Running Tcl scripts with a container

All OneSpan Authentication Server images contain the Tcl Command-Line Administration tool (dpadmincmd) to run Tcl scripts inside the containers.

You can run Tcl scripts the following ways:

• Locally using a standalone OneSpan Authentication Server container
• Inside a running OneSpan Authentication Server container

Running a Tcl script locally

To execute a Tcl script locally using a OneSpan Authentication Server container, run the following command:

docker run --rm \
  -v <path_to_tcl_script>:/tcl/<tcl_script> \
  -v <path_to_dpadmincmd_xml>:/etc/vasco/ias/dpadmincmd.xml \
  -v <path_to_seal_sslcert_ca_pem>:/tcl/seal-sslcert-ca.pem \
  onespan_ias_maria:<release_version> \
  /opt/vasco/ias/bin/dpadmincmd -u <admin_username> -p <admin_password> \
  /tcl/<tcl_script>

Replace the following:

• path_to_tcl_script. The absolute path to the Tcl script on the host system that is mounted into the container.
• tcl_script. The name of the Tcl script without the path that is mounted into the container.
• path_to_dpadmincmd_xml. The absolute path to the Tcl Command-Line Administration tool configuration file (dpadmincmd.xml) on the host system that is mounted into the container, e.g. ./tcl/dpadmincmd.xml.
• path_to_seal_sslcert_ca_pem. The full path to the SEAL SSL CA certificate on the host system that is mounted into the container, e.g. ./secrets/ias/sslcert.pem.
• release_version. The specific version of the images distributed in the package, e.g. 3.27.0.1234.
• admin_username. The user name of an administrative user to connect to OneSpan Authentication Server as it is defined in the secrets section of the used deployment configuration file.
• admin_password. The corresponding password of admin_username as it is defined in the secrets section of the used deployment configuration file.

The Tcl Command-Line Administration tool configuration file (dpadmincmd.xml) must correctly configure the SEAL connection to the OneSpan Authentication Server instance. Note the following:

• The SEAL SSL CA certificate path must point to the certificate mounted inside the container (e.g. /tcl/seal-sslcert-ca.pem).
• The address and SSL SEAL port of the target OneSpan Authentication Server instance must be reachable from the host machine.

Running a Tcl script inside a OneSpan Authentication Server container

Before you can run a Tcl script inside a OneSpan Authentication Server container, you need to copy or mount the Tcl script into the container when you deploy it.

To copy Tcl scripts into the containers, use the docker cp or kubectl cp commands.

The example Docker configuration files contained in the package mount the tcl folder in the OneSpan Authentication Server containers at /config/tcl. This means that you can run Tcl scripts from that folder with the following command:

docker compose exec ias \
  /opt/vasco/ias/bin/dpadmincmd -u <admin_username> -p <admin_password> \
  <tcl_script>

Replace the following:

• admin_username. The user name of an administrative user to connect to OneSpan Authentication Server as it is defined in the secrets section of the used deployment configuration file.
• admin_password. The corresponding password of admin_username as it is defined in the secrets section of the used deployment configuration file.
• tcl_script. The name of the Tcl script without the path that is mounted into the container.