A library to manage ForgeRock Identity Cloud tenants, ForgeOps deployments, and classic deployments.
A hybrid (ESM and CJS) library to manage PingOne Advanced Identity Cloud environments, ForgeOps deployments, and classic deployments.
Frodo-lib powers frodo-cli, the command line tool to manage PingOne Advanced Identity Cloud environments, ForgeOps deployments, and classic deployments.
Please refer to the GitHub README for full documentation.
All notable changes to this project are documented in this file.
The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.
Add governance API factory under frodo.factory:
rockcarver
generateGovernanceApi: Generates a Governance Axios API instanceFixes and improvements to imports and exports:
agents => agent, secrets => secret, variables => variable). The reason for this is to make them more consistent with the rest of the exports which are also singular, and also because secrets plural will be used for exporting AM secret config in the future.Add governance API factory under frodo.factory:
generateGovernanceApi: Generates a Governance Axios API instanceFixes and improvements to imports and exports:
agents => agent, secrets => secret, variables => variable). The reason for this is to make them more consistent with the rest of the exports which are also singular, and also because secrets plural will be used for exporting AM secret config in the future.Expose API factory to developers using Frodo Library to configure AIC, ForgeOps, and PingAM deployments.
Under frodo.factory developers now have access to:
generateAmApi: Generates an AM Axios API instancegenerateOauth2Api: Generates an OAuth2 Axios API instancegenerateIdmApi: Generates an IDM Axios API instancegenerateLogKeysApi: Generates a LogKeys API Axios instancegenerateLogApi: Generates a Log API Axios instancegenerateEnvApi: Generates an Axios instance for the Identity Cloud Environment APIgenerateReleaseApi: Generates a release (Github or Npm) Axios API instanceImprove support for custom platform deployments (non-forgeops or customized forgeops)
rockcarver/frodo-cli#429: Added state functions to support custom oauth2 clients for IDM API calls:
state.setAdminClientId(clientId: string): voidstate.getAdminClientId(): stringstate.setAdminRedirectUri(redirectUri: string): voidstate.getAdminRedirectUri(): stringrockcarver/frodo-cli#359: Added state functions to support custom IDM host URLs for all IDM API calls (e.g. platform deployments hosting AM and IDM on/in different DNS hosts/domains):
state.setIdmHost(host: string): voidstate.getIdmHost(): stringNodeNext for module and moduleResolution, or ESNext for module and Bundler for moduleResolution, it was unable to determine types.Improvements to script handling:
useStringArrays in exports and allowing imports to support single-string scripts in addition to string array scripts.#247 - Support for Advanced Identitty Cloud Environment Promotion API (Location in library: frodo.cloud.env.promotion)
#432 - Support for Advanced Identitty Cloud ESV Count API (Location in library: frodo.cloud)
#433 - Support for Advanced Identitty Cloud Environment Certificate API (Location in library: frodo.cloud.env.cert)
#434 - Support for Advanced Identitty Cloud Environment CSR API (Location in library: frodo.cloud.env.csr)
#435 - Support for Advanced Identitty Cloud Environment Content Security Policy API (Location in library: frodo.cloud.env)
#436 - Support for Advanced Identitty Cloud Environment Cookie Domains API (Location in library: frodo.cloud.env)
#437 - Support for Advanced Identitty Cloud Environment Custom Domains API (Location in library: frodo.cloud.env)
#438 - Support for Advanced Identitty Cloud Environment Federation Enforcement API (Location in library: frodo.cloud.env)
#439 - Support for Advanced Identitty Cloud Environment Release API (Location in library: frodo.cloud.env)
#440 - Support for Advanced Identitty Cloud Environment SSO Cookie API (Location in library: frodo.cloud.env)
Fixes to script handling
#448: Frodo Library now accepts an additional optional boolean param wait, which if provided delays the response until an OSGi service event confirms the change has been consumed by the corresponding service or the request times out, to the following frodo.idm.config functions:
#450: Mitigated CVE-2024-39338
rockcarver/frodo-cli#428: Frodo Library now includes the loglevel dependency.
rockcarver/frodo-cli#430: Frodo now properly supports exporting and importing of the email service with secondary configurations.
frodo.cloud.env.promotion)frodo.cloud.esvCount.getEsvCount and added new location frodo.cloud.getEsvCountfrodo.cloud.env)frodo.cloud.env)frodo.cloud.env)frodo.cloud.env)frodo.cloud.env)frodo.cloud.env)#448: Frodo Library now accepts an additional optional boolean param wait, which if provided delays the response until an OSGi service event confirms the change has been consumed by the corresponding service or the request times out, to the following frodo.idm.config functions:
#450: Mitigated CVE-2024-39338
frodo.cloud.esvCount)frodo.cloud.env.cert)frodo.cloud.env.csr)loglevel dependency.2.x introduces breaking changes to support multiple instances of the library to run concurrently and connect to multiple different Ping Identity Platform instances at the same time. 1.x operates using a global singleton, making it impossible to connect to more than one platform instance at a time.
Removing the singleton pattern and introducing multi-instantiability forced a radical redesign of the core library functions while striving to maintain the basic usage pattern. The library is now exposing two main types describing its modules (Frodo) and state (State). Each module in turn exports all its collection of functions as a type as well. Exposing the library structure as types enables auto-completion for both JS and TS developers with properly configured IDEs like Visual Studio Code or other and also serves as an abstraction layer between what the library exposes vs what and how it's implemented.
FrodoError ClassAll the errors thrown by the library are of the class FrodoError, introduced in 2.x. The new error class addresses the following challenges of earlier library versions:
Allows applications using the library to determine if the error originated in the library or is an unexpected and unhandled error from deeper down the stack.
Nesting of errors:
When the library throws because it caught an error thrown deeper down the stack, it wraps the caught Error in a FrodoError.
Nesting of arrays of errors
The library supports many operation that require a number of actions to occur in a row or in parallel. Often these operations are REST API calls and any of those calls may fail for any reason. To preserve status of every operation, FrodoError can also wrap an array of errors, each of which may be another instance of FrodoError wrapping an individual or an array of errors.
Provides a stack-like combined error message concatenating the messages of all wrapped errors and nested errors.
Includes standardized fields to surface network errors in case the Error on top of the stack is an AxiosError.
The new printError function recognizes FrodoError and prints a uniformly formatted expression of the error including an interpretation of the fields for network stack errors.
The following modules have been updated and/or added since 1.x:
| Module | Since | Capabilities |
|---|---|---|
| frodo.admin | 1.0.0 | Library of common and complex admin tasks. |
| frodo.agent | 1.0.0 | Manage web, java, and gateway agents. |
| frodo.app | 2.0.0 | Manage platform applications and dependencies. |
| frodo.authn.journey | 1.0.0 | Manage authentication journeys. |
| frodo.authn.node | 1.0.0 | Manage authentication nodes. |
| frodo.authn.settings | 2.0.0 | Manage realm-wide authentication settings. |
| frodo.authz.policy | 1.0.0 | Manage authorization policies and dependencies. |
| frodo.authz.policySet | 1.0.0 | Manage policy sets and dependencies. |
| frodo.authz.resourceType | 1.0.0 | Manage resource types and dependencies. |
| frodo.cache | 2.0.0 | Token cache management exposed through the library but primarily used internally. |
| frodo.cloud.adminFed | 1.0.0 | Manage PingOne Advanced Identity Cloud admin federation. |
| frodo.cloud.feature | 1.0.0 | Obtain info on PingOne Advanced Identity Cloud features. |
| frodo.cloud.log | 1.0.0 | Access PingOne Advanced Identity Cloud debug and audit logs. |
| frodo.cloud.secret | 1.0.0 | Mange secrets in PingOne Advanced Identity Cloud. |
| frodo.cloud.serviceAccount | 1.0.0 | Manage service accounts in PingOne Advanced Identity Cloud. |
| frodo.cloud.startup | 1.0.0 | Apply changes to secrets and variables and restart services in PingOne Advanced Identity Cloud. |
| frodo.cloud.variable | 1.0.0 | Manage variables in PingOne Advanced Identity Cloud. |
| frodo.conn | 1.0.0 | Manage connection profiles. |
| frodo.config | 2.0.0 | Manage the whole platform configuration. |
| frodo.email.template | 1.0.0 | Manage email templates (IDM). |
| frodo.idm.config | 2.0.0 | Manage any IDM configuration object. |
| frodo.idm.connector | 2.0.0 | Manage IDM connector configuration. |
| frodo.idm.managed | 1.0.0 | Manage IDM managed object schema (managed.json). |
| frodo.idm.mapping | 2.0.0 | Manage IDM mappings (sync.json). |
| frodo.idm.organization | 1.0.0 | Limited Org Model management exposed through the library but primarily used internally. |
| frodo.idm.recon | 2.0.0 | Read, start, cancel IDM recons. |
| frodo.idm.system | 2.0.0 | Manage data in connected systems. |
| frodo.info | 1.0.0 | Obtain information about the connected instance and authenticated identity. |
| frodo.login | 1.0.0 | Authenticate and obtain necessary tokens. |
| frodo.oauth2oidc.client | 1.0.0 | Manage OAuth 2.0 clients. |
| frodo.oauth2oidc.endpoint | 2.0.0 | Limited OAuth 2.0 grant flows exposed through the library but primarily used internally. |
| frodo.oauth2oidc.external | 1.0.0 | Manage external OAuth 2.0/OIDC 1.0 (social) identity providers. |
| frodo.oauth2oidc.issuer | 2.0.0 | Manage trusted OAuth 2.0 JWT issuers. |
| frodo.oauth2oidc.provider | 1.0.0 | Manage the realm OAuth 2.0 provider. |
| frodo.realm | 1.0.0 | Manage realms. |
| frodo.saml.circlesOfTrust | 1.0.0 | Manage SAML 2.0 circles of trust. |
| frodo.saml.entityProvider | 1.0.0 | Manage SAML 2.0 entity providers. |
| frodo.script | 1.0.0 | Manage access management scripts. |
| frodo.service | 1.0.0 | Manage access management services. |
| frodo.session | 2.0.0 | Limited session management exposed through the library but primarily used internally. |
| frodo.state | 1.0.0 | Manage library state. |
| frodo.theme | 1.0.0 | Manage platform themes (hosted pages). |
| frodo.utils.constants | 1.0.0 | Access relevant library constants. |
| frodo.utils.jose | 1.0.0 | Jose utility functions exposed through the library but primarily used internally. |
| frodo.utils.json | 1.0.0 | JSON utility functions exposed through the library but primarily used internally. |
| frodo.utils.version | 1.0.0 | Utility functions to obtain current library version and available released versions. |
The 2.x version of the library uses a secure token cache, which is active by default. The cache makes it so that when the frodo.login.getTokens() method is called, available tokens are updated in state from cache and if none are available, they are obtained from the instance configured in state. The cache is tokenized and encrypted on disk, so it persists across library instantiations. You can disable the cache by either setting the FRODO_NO_CACHE environment variable or by calling state.setUseTokenCache(false) from your application.
You can change the default location of the cache file (~/.frodo/TokenCache.json) by either setting the FRODO_TOKEN_CACHE_PATH environment variable or by calling state.setTokenCachePath('/path/to/cache.json').
The 2.x version of the library automatically refreshes session and access tokens before they expire. Combined with the new token cache, the library will maintain a set of valid tokens in state at all times until it is shut down. If you do not want to automatically refresh tokens, set the autoRefresh parameter (2nd param) of your frodo.login.getTokens() call to false.
| Node.js | frodo-lib 1.x | frodo-lib 2.x | frodo-lib 3.x |
|---|---|---|---|
| 14 | :white_check_mark: | :heavy_minus_sign: | :heavy_minus_sign: |
| 16 | :white_check_mark: | :heavy_minus_sign: | :heavy_minus_sign: |
| 18 | :white_check_mark: | :white_check_mark: | :heavy_minus_sign: |
| 20 | :heavy_minus_sign: | :white_check_mark: | :white_check_mark: |
| 22 | :heavy_minus_sign: | :white_check_mark: | :white_check_mark: |
| 24 | :heavy_minus_sign: | :heavy_minus_sign: | :white_check_mark: |
Platform passwords and secrets are configuration values that are stored encrypted as part of platform configuration. Examples are oauth2 client secrets or service account passwords.
Frodo generally doesn't export platform passwords and secrets. The platform supports configuration placeholders and environment secrets and variables allowing administrators to separate the functional configuration from sensitive secrets and variable configuration values. frodo assumes administrators take full advantage of these capabilities so that there is no need or expectation that exports include passwords and secrets. However, where the APIs support it, administrators can seed import data with raw secrets and frodo will import them.
Frodo supports exporting and importing of ESV secret values. To leave stuartship of secret values with the cloud environment where they belong, frodo always encrypts values using either encryption keys from the source environment (default) or the target environment. Frodo never exports secrets in the clear.
base64aes encoding for ESV secretsfrodo.config.exportFullConfiguration and frodo.config.importFullConfigurationfrodo conn save commandfr:am:*fr:idc:analytics:*fr:autoaccess:*fr:idc:certificate:*fr:idc:certificate:readfr:idc:content-security-policy:*fr:idc:custom-domain:*fr:idc:esv:*fr:idc:esv:readfr:idc:esv:restartfr:idc:esv:updatefr:idm:*fr:iga:*fr:idc:promotion:*fr:idc:release:*fr:idc:sso-cookie:*FrodoError for all ops layer errors.frodo.authn.settings module.#53: Frodo Library now uses a file-based secure token cache to persist session and access tokens for re-use. The cached tokens are protected by the credential that was used to obtain them. Session tokens are encrypted using the hashed password as the master key, access tokens are encrypted using the hashed JWK private key as the master key. Therefore only users and processes with the correct credentials can access the tokens in the cache.
state.getUseTokenCache(): boolean and state.setUseTokenCache(useTokenCache: boolean): void.#340: Frodo Library now autotomatically refreshes expired session and access tokens.
frodo.login.getTokens() functino with a new autoRefresh: boolean parameter.Device Match node if the Use Custom Matching Script option is selected.expressionType property when creating ESV variables in Identity Cloud.Fix import/require resolution issues for library users. Developers using the library can now:
ESM:
Member style import any other modules from the library:
import { frodo, state, FrodoLib } from '@rockcarver/frodo-lib';CJS:
Member style require any other modules from the library"
const { frodo, state, FrodoLib } = require('@rockcarver/frodo-lib');AdminFederation.AdminFederation.AdminFederation.Log.frodo logs tail command in the cli)frodo esv apply before aborting.frodo logs tail command in the cli)frodo esv apply before aborting.frodo esv apply before aborting.Authenticate.getTokens API now supports new forceLoginAsUser param to force logging in as a user even if a service account is available.ConnectionProfile.getConnectionProfileByHost.ConnectionProfile.saveConnectionProfile.#68: Support final implementation of Identity Cloud service accounts. Service accounts are the future way for applications to authenticate to Identity Cloud environments without using a personal tenant admin account. Tenant admins can create any number of service accounts and assign sets of privileges to each account. Frodo Library can create service accounts with the required privileges or can use existing service accounts.
To create a service account use the new ServiceAccount API:
import { createJwkRsa, createJwks, getJwkRsaPublic } from './JoseOps';
import {
createServiceAccount,
isServiceAccountsFeatureAvailable,
} from './ServiceAccountOps';
// check if the tenant supports service accounts
if (isServiceAccountsFeatureAvailable()) {
const name = 'sa';
const description = 'service account';
const accountStatus = 'Active';
const scopes = ['fr:am:*', 'fr:idm:*', 'fr:idc:esv:*'];
// create a java web key (JWK) using RSA
const jwk = await createJwkRsa();
// extract only the public key as a JWK from the full JWK
const publicJwk = await getJwkRsaPublic(jwk);
// create a java wek key set (JWKS) from the public JWK
const jwks = await createJwks(publicJwk);
// create service account
const payload = await ServiceAccount.createServiceAccount(
name,
description,
accountStatus,
scopes,
jwks
);
// uuid of new service account if creation succeeded
const saId = payload._id;
}To use a service account set the following state variables:
import { state } from '@rockcarver/frodo-lib';
// setting both, id and jwk, instruct the library to use the service account
state.setServiceAccountId(saId);
state.setServiceAccountJwk(jwk);Add support for additional environment variables:
FRODO_SA_ID: Service account's uuid. If set, must also set FRODO_SA_JWK.
FRODO_SA_JWK: Service account's java web key (jwk) as single-line string. Jwk must contain private key! If set, must also set FRODO_SA_ID.
FRODO_AUTHENTICATION_SERVICE=journey: Specify a login journey for frodo to use.
FRODO_MOCK=1: Enable mocking. If enabled, frodo-lib replays recorded API responses instead of connecting to a platform instance.
FRODO_POLLY_LOG_LEVEL=info: Frodo mock engine log level (trace, debug, info, warn, error, silent). This is helpful for troubleshooting the mock capability, only.
Environment variables added in 0.17.1:
FRODO_HOSTFRODO_REALMFRODO_USERNAMEFRODO_PASSWORDFRODO_SA_IDFRODO_SA_JWKFRODO_LOG_KEYFRODO_LOG_SECRETFRODO_DEBUGAdd new InfoOps module (exported as Info) to obtain details about the connected platform instance.
Add support to delete IDM config entities
Add function to check RCS status
Add mock mode for library to allow unit testing of clients using the library, like frodo-cli. This initial release contains minimal mock data. Enable mock mode using FRODO_MOCK=1.
Updated list of contributors in package.json
More automated tests
#68: Support upcoming Identity Cloud service accounts. Service accounts are the future way to authenticate to Identity Cloud environments without using a personal tenant admin account. Tenant admins can create any number of service accounts and assign sets of privileges to each account. Frodo Library can create service accounts with the required privileges or can use existing service accounts.
To create a service account use the new ServiceAccount API:
import { createJwkRsa, createJwks, getJwkRsaPublic } from './JoseOps';
import {
createServiceAccount,
isServiceAccountsFeatureAvailable,
} from './ServiceAccountOps';
// check if the tenant supports service accounts
if (isServiceAccountsFeatureAvailable()) {
const name = 'sa';
const description = 'service account';
const accountStatus = 'Active';
const scopes = ['fr:am:*', 'fr:idm:*', 'fr:idc:esv:*'];
// create a java web key (JWK) using RSA
const jwk = await createJwkRsa();
// extract only the public key as a JWK from the full JWK
const publicJwk = await getJwkRsaPublic(jwk);
// create a java wek key set (JWKS) from the public JWK
const jwks = await createJwks(publicJwk);
// create service account
const payload = await ServiceAccount.createServiceAccount(
name,
description,
accountStatus,
scopes,
jwks
);
// uuid of new service account if creation succeeded
const saId = payload._id;
}To use a service account set the following state variables:
import { state } from '@rockcarver/frodo-lib';
// setting both, id and jwk, instruct the library to use the service account
state.setServiceAccountId(saId);
state.setServiceAccountJwk(jwk);#154: Frodo-specific transaction id in all API requests: frodo-<random uuid>
Support AM realm and global services.
import { Service } from '@rockcarver/frodo-lib';
const {
createServiceExportTemplate,
deleteFullServices,
deleteFullService,
getListOfServices,
getFullServices,
exportServices,
exportService,
importServices,
importService,
} = Service;Support import IDM configuration.
import { Idm } from '@rockcarver/frodo-lib';
const { putConfigEntity } = Idm;#139: Support for Agents / Gateways.
import { Agent } from '@rockcarver/frodo-lib';
const {
AGENT_TYPE_IG,
AGENT_TYPE_JAVA,
AGENT_TYPE_WEB,
createAgentExportTemplate,
getAgents,
getIdentityGatewayAgents,
getJavaAgents,
getWebAgents,
exportAgents,
exportIdentityGatewayAgents,
exportJavaAgents,
exportWebAgents,
exportAgent,
exportIdentityGatewayAgent,
exportJavaAgent,
exportWebAgent,
importAgents,
importIdentityGatewayAgents,
importJavaAgents,
importWebAgents,
importAgent,
importIdentityGatewayAgent,
importJavaAgent,
importWebAgent,
} = Agent;#180: Allow all connection parameters to be supplied using environment variables for secure CI/CD:
FRODO_HOSTFRODO_REALMFRODO_USERNAMEFRODO_PASSWORDFRODO_SA_IDFRODO_SA_JWKFRODO_LOG_KEYFRODO_LOG_SECRETFRODO_DEBUG#141: Add curlirizer support for troubleshooting. The library can output curl commands for every REST API call it makes. Clients can use this functionality by registering a curlirize handler and enabling the feature:
import { state } from '@rockcarver/frodo-lib';
/**
* Output a curlirize message
* @param {string} message the message
*/
export function curlirizeMessage(message) {
if (!message) return;
console.error(message['brightBlue']);
}
state.setCurlirizeHandler(curlirizeMessage);Added new raw Saml2 API functions that use the classic (pre 7.0.0) SAML REST APIs. This allows Frodo to export and import SAML entity providers from pre 7 platform instances.
import { Saml2 } from '@rockcarver/frodo-lib';
const { getRawProviders, getRawProvider, putRawProvider } = Saml2;More automated tests
Frodo Libray for clarity in notifications.enableJourney and disableJourney funtions to JourneyOps.ts in support of new frodo-cli commands frodo journey enable and frodo journey disablepremium and cloud.400 - invalid attribute errors and retrying without the attributes. This is necessary to import journeys exported from a different version requiring different configuration options. Use the --verbose parameter to see when invalid attributes are being removed on import.frodo journey describe command to include more detailsfrodo idm export -A -D ./idm <host> command/parent/childFrodo now allows two new parameters when adding a connection profile:
--authentication-service [service] Name of the authentication service/tree to use.
--authentication-header-overrides [headers] Map of headers: {"host":"am.example.com:8081"}.
These parameters are currently only supported in the frodo conn add command and the configuration elements will be automatically applied to commands issued using that connection profile.
% frodo conn add https://platform.example.com:9443/am username password --authentication-service ldapService --authentication-header-overrides '{"host":"am.example.com:8081"}' -k
ForgeOps deployment detected.
Connected to ForgeRock Access Management 7.2.0 Build 64ef7ebc01ed3df1a1264d7b0400351bc101361f (2022-June-27 08:15)
Saving creds in /Users/vscheuber/.frodo/.frodorc...
Updating connection profile https://platform.example.com:9443/am
Advanced setting: Authentication Service: ldapService
Advanced setting: Authentication Header Overrides:
{ host: 'am.example.com:8081' }
%After the connection profile is created with the additional parameters, the environment can be accessed as usual. In this case it requires the -k parameter for every command, as the environment uses a self-signed certificate.
% frodo journey list platform alpha -k
ForgeOps deployment detected.
Connected to ForgeRock Access Management 7.2.0 Build 64ef7ebc01ed3df1a1264d7b0400351bc101361f (2022-June-27 08:15)
Listing journeys in realm "alpha"...
Agent
Example
Facebook-ProvisionIDMAccount
Google-AnonymousUser
Google-DynamicAccountCreation
HmacOneTimePassword
PersistentCookie
PlatformForgottenUsername
PlatformLogin
PlatformProgressiveProfile
PlatformRegistration
PlatformResetPassword
PlatformUpdatePassword
RetryLimit
%frodo email template list <host> now runs properlyfrodo journey describe <host>) now runs properlyfrodo journey list -l <host> now runs properlyfrodo idp export -A <host> now runs properlyfrodo saml export -A <host> now runs properlyfrodo journey export -A <host> now runs properlyfrodo-cli binary builds.frodo-lib is now a typescript project.frodo-lib is now a hybrid npm package supporting both ES modules and CommonJS modules.--no-deps option to journey export/import commands. This allows users to omit all external dependencies from a journey export and/or import. One use case where this comes in handy is when using frodo as a CI/CD tool to extract and deploy individual configuration artifacts and it is desirable to not mingle multiple types of configuration in a single file but keep each type of configuration in its own file for version and change control.--verbose option to journey export command.frodo log tail command.frodo journey import command.frodo journey import command.frodo logs tail command.frodo log tail command.frodo journey import command.frodo journey import command.frodo logs tail command.HTTPS_PROXY=<protocol>://<host>:<port>)
Frodo now supports using system enviroment variable HTTPS_PROXY (and HTTP_PROXY) to connect through a network proxy.frodo realm describe command:-n/--name parameteresv apply commandidm list commandidm sub-commands to align with other commands:export, exportAll, and exportAllRaw have been collapsed into one: exportidm export -A (--all-separate) is now the way to export all idm configuration.-e and -E select old exportAll functionality with variable replacement and filtering-e and -E, selects the old exportAllRaw functionality without variable replacement and without filteringidm export command:<frodo home>/resources/sampleEntitiesFile.json<frodo home>/resources/sampleEnvFile.env-N/--name option of the count command has been renamed to -m/--managed-objectidm count command-l/--long option to script list commandfrodo conn add to validate connection details by default and renamed parameter from --validate to --no-validate to allow disabling validation<name>/<version> (e.g. frodo/0.7.1-1)realm details to realm describe but registered realm details as an alias for backwards compatibilityapp but registered application as an alias for backwards compatibility-i/--id to -i/--app-id. Short version is not impacted by rename.conn describe command to describe connection profiles--show-secrets option to conn describe command to show clear-text secrets--validate option to conn add command to validate credentials before addingconn with aliases connection and connections for backwards compatibility