Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-50619

AuthenticationError: Group.user.openshift.io "/rhbk-idp" is invalid: metadata.name: Invalid value: "/rhbk-idp": may not contain '/'

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Not a Bug
    • Icon: Undefined Undefined
    • None
    • 4.17
    • oauth-apiserver
    • None
    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      Description of problem:

      I created an openid provider. Keycloak/RHBK 26.0    

      Version-Release number of selected component (if applicable):

          

      How reproducible:

      Keycloak with user which is member of a group
      IDP contains
            claims: 
              ...
              groups:
              - groups    

      Steps to Reproduce:

          1. create RHBK
          -  create realm
          -  create user
          -  create group
          -  add user to group
          -  create client
          2. create secret for client
          3. create IDP
          - name: rhbk
            openID:        
              claims:
                email:
                  - email
                name:
                  - name
                preferredUsername:
                  - preferred_username
                groups:
                  - groups
              clientID: ocp
              clientSecret:
                name: rhbk-secret
              issuer: 'https://keycloak-rhbk.apps.<openshift-domain>/realms/ocp-realm'
            type: OpenID
          4. login with IDP rhbk and user   

      Actual results:

      NS: openshift-authentication Pod: oauth-openshift-f7cbdc5b9-8gb7t
      E0212 06:41:33.325983 1 errorpage.go:28] AuthenticationError: Group.user.openshift.io "/rhbk-idp" is invalid: metadata.name: Invalid value: "/rhbk-idp": may not contain '/'    

      Expected results:

      no error, login should work    

      Additional info:

      when the claim for group is removed, login works, but group does not exist    
      
      Group is documented at
      https://docs.openshift.com/container-platform/4.17/authentication/identity_providers/configuring-oidc-identity-provider.html#identity-provider-oidc-CR_configuring-oidc-identity-provider

              Unassigned Unassigned
              rbaumgar Robert Baumgartner
              None
              None
              Xingxing Xia Xingxing Xia
              None
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: