Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-38349

OpenID IDP endpoint verification fails when hostname can only be resolved by data plane

XMLWordPrintable

    • Moderate
    • None
    • False
    • Hide

      None

      Show
      None
    • Hide
      *Cause*: When a hosted cluster proxy is configured and it uses an idp that has a http/https endpoint, the hostname of the idp is not resolved before sending it through the proxy.
      *Consequence*: Host names that can only be resolved by the data plane fail to resolve for idps.
      *Fix*: Perform dns lookup before sending idp traffic through konnectivity tunnel.
      *Result*: IDPs with hostnames that can only be resolved by the data plane can be verified by the control plane operator.
      Show
      *Cause*: When a hosted cluster proxy is configured and it uses an idp that has a http/https endpoint, the hostname of the idp is not resolved before sending it through the proxy. *Consequence*: Host names that can only be resolved by the data plane fail to resolve for idps. *Fix*: Perform dns lookup before sending idp traffic through konnectivity tunnel. *Result*: IDPs with hostnames that can only be resolved by the data plane can be verified by the control plane operator.
    • Bug Fix
    • In Progress

      Description of problem:

      When using configuring an OpenID idp that can only be accessed via the data plane, if the hostname of the provider can only be resolved by the data plane, reconciliation of the idp fails.

      Version-Release number of selected component (if applicable):

          4.16

      How reproducible:

          always

      Steps to Reproduce:

          1. Configure an OpenID idp on a HostedCluster with a URL that points to a service in the dataplane (like https://keycloak.keycloak.svc)

      Actual results:

          The oauth server fails to be reconciled

      Expected results:

          The oauth server reconciles and functions properly

      Additional info:

          Follow up to OCPBUGS-37753

            cewong@redhat.com Cesar Wong
            cewong@redhat.com Cesar Wong
            Jie Zhao Jie Zhao
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

              Created:
              Updated: