Uploaded image for project: 'Ansible Automation Platform RFEs'
  1. Ansible Automation Platform RFEs
  2. AAPRFE-2622

Ensure that the JWT_ALGORITHM field for OIDC authentication methods is set and provide adequate warnings otherwise

XMLWordPrintable

    • Icon: Feature Request Feature Request
    • Resolution: Unresolved
    • Icon: Normal Normal
    • None
    • 2.5, 2.6
    • aap-ui, platform-gateway
    • None
    • False
    • Hide

      None

      Show
      None
    • False

      What is the nature and description of the request?

      As the misconfiguration of the JWT_ALGORITHM fields leads to the authentication being unable to process the login requests it would help to have the field marked as required or at least a direct query the authentication method default endpoints to retrieve the list of supported algorithms, in any case provide a warning when left empty.

      Why does the customer need this? (List the business requirements here)

      This change will help the customer having a consistent experience across updates and configurations and assist in deflecting issues by raising warnings and errors during the configuration step itself instead of having to face them at login time during seemingly unrelated changes of the configuration.

      How would you like to achieve this? (List the functional requirements here)

      Either set it required by default and update the help tooltip to refer to the default endpoint examples, like this:

      https://<oidc host>/auth/realms/<realm>/.well-known/openid-configuration

      This change should also be reported on the documentation page:

      https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5/html-single/access_management_and_authentication/index#config-jwt-algorithms

      https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/html-single/access_management_and_authentication/index#troubleshoot-generic-oidc

      The endpoint could eventually be pinged automatically or with the use of a button in the UI that attempts to make the request to the URL defaults and return the json response filtered on the field id_token_signing_alg_values_supported or the error response, this will allow the customer to continue investigating the problem on its own or use the expected algorithm otherwise.

      In any case, a warning that the field has been left empty will help reducing unexpected issues.

       

              Unassigned Unassigned
              rhn-support-mcanu Matteo Canu
              Votes:
              1 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: