Implement support for Client Credentials flow

[m-mohr]

The OIDC client credentials flow for long machine-to-machine workflows would be nice.

Can probably be supported through req_oauth_client_credentials in httr2

[afischbach]

USGS is seeking to automate daily Sentinel-1 and -2 imagery access to support wildlife management at remote sites across the Pacific Arctic.
I understand that a (semi-)automated workflow is available within the python data access toolset (https://open-eo.github.io/openeo-python-client/auth.html#oidc-authentication-dynamic-method-selection).
However, the USGS IT security environment limits our ability to use python for these automated processes.
Please advise if this workflow may be advanced for the r scripting environment.

[m-mohr]

Yes, implementing the Clients Credentials Flow should be possible, but we have no funding to implement new features at the moment. PRs are also welcome, of course. Don't forget that the Flow also needs to be supported by the backend that you plan to connect to.

[afischbach]

Please advise on the process for (purchase requests) PR's. Once our project has clarity on our budget, we may be able to provide support for feature development.

[m-mohr]

For contractual information please see https://mohr.ws/contracting.html
This should be a fairly small task (1-2 days).

Could you please let me know which backend you plan to work against? Is it a public one such as CDSE for example? Have you ensured that they support the Client Credentials Flow? Thanks.

[m-mohr]

@soxofaan As you asked recently about this for the Web Editor, would this also be of interest to VITO/CDSE/...?

[soxofaan]

hmm I don't think we already had R users that requested client credentials.

[soxofaan]

However, the USGS IT security environment limits our ability to use python for these automated processes.
Please advise if this workflow may be advanced for the r scripting environment.

@afischbach
If you are working in constrained environments like this, I also like to point out that you don't have to use any of the official openeo client libraries to interact with an openeo backend. You basically just need a tool or language that can do HTTP requests. Resolving the client credentials is essentially also just a single HTTP request.
Obviously you have to do some more work that the official openeo clients do for you. But you could prepare a lot in advance outside of the constrained environment, with the tech of your choice, e.g. to produce process graph templates. At run time you then just have to fill in some placeholders and do a couple of HTTP requests.
I probably make it sound easier than it is, but I just wanted to point out that this is an option to consider if you have the resources to do that.

[afischbach]

We have been able to negotiate use of python within the USGS computing environment and have developed scripts to access Sentine-1 and -2 imagery through the openEO facility. Here is a link<https://code.usgs.gov/asc/sentinel-satellite-imagery-download/-/tree/v1.0.0> to these scripts. I hope that this may be helpful for the broader community.

…

-Tony Anthony Fischbach, Research Wildlife Biologist (he/him) USGS Alaska Science Center Walrus Research Program 4210 University Drive Anchorage, AK 99508 voice: (907) 786-7145 https://www.usgs.gov/centers/asc/science/walrus-research Google Scholar Profile<https://scholar.google.com/citations?user=KY5FGjMAAAAJ&hl=en> I am grateful to work on Inupiat, Siberian Yu’pik, Yu’pik and Unangax̂ lands when permitted and to live on Dena'ina lands. From: Stefaan Lippens ***@***.***> Sent: Thursday, June 13, 2024 07:29 To: Open-EO/openeo-r-client ***@***.***> Cc: Fischbach, Anthony S ***@***.***>; Mention ***@***.***> Subject: [EXTERNAL] Re: [Open-EO/openeo-r-client] Implement support for Client Credentials flow (Issue #144) This email has been received from outside of DOI - Use caution before clicking on links, opening attachments, or responding. However, the USGS IT security environment limits our ability to use python for these automated processes. Please advise if this workflow may be advanced for the r scripting environment. @afischbach<https://github.com/afischbach> If you are working in constrained environments like this, I also like to point out that you don't have to use any of the official openeo client libraries to interact with an openeo backend. You just need a tool or language that can do HTTP requests. Resolving the client credentials is essentially also just a single HTTP request. Obviously you have to do some more work that the official openeo clients do for you. But you could prepare a lot in advance outside of the constrained environment, with the tech of your choice, e.g. to produce process graph templates. At run time you then just have to fill in some placeholders and do a couple of HTTP requests. I probably make it sound easier than it is, but I just wanted to point out that this is an option to consider if you have the resources to do that. — Reply to this email directly, view it on GitHub<#144 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AEFRIW3TNDAYL7KA4G5QGDLZHG3CPAVCNFSM6AAAAAAYYAGJJ6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCNRWGAYDQMZTGE>. You are receiving this because you were mentioned.Message ID: ***@***.******@***.***>>