Docs: cli: new command `auth-session {login,logout,list}`

[jseldess]

PR: https://github.com/cockroachdb/cockroach/pull/43872

From release notes:

The new cockroach auth-session login, cockroach auth-session list, and cockroach auth-session logout commands are now provided to facilitate the management of web sessions. The command auth-session login also produces a HTTP cookie which can be used by non-interactive HTTP-based database management tools. It also can generate such a cookie for the root user, who would not otherwise be able to do so using a web browser. [#43872][#43872] {% comment %}doc{% endcomment %}

The new command cockroach auth-session login (reserved for administrators) creates authentication tokens with an arbitrary expiration date. Operators should be careful to monitor system.web_sessions and enforce policy-mandated expirations by either using SQL queries or the new command cockroach auth-session logout. [#43872][#43872] {% comment %}doc{% endcomment %}

[dbist]

@Amruta-Ranade would be good to show examples:

cockroach auth-session login maxroach --certs-dir=certs

  username |     session ID     |                           authentication cookie
+----------+--------------------+----------------------------------------------------------------------------+
  maxroach | 538994200482643969 | session=CIGAjv7pi7m9BxIQIpYyFNH5pRcqf2Y6kEgv6A==; Path=/; HttpOnly; Secure
(1 row)
#
# Example uses:
#
#     curl [-k] --cookie 'session=CIGAjv7pi7m9BxIQIpYyFNH5pRcqf2Y6kEgv6A==; Path=/; HttpOnly; Secure' https://...
#
#     wget [--no-check-certificate] --header='Cookie: session=CIGAjv7pi7m9BxIQIpYyFNH5pRcqf2Y6kEgv6A==; Path=/; HttpOnly; Secure' https://...
#

and example of how that session can be used programmatically.

[mattcrdb]

Any update on this? It would be good to have something for us to point users to.

[Amruta-Ranade]

Not yet :( It hasn't been prioritized for a while now. Will try to get it done as soon as I am done with 20.2 roadmap work.

[mattcrdb]

Thanks for the quick response!

[mattcrdb]

Can we prioritize this issue? We've had plenty of incidents where documentation on this feature would assist both operators and TSE in collecting profiles gated behind a valid authentication cookie.