-
Bug
-
Resolution: Unresolved
-
Major
-
None
-
None
-
None
-
False
-
-
False
-
-
-
None
Description of problem:
When direct authentication for external oidc is set up - and it uses extra mappings, search api breaks
Version-Release number of selected component (if applicable):
ACM 2.16
How reproducible:
Depends on configuration/mapping of OIDC elements to the cluster. This is what we have on the QE test cluster (which is based on how OCP Tests this). This is seen in specs of Authentication CR as shown here:
apiVersion: config.openshift.io/v1
kind: ClusterVersion
name: version
spec:
oidcProviders:
- claimMappings:
extra:
- key: extratest.openshift.com/foo
valueExpression: claims.email
- key: extratest.openshift.com/bar
valueExpression: '"extra-test-mark"'
....
Steps to reproduce:
- Make sure that Authentication CR has those mappings
- Try to use search.
- It will never return data and search API server pod log will have the error
Actual results:
None
search API server pod log will have the error -
E0129 07:15:38.270923 1 userData.go:336] Error creating SelfSubjectRulesReviews for namespaceuserextras.authentication.k8s.io "keycloak-testuser-1@example.com" is forbidden: User "system:serviceaccount:ocm:search-serviceaccount" cannot impersonate resource "userextras/extratest.openshift.com/foo" in API group "authentication.k8s.io" at the cluster scopeacmqe-foundation-auto-l6k24h-broker E0129 07:15:39.046536 1 userData.go:336] Error creating SelfSubjectRulesReviews for namespaceuserextras.authentication.k8s.io "extra-test-mark" is forbidden: User "system:serviceaccount:ocm:search-serviceaccount" cannot impersonate resource "userextras/extratest.openshift.com/bar" in API group "authentication.k8s.io" at the cluster scopelocal-cluster-broker E0129 07:15:42.573170 1 userData.go:336] Error creating SelfSubjectRulesReviews for namespaceuserextras.authentication.k8s.io "extra-test-mark" is forbidden: User "system:serviceaccount:ocm:search-serviceaccount" cannot impersonate resource "userextras/extratest.openshift.com/bar" in API group "authentication.k8s.io" at the cluster scopeopen-cluster-management-agent-addon-new
Expected results:
We need to show the data without error!