCmdFlagOrEnv(cmd, "service-account-token-path", util.INFISICAL_KUBERNETES_SERVICE_ACCOUNT_TOKEN_NAME)
-	if err != nil {
-		return infisicalSdk.MachineIdentityCredential{}, err
-	}
-
-	return infisicalClient.Auth().KubernetesAuthLogin(identityId, serviceAccountTokenPath)
-}
-
-func handleAzureAuthLogin(cmd *cobra.Command, infisicalClient infisicalSdk.InfisicalClientInterface) (credential infisicalSdk.MachineIdentityCredential, e error) {
-
-	identityId, err := util.GetCmdFlagOrEnv(cmd, "machine-identity-id", util.INFISICAL_MACHINE_IDENTITY_ID_NAME)
-	if err != nil {
-		return infisicalSdk.MachineIdentityCredential{}, err
-	}
-
-	return infisicalClient.Auth().AzureAuthLogin(identityId, "")
-}
-
-func handleGcpIdTokenAuthLogin(cmd *cobra.Command, infisicalClient infisicalSdk.InfisicalClientInterface) (credential infisicalSdk.MachineIdentityCredential, e error) {
-
-	identityId, err := util.GetCmdFlagOrEnv(cmd, "machine-identity-id", util.INFISICAL_MACHINE_IDENTITY_ID_NAME)
-	if err != nil {
-		return infisicalSdk.MachineIdentityCredential{}, err
-	}
-
-	return infisicalClient.Auth().GcpIdTokenAuthLogin(identityId)
-}
-
-func handleGcpIamAuthLogin(cmd *cobra.Command, infisicalClient infisicalSdk.InfisicalClientInterface) (credential infisicalSdk.MachineIdentityCredential, e error) {
-
-	identityId, err := util.GetCmdFlagOrEnv(cmd, "machine-identity-id", util.INFISICAL_MACHINE_IDENTITY_ID_NAME)
-	if err != nil {
-		return infisicalSdk.MachineIdentityCredential{}, err
-	}
-
-	serviceAccountKeyFilePath, err := util.GetCmdFlagOrEnv(cmd, "service-account-key-file-path", util.INFISICAL_GCP_IAM_SERVICE_ACCOUNT_KEY_FILE_PATH_NAME)
-	if err != nil {
-		return infisicalSdk.MachineIdentityCredential{}, err
-	}
-
-	return infisicalClient.Auth().GcpIamAuthLogin(identityId, serviceAccountKeyFilePath)
-}
-
-func handleAwsIamAuthLogin(cmd *cobra.Command, infisicalClient infisicalSdk.InfisicalClientInterface) (credential infisicalSdk.MachineIdentityCredential, e error) {
-
-	identityId, err := util.GetCmdFlagOrEnv(cmd, "machine-identity-id", util.INFISICAL_MACHINE_IDENTITY_ID_NAME)
-	if err != nil {
-		return infisicalSdk.MachineIdentityCredential{}, err
-	}
-
-	return infisicalClient.Auth().AwsIamAuthLogin(identityId)
-}
-
-func handleOidcAuthLogin(cmd *cobra.Command, infisicalClient infisicalSdk.InfisicalClientInterface) (credential infisicalSdk.MachineIdentityCredential, e error) {
-
-	identityId, err := util.GetCmdFlagOrEnv(cmd, "machine-identity-id", util.INFISICAL_MACHINE_IDENTITY_ID_NAME)
-	if err != nil {
-		return infisicalSdk.MachineIdentityCredential{}, err
-	}
-
-	jwt, err := util.GetCmdFlagOrEnv(cmd, "oidc-jwt", util.INFISICAL_OIDC_AUTH_JWT_NAME)
-	if err != nil {
-		return infisicalSdk.MachineIdentityCredential{}, err
-	}
-
-	return infisicalClient.Auth().OidcAuthLogin(identityId, jwt)
-}
-
 func formatAuthMethod(authMethod string) string {
 	return strings.ReplaceAll(authMethod, "-", " ")
 }
@@ -154,8 +63,22 @@ var loginCmd = &cobra.Command{
 	Use:                   "login",
 	Short:                 "Login into your Infisical account",
 	DisableFlagsInUseLine: true,
-	Run: func(cmd *cobra.Command, args []string) {
+	PreRunE: func(cmd *cobra.Command, args []string) error {
+		// daniel: oidc-jwt is deprecated in favor of `jwt`. we backfill the `jwt` flag with the value of `oidc-jwt` if it's set.
+		if cmd.Flags().Changed("oidc-jwt") && !cmd.Flags().Changed("jwt") {
+			oidcJWT, err := cmd.Flags().GetString("oidc-jwt")
+			if err != nil {
+				return err
+			}
 
+			err = cmd.Flags().Set("jwt", oidcJWT)
+			if err != nil {
+				return err
+			}
+		}
+		return nil
+	},
+	Run: func(cmd *cobra.Command, args []string) {
 		presetDomain := config.INFISICAL_URL
 
 		clearSelfHostedDomains, err := cmd.Flags().GetBool("clear-domains")
@@ -310,17 +233,19 @@ var loginCmd = &cobra.Command{
 			Telemetry.CaptureEvent("cli-command:login", posthog.NewProperties().Set("infisical-backend", config.INFISICAL_URL).Set("version", util.CLI_VERSION))
 		} else {
 
-			authStrategies := map[util.AuthStrategyType]func(cmd *cobra.Command, infisicalClient infisicalSdk.InfisicalClientInterface) (credential infisicalSdk.MachineIdentityCredential, e error){
+			sdkAuthenticator := util.NewSdkAuthenticator(infisicalClient, cmd)
-				util.AuthStrategy.UNIVERSAL_AUTH:    handleUniversalAuthLogin,
+
-				util.AuthStrategy.KUBERNETES_AUTH:   handleKubernetesAuthLogin,
+			authStrategies := map[util.AuthStrategyType]func() (credential infisicalSdk.MachineIdentityCredential, e error){
-				util.AuthStrategy.AZURE_AUTH:        handleAzureAuthLogin,
+				util.AuthStrategy.UNIVERSAL_AUTH:    sdkAuthenticator.HandleUniversalAuthLogin,
-				util.AuthStrategy.GCP_ID_TOKEN_AUTH: handleGcpIdTokenAuthLogin,
+				util.AuthStrategy.KUBERNETES_AUTH:   sdkAuthenticator.HandleKubernetesAuthLogin,
-				util.AuthStrategy.GCP_IAM_AUTH:      handleGcpIamAuthLogin,
+				util.AuthStrategy.AZURE_AUTH:        sdkAuthenticator.HandleAzureAuthLogin,
-				util.AuthStrategy.AWS_IAM_AUTH:      handleAwsIamAuthLogin,
+				util.AuthStrategy.GCP_ID_TOKEN_AUTH: sdkAuthenticator.HandleGcpIdTokenAuthLogin,
-				util.AuthStrategy.OIDC_AUTH:         handleOidcAuthLogin,
+				util.AuthStrategy.GCP_IAM_AUTH:      sdkAuthenticator.HandleGcpIamAuthLogin,
+				util.AuthStrategy.AWS_IAM_AUTH:      sdkAuthenticator.HandleAwsIamAuthLogin,
+				util.AuthStrategy.OIDC_AUTH:         sdkAuthenticator.HandleOidcAuthLogin,
 			}
 
-			credential, err := authStrategies[strategy](cmd, infisicalClient)
+			credential, err := authStrategies[strategy]()
 
 			if err != nil {
 				euErrorMessage := ""
@@ -518,14 +443,18 @@ func init() {
 	rootCmd.AddCommand(loginCmd)
 	loginCmd.Flags().Bool("clear-domains", false, "clear all self-hosting domains from the config file")
 	loginCmd.Flags().BoolP("interactive", "i", false, "login via the command line")
-	loginCmd.Flags().String("method", "user", "login method [user, universal-auth]")
 	loginCmd.Flags().Bool("plain", false, "only output the token without any formatting")
+	loginCmd.Flags().String("method", "user", "login method [user, universal-auth, kubernetes, azure, gcp-id-token, gcp-iam, aws-iam, oidc-auth]")
 	loginCmd.Flags().String("client-id", "", "client id for universal auth")
 	loginCmd.Flags().String("client-secret", "", "client secret for universal auth")
 	loginCmd.Flags().String("machine-identity-id", "", "machine identity id for kubernetes, azure, gcp-id-token, gcp-iam, and aws-iam auth methods")
 	loginCmd.Flags().String("service-account-token-path", "", "service account token path for kubernetes auth")
 	loginCmd.Flags().String("service-account-key-file-path", "", "service account key file path for GCP IAM auth")
-	loginCmd.Flags().String("oidc-jwt", "", "JWT for OIDC authentication")
+	loginCmd.Flags().String("jwt", "", "jwt for jwt-based auth methods [oidc-auth, jwt-auth]")
+	loginCmd.Flags().String("oidc-jwt", "", "JWT for OIDC authentication. Deprecated, use --jwt instead")
+
+	loginCmd.Flags().MarkDeprecated("oidc-jwt", "use --jwt instead")
+
 }
 
 func DomainOverridePrompt() (bool, error) {

cli/packages/gateway/gateway.go

@@ -54,6 +54,10 @@ func NewGateway(identityToken string) (Gateway, error) {
 	}, nil
 }
 
+func (g *Gateway) UpdateIdentityAccessToken(accessToken string) {
+	g.httpClient.SetAuthToken(accessToken)
+}
+
 func (g *Gateway) ConnectWithRelay() error {
 	relayDetails, err := api.CallRegisterGatewayIdentityV1(g.httpClient)
 	if err != nil {

cli/packages/util/auth.go

@@ -5,7 +5,9 @@ import (
 	"os"
 	"os/exec"
 
+	infisicalSdk "github.com/infisical/go-sdk"
 	"github.com/rs/zerolog/log"
+	"github.com/spf13/cobra"
 )
 
 type AuthStrategyType string
@@ -18,6 +20,7 @@ var AuthStrategy = struct {
 	GCP_IAM_AUTH      AuthStrategyType
 	AWS_IAM_AUTH      AuthStrategyType
 	OIDC_AUTH         AuthStrategyType
+	JWT_AUTH          AuthStrategyType
 }{
 	UNIVERSAL_AUTH:    "universal-auth",
 	KUBERNETES_AUTH:   "kubernetes",
@@ -26,6 +29,7 @@ var AuthStrategy = struct {
 	GCP_IAM_AUTH:      "gcp-iam",
 	AWS_IAM_AUTH:      "aws-iam",
 	OIDC_AUTH:         "oidc-auth",
+	JWT_AUTH:          "jwt-auth",
 }
 
 var AVAILABLE_AUTH_STRATEGIES = []AuthStrategyType{
@@ -36,6 +40,7 @@ var AVAILABLE_AUTH_STRATEGIES = []AuthStrategyType{
 	AuthStrategy.GCP_IAM_AUTH,
 	AuthStrategy.AWS_IAM_AUTH,
 	AuthStrategy.OIDC_AUTH,
+	AuthStrategy.JWT_AUTH,
 }
 
 func IsAuthMethodValid(authMethod string, allowUserAuth bool) (isValid bool, strategy AuthStrategyType) {
@@ -84,3 +89,120 @@ func EstablishUserLoginSession() LoggedInUserDetails {
 
 	return loggedInUserDetails
 }
+
+type SdkAuthenticator struct {
+	infisicalClient infisicalSdk.InfisicalClientInterface
+	cmd             *cobra.Command
+}
+
+func NewSdkAuthenticator(infisicalClient infisicalSdk.InfisicalClientInterface, cmd *cobra.Command) *SdkAuthenticator {
+	return &SdkAuthenticator{
+		infisicalClient: infisicalClient,
+		cmd:             cmd,
+	}
+}
+func (a *SdkAuthenticator) HandleUniversalAuthLogin() (credential infisicalSdk.MachineIdentityCredential, e error) {
+
+	clientId, err := GetCmdFlagOrEnv(a.cmd, "client-id", []string{INFISICAL_UNIVERSAL_AUTH_CLIENT_ID_NAME})
+
+	if err != nil {
+		return infisicalSdk.MachineIdentityCredential{}, err
+	}
+
+	clientSecret, err := GetCmdFlagOrEnv(a.cmd, "client-secret", []string{INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET_NAME})
+	if err != nil {
+		return infisicalSdk.MachineIdentityCredential{}, err
+	}
+
+	return a.infisicalClient.Auth().UniversalAuthLogin(clientId, clientSecret)
+}
+
+func (a *SdkAuthenticator) HandleJwtAuthLogin() (credential infisicalSdk.MachineIdentityCredential, e error) {
+
+	identityId, err := GetCmdFlagOrEnv(a.cmd, "machine-identity-id", []string{INFISICAL_MACHINE_IDENTITY_ID_NAME})
+	if err != nil {
+		return infisicalSdk.MachineIdentityCredential{}, err
+	}
+
+	jwt, err := GetCmdFlagOrEnv(a.cmd, "jwt", []string{INFISICAL_JWT_NAME})
+	if err != nil {
+		return infisicalSdk.MachineIdentityCredential{}, err
+	}
+
+	return a.infisicalClient.Auth().JwtAuthLogin(identityId, jwt)
+}
+
+func (a *SdkAuthenticator) HandleKubernetesAuthLogin() (credential infisicalSdk.MachineIdentityCredential, e error) {
+
+	identityId, err := GetCmdFlagOrEnv(a.cmd, "machine-identity-id", []string{INFISICAL_MACHINE_IDENTITY_ID_NAME})
+	if err != nil {
+		return infisicalSdk.MachineIdentityCredential{}, err
+	}
+
+	serviceAccountTokenPath, err := GetCmdFlagOrEnv(a.cmd, "service-account-token-path", []string{INFISICAL_KUBERNETES_SERVICE_ACCOUNT_TOKEN_NAME})
+	if err != nil {
+		return infisicalSdk.MachineIdentityCredential{}, err
+	}
+
+	return a.infisicalClient.Auth().KubernetesAuthLogin(identityId, serviceAccountTokenPath)
+}
+
+func (a *SdkAuthenticator) HandleAzureAuthLogin() (credential infisicalSdk.MachineIdentityCredential, e error) {
+
+	identityId, err := GetCmdFlagOrEnv(a.cmd, "machine-identity-id", []string{INFISICAL_MACHINE_IDENTITY_ID_NAME})
+	if err != nil {
+		return infisicalSdk.MachineIdentityCredential{}, err
+	}
+
+	return a.infisicalClient.Auth().AzureAuthLogin(identityId, "")
+}
+
+func (a *SdkAuthenticator) HandleGcpIdTokenAuthLogin() (credential infisicalSdk.MachineIdentityCredential, e error) {
+
+	identityId, err := GetCmdFlagOrEnv(a.cmd, "machine-identity-id", []string{INFISICAL_MACHINE_IDENTITY_ID_NAME})
+	if err != nil {
+		return infisicalSdk.MachineIdentityCredential{}, err
+	}
+
+	return a.infisicalClient.Auth().GcpIdTokenAuthLogin(identityId)
+}
+
+func (a *SdkAuthenticator) HandleGcpIamAuthLogin() (credential infisicalSdk.MachineIdentityCredential, e error) {
+
+	identityId, err := GetCmdFlagOrEnv(a.cmd, "machine-identity-id", []string{INFISICAL_MACHINE_IDENTITY_ID_NAME})
+	if err != nil {
+		return infisicalSdk.MachineIdentityCredential{}, err
+	}
+
+	serviceAccountKeyFilePath, err := GetCmdFlagOrEnv(a.cmd, "service-account-key-file-path", []string{INFISICAL_GCP_IAM_SERVICE_ACCOUNT_KEY_FILE_PATH_NAME})
+	if err != nil {
+		return infisicalSdk.MachineIdentityCredential{}, err
+	}
+
+	return a.infisicalClient.Auth().GcpIamAuthLogin(identityId, serviceAccountKeyFilePath)
+}
+
+func (a *SdkAuthenticator) HandleAwsIamAuthLogin() (credential infisicalSdk.MachineIdentityCredential, e error) {
+
+	identityId, err := GetCmdFlagOrEnv(a.cmd, "machine-identity-id", []string{INFISICAL_MACHINE_IDENTITY_ID_NAME})
+	if err != nil {
+		return infisicalSdk.MachineIdentityCredential{}, err
+	}
+
+	return a.infisicalClient.Auth().AwsIamAuthLogin(identityId)
+}
+
+func (a *SdkAuthenticator) HandleOidcAuthLogin() (credential infisicalSdk.MachineIdentityCredential, e error) {
+
+	identityId, err := GetCmdFlagOrEnv(a.cmd, "machine-identity-id", []string{INFISICAL_MACHINE_IDENTITY_ID_NAME})
+	if err != nil {
+		return infisicalSdk.MachineIdentityCredential{}, err
+	}
+
+	jwt, err := GetCmdFlagOrEnv(a.cmd, "jwt", []string{INFISICAL_JWT_NAME, INFISICAL_OIDC_AUTH_JWT_NAME})
+	if err != nil {
+		return infisicalSdk.MachineIdentityCredential{}, err
+	}
+
+	return a.infisicalClient.Auth().OidcAuthLogin(identityId, jwt)
+}

cli/packages/util/constants.go

@@ -24,7 +24,10 @@ const (
 	INFISICAL_GCP_IAM_SERVICE_ACCOUNT_KEY_FILE_PATH_NAME = "INFISICAL_GCP_IAM_SERVICE_ACCOUNT_KEY_FILE_PATH"
 
 	// OIDC Auth
-	INFISICAL_OIDC_AUTH_JWT_NAME = "INFISICAL_OIDC_AUTH_JWT"
+	INFISICAL_OIDC_AUTH_JWT_NAME = "INFISICAL_OIDC_AUTH_JWT" // deprecated in favor of INFISICAL_JWT
+
+	// JWT AUTH
+	INFISICAL_JWT_NAME = "INFISICAL_JWT"
 
 	// Generic env variable used for auth methods that require a machine identity ID
 	INFISICAL_MACHINE_IDENTITY_ID_NAME = "INFISICAL_MACHINE_IDENTITY_ID"

cli/packages/util/helper.go

@@ -292,13 +292,18 @@ func GetEnvVarOrFileContent(envName string, filePath string) (string, error) {
 	return fileContent, nil
 }
 
-func GetCmdFlagOrEnv(cmd *cobra.Command, flag, envName string) (string, error) {
+func GetCmdFlagOrEnv(cmd *cobra.Command, flag string, envNames []string) (string, error) {
 	value, flagsErr := cmd.Flags().GetString(flag)
 	if flagsErr != nil {
 		return "", flagsErr
 	}
 	if value == "" {
-		value = os.Getenv(envName)
+		for _, env := range envNames {
+			value = os.Getenv(env)
+			if value != "" {
+				break
+			}
+		}
 	}
 	if value == "" {
 		return "", fmt.Errorf("please provide %s flag", flag)