Feature/OIDC device flow

[turetske]

Implements a call to the pelican binary to run an OIDC flow to get a token for the given namespace.

[turetske]

@jhiemstrawisc The code needed for a Jupyter cell to work:

import getpass
import sys
from io import StringIO

# Capture the password securely
password = getpass.getpass("Enter password to encrypt credentials file: ")

# Redirect stdin to provide the password
old_stdin = sys.stdin
sys.stdin = StringIO(password + "\n")

try:
    list = pelfs.ls("/ospool/ap40/data/emma.turetsky")
    print(list)
finally:
    sys.stdin = old_stdin

[jhiemstrawisc]

In addition to source code review, I tried testing this by hand as a user might:

>>> pelfs = PelicanFileSystem("pelican://osg-htc.org")
>>> pelfs.ls('/ospool/ap40/justin.hiemstra/')
The client is able to save the authorization in a local file.
This prevents the need to reinitialize the authorization for each transfer.
You will be asked for this password whenever a new session is started.
Please provide a new password to encrypt the local OSDF client configuration file: 
asdf

To approve credentials for this operation, please navigate to the following URL and approve the request:

https://osdf-ospool-issuer.osgdev.chtc.io/scitokens-server/device?user_code=GWT-LMC-2HM
WARNING[2025-11-17T15:03:14-06:00] Token was acquired from issuer but it does not appear valid for transfer; trying anyway 
eyJraWQiOiI1ZTQ5IiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJ3bGNnLnZlciI6IjEuMCIsImF1ZCI6Imh0dHBzOi8vd2xjZy5jZXJuLmNoL2p3dC92MS9hbnkiLCJzdWIiOiJqdXN0aW4uaGllbXN0cmEiLCJuYmYiOjE3NjM0MTMzODksInNjb3BlIjoic3RvcmFnZS5yZWFkOi9kYXRhL2p1c3Rpbi5oaWVtc3RyYSIsImlzcyI6Imh0dHBzOi8vb3NnLWh0Yy5vcmcvb3Nwb29sIiwiZXhwIjoxNzYzNDE0NDAzLCJpYXQiOjE3NjM0MTMzOTQsImp0aSI6Imh0dHBzOi8vb3NkZi1vc3Bvb2wtaXNzdWVyLm9zZ2Rldi5jaHRjLmlvL3NjaXRva2Vucy1zZXJ2ZXIvNmZmMTE0ZWRkNWE0MzllMTNkYTc4YzNmNzJkZThlOGY_dHlwZT1hY2Nlc3NUb2tlbiZ0cz0xNzYzNDEzMzk0MjM4JnZlcnNpb249djIuMCZsaWZldGltZT0xMDA5MDAwIn0.<Justin redacted this bit>
Using fallback token even though it may not be fully acceptable
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/jhiemstra/.local/share/mamba/envs/test-pelicanfs/lib/python3.12/site-packages/fsspec/asyn.py", line 118, in wrapper
    return sync(self.loop, func, *args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/jhiemstra/.local/share/mamba/envs/test-pelicanfs/lib/python3.12/site-packages/fsspec/asyn.py", line 103, in sync
    raise return_result
  File "/home/jhiemstra/.local/share/mamba/envs/test-pelicanfs/lib/python3.12/site-packages/fsspec/asyn.py", line 56, in _runner
    result[0] = await coro
                ^^^^^^^^^^
  File "/home/jhiemstra/snakemake-executor-dev/pelicanfs/src/pelicanfs/core.py", line 711, in wrapper
    return await func(self, data_url, *args[1:], **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/jhiemstra/snakemake-executor-dev/pelicanfs/src/pelicanfs/core.py", line 723, in _ls
    out = await self._ls_real(path, detail=detail)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/jhiemstra/snakemake-executor-dev/pelicanfs/src/pelicanfs/core.py", line 751, in _ls_real
    return await self._ls_real(url, detail=detail, client=client_ctx)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/jhiemstra/snakemake-executor-dev/pelicanfs/src/pelicanfs/core.py", line 760, in _ls_real
    items = await list_files(remote_dir)
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/jhiemstra/.local/share/mamba/envs/test-pelicanfs/lib/python3.12/site-packages/aiowebdav2/client.py", line 344, in list_with_infos
    response = await self.execute_request(
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/jhiemstra/.local/share/mamba/envs/test-pelicanfs/lib/python3.12/site-packages/aiowebdav2/client.py", line 264, in execute_request
    raise AccessDeniedError(self._url)
aiowebdav2.exceptions.AccessDeniedError: Access denied to https://ap40.uw.osg-htc.org:8443

I'm not too worried about the 403 I'm getting (I think this is external to PelicanFS), but I am worried that:

• The password I enter for the local token cache shows up in plain text
• The token itself is written out

Can you find a way to prevent these two things from happening?

[turetske]

@jhiemstrawisc I've tested this using a Jupyter notebook and with the command line - I believe I've addressed your concerns.

[jhiemstrawisc]

This is getting pretty close. The only issue I'm still having is with redacting stuff the input password to pelican token fetch:

$ python
Python 3.12.12 | packaged by conda-forge | (main, Oct 22 2025, 23:34:53) [Clang 19.1.7 ] on darwin
Type "help", "copyright", "credits" or "license" for more information.
Cmd click to launch VS Code Native REPL
>>> from pelicanfs import PelicanFileSystem
>>> pelfs = PelicanFileSystem("pelican://osg-htc.org")
>>> pelfs.ls('/ospool/ap40/data/justin.hiemstra/')
The OSDF client configuration is encrypted.  Enter your password: [REDACTED]
asdf

[TOKEN_REDACTED]
Using fallback token even though it may not be fully acceptable
[{'name': '/ospool/ap40/data/justin.hiemstra/ap40-foo.txt', 'size': 9, 'type': 'file', 'modified': datetime.datetime(2025, 11, 10, 16, 47, 45)}]

You'll notice Enter your password: [REDACTED] -- this shows up before I've started typing, but then my super secret asdf password still shows up in plain text. I think this is critical enough to get right on the first pass of the code.

[jhiemstrawisc]

LGTM. Lots of little things in here to test, but things "work on my machine"