Problem:

At the end of 2023, the IT team will discontinue support for the Resource Owner Password Credentials (ROPC) Oauth Grant type, Offline Tokens and Basic Authentication. 

The HCC team is working on implementing Service Accounts with RBAC support as an alternative to these basic authentication methods. This is planned for 2023 Q3. (More communications will come once Q3 Planning is finalized and we have a refined timeline). 

In preparation for this change, we are asking teams to start thinking about how they use the external SSO today (in any environment) to help define future strategies for updating to supported auth methods later this year. This includes:

• API authentication,

• QE tests and test automation,

• Black box tests,

• Other peripheral internal tests that depend on the external SSO.

Goal:

This will require changes from teams and services currently using sso.redhat.com ("external SSO"). 

Additional information:

Please review the following post from IT's CIAM team for details of the change, requirements, background information, and references: Resource Owner Password Credentials grant to be removed.

• Relevant Jira(s): 
• RHCLOUD-26141 : Clone this user story and move it to your team's backlog to begin documenting the impact of this change 
• Service Accounts: CRCPLAN-185
  • The updated timeline, project status and additional information can be found on the source: HCC Service Accounts as an Alternative to Basic Auth.
  • Service Accounts are live in Stage/Preview: https://console.stage.redhat.com/preview/iam/service-accounts
  • ADR document Service Account Integration in 3Scale/RBAC
    • (To support the deprecation of basic authentication, the Access & Management team is proposing a change to support Service Account authorization of resources within console.redhat.com)
      • Modifying the 3scale API Gateway to allow service account traffic
      • Modifying RBAC to allow service-account principals to be associated with user groups

• Contacts and additional support: 
• For IT or CIAM related questions: IT User Community (Google Chat space) or ciams-client-integration@redhat.com (Email)
• For Console related questions: #team-consoledot-accessmanagement (Slack)

ConsoleDot Actions Required & Releases Source page is here.