Skip to content

Document te vertipaq --push and always-cached SPN login #433

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
MariaJoseFF wants to merge 1 commit into from
Closed

Document te vertipaq --push and always-cached SPN login #433

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion content/features/te-cli/te-cli-auth.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,9 @@ te auth login -u "$AZURE_CLIENT_ID" -t "$AZURE_TENANT_ID" --certificate ./sp.pfx
te auth login --identity # Alias: -I
```

After a successful service-principal login the CLI **caches the credentials** so every subsequent `te` command can acquire tokens silently - no need to re-pass `-u / -p / -t` or set the `AZURE_CLIENT_*` environment variables. Pass `--save=false` for a one-shot login that doesn't update the cache, or run `te auth logout` to clear it.
After a successful service-principal login the CLI **caches the credentials** so every subsequent `te` command can acquire tokens silently - no need to re-pass `-u / -p / -t` or set the `AZURE_CLIENT_*` environment variables. Service-principal credentials passed to `te auth login` (client secret or certificate) are always cached. Run `te auth logout` to clear the cache.

To authenticate a service principal without writing anything to the machine, skip `te auth login`: set `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET` and `AZURE_TENANT_ID`, and pass `--auth env` to each `te` command. The CLI authenticates per invocation and caches nothing - see [Non-interactive authentication](#non-interactive-authentication).

> [!WARNING]
> Passing secrets directly on the command line exposes them to process listings and shell history. Prefer the `AZURE_CLIENT_SECRET` environment variable, or pipe the secret via stdin with `-p -`.
Expand Down
5 changes: 4 additions & 1 deletion content/features/te-cli/te-cli-commands.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -705,7 +705,9 @@ Analyze VertiPaq storage statistics.
- `--export <file.vpax>` - export VertiPaq stats to a `.vpax` file for offline analysis.
- `--import <file.vpax>` - load a previously exported `.vpax` file and analyze it offline.
- `--obfuscate` - obfuscate names and expressions in exported VPAX.
- `--top <N>`, `--stats`, `--annotate`, `--save`.
- `--top <N>`, `--stats`.
- `--annotate` - write stats as annotations on each model object (table size, column size, cardinality, etc.). Without `--push`, the annotations are only prepared, not written to the workspace.
- `--push` - push the annotations prepared by `--annotate` back to the workspace. Requires `--annotate`; not available with `--import`.
- `--auth <method>` - auth method override when connecting to a remote model.

```bash
Expand All @@ -714,6 +716,7 @@ te vertipaq Sales # Stats limited to the Sales table
te vertipaq --all # Tables, columns, relationships, partitions
te vertipaq --export stats.vpax
te vertipaq --import stats.vpax # Analyze offline
te vertipaq --annotate --push # Write stats as annotations and push them to the workspace
```

### Formatting expressions
Expand Down
Loading