Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-38349

OpenID IDP endpoint verification fails when hostname can only be resolved by data plane

XMLWordPrintable

    • Moderate
    • None
    • False
    • Hide

      None

      Show
      None
    • Hide
      *Cause*: When a hosted cluster proxy is configured and it uses an idp that has a http/https endpoint, the hostname of the idp is not resolved before sending it through the proxy.
      *Consequence*: Host names that can only be resolved by the data plane fail to resolve for idps.
      *Fix*: Perform dns lookup before sending idp traffic through konnectivity tunnel.
      *Result*: IDPs with hostnames that can only be resolved by the data plane can be verified by the control plane operator.
      Show
      *Cause*: When a hosted cluster proxy is configured and it uses an idp that has a http/https endpoint, the hostname of the idp is not resolved before sending it through the proxy. *Consequence*: Host names that can only be resolved by the data plane fail to resolve for idps. *Fix*: Perform dns lookup before sending idp traffic through konnectivity tunnel. *Result*: IDPs with hostnames that can only be resolved by the data plane can be verified by the control plane operator.
    • Bug Fix
    • In Progress

      Description of problem:

      When using configuring an OpenID idp that can only be accessed via the data plane, if the hostname of the provider can only be resolved by the data plane, reconciliation of the idp fails.

      Version-Release number of selected component (if applicable):

          4.16

      How reproducible:

          always

      Steps to Reproduce:

          1. Configure an OpenID idp on a HostedCluster with a URL that points to a service in the dataplane (like https://keycloak.keycloak.svc)

      Actual results:

          The oauth server fails to be reconciled

      Expected results:

          The oauth server reconciles and functions properly

      Additional info:

          Follow up to OCPBUGS-37753

              cewong@redhat.com Cesar Wong
              cewong@redhat.com Cesar Wong
              Jie Zhao Jie Zhao
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated: