clean up oidc-gen call
@@ -6,7 +6,17 @@ users have to either register a client manually or use a preregistered public cl
Example:
```
-$ oidc-gen --pub --issuer https://aai.egi.eu/oidc --scope "eduperson_entitlement email" <shortname>
+$ oidc-gen --pub --issuer https://aai.egi.eu/oidc \
+ --scope "email \
+ eduperson_entitlement \
+ eduperson_scoped_affiliation \
+ eduperson_unique_id" <shortname>
+```
+You will need to follow the OIDC-flow, which usually involves
+authentication in a web-browser. If the browser does not start, you can
+copy paste the displayed URL.
+
+```
[...]
Generating account configuration ...
accepted
@@ -15,13 +25,21 @@ https://[...]
[...]
Polling oidc-agent to get the generated account configuration .....success
The generated account config was successfully added to oidc-agent. You don't have to run oidc-add.
+```
+
+Finally, you will be be asked for a password on
+the commandline to safely score your credentials.
+```
Enter encryption password for account configuration '<shortname>':
Confirm encryption Password:
```
-Note that you need to run the webbrowser on the same host as the
+**Note**: You need to run the webbrowser on the same host as the
`oidc-gen` command.
+\
+If you operate on a remote machine, you need to use the
+`device-code-flow`, by adding `--flow=device` to the above commandline.
Advanced users may succeed by otherwise ensuring that the browser you are using can connect to the host on
which `oidc-gen` and `oidc-agent` run on ports 4242, 8080 or 43985.
