oidc: Make generate-oidc-token a bit easier, add generate-oidc-client.

Signed-off-by: James Antill <james@and.org>

scripts/generate-oidc-client

@@ -0,0 +1,91 @@
+#!/usr/bin/python3
+# Copyright (c) 2026 Red Hat, Inc.
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# version 2 as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+"""
+This script will accept some parameters and will print out some config. data
+for use in openidc.{{env}}.static
+"""
+import base64
+import json
+import os
+import time
+import uuid
+
+import click
+
+
+secret = base64.urlsafe_b64encode(os.urandom(64))[:64].decode()
+
+
+template = """
+Paste this into ansible/roles/ipsilon/templates/openidc.{{env}}.static.j2
+
+--------START CUTTING HERE--------
+{service_name} client_id=null
+{service_name} client_secret="{{{service_name}_oidc_client_secret}}"
+{service_name} client_name="{service_name}"
+{service_name} redirect_uris=["https://{service_name}.fedoraproject.org/oidc/callback"]
+{service_name} application_type="native"
+{service_name} client_uri="http://localhost:13747/"
+{service_name} contacts=["admin@fedoraproject.org"]
+# This is sometimes client_secret_basic
+{service_name} token_endpoint_auth_method="{authmethod}"
+{service_name} logo_uri=null
+{service_name} policy_uri="https://fedoraproject.org/wiki/Legal:PrivacyPolicy"
+{service_name} tos_uri=null
+{service_name} jwks_uri=null
+{service_name} jwks=null
+{service_name} sector_identifier_uri=null
+{service_name} subject_type="public"
+{service_name} response_types="code"
+{service_name} grant_types="authorization_code"
+{service_name} request_uris=[]
+{service_name} require_auth_time=null
+{service_name} id_token_signed_response_alg="RS256"
+{service_name} request_object_signing_alg="none"
+{service_name} initiate_login_uri=null
+{service_name} default_max_age=null
+{service_name} default_acr_values=null
+{service_name} client_secret_expires_at=0
+{service_name} ipsilon_internal={{"type":"static","client_id":"{service_name}","trusted":false}}
+-------- END CUTTING HERE --------
+
+"""
+
+
+@click.command()
+@click.argument('service_name')
+@click.option('--username', '-u', default=None,
+              help='The username associated with the token. Defaults to SERVICE_NAME@service.')
+@click.option('--authmethod', default="client_secret_post",
+              help='The auth_method value, usually client_secret_post / client_secret_basic')
+def main(service_name, username, authmethod):
+    """
+    Print out config. to allow a token to be used by Ipsilon database
+
+    SERVICE_NAME is the name of the service that the token will be used by, (e.g., bodhi).
+    """
+    username = username or "{}@service".format(service_name)
+
+    meths = ('client_secret_basic', 'client_secret_post', 'none')
+    if authmethod not in meths:
+        print(" Warning: --authmethod is usually one of:", ", ".join(meths))
+
+    print(template.format(service_name=service_name, username=username,
+                          authmethod=authmethod))
+
+
+if __name__ == '__main__':
+    main()

scripts/generate-oidc-token

@@ -95,6 +95,14 @@ def generate_token(service_name, expiration, scope, no_openid, username):
                           expiration=expiration, scope=scope, username=username, now=now))
 
     print("Token: {}_{}\n".format(identifier, secret))
+    print("")
+    print("")
+    print("For adding to the private repo:")
+    print("")
+    print("ID: {}\n".format(service_name))
+    print("Secret: {}\n".format(secret))
+    print("")
+    print("Also see: ansible/scripts/generate-oidc-client")
 
 
 if __name__ == '__main__':