-
Bug
-
Resolution: Not a Bug
-
Undefined
-
None
-
4.17
-
None
-
Quality / Stability / Reliability
-
False
-
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
Description of problem:
I created an openid provider. Keycloak/RHBK 26.0
Version-Release number of selected component (if applicable):
How reproducible:
Keycloak with user which is member of a group
IDP contains
claims:
...
groups:
- groups
Steps to Reproduce:
1. create RHBK
- create realm
- create user
- create group
- add user to group
- create client
2. create secret for client
3. create IDP
- name: rhbk
openID:
claims:
email:
- email
name:
- name
preferredUsername:
- preferred_username
groups:
- groups
clientID: ocp
clientSecret:
name: rhbk-secret
issuer: 'https://keycloak-rhbk.apps.<openshift-domain>/realms/ocp-realm'
type: OpenID
4. login with IDP rhbk and user
Actual results:
NS: openshift-authentication Pod: oauth-openshift-f7cbdc5b9-8gb7t E0212 06:41:33.325983 1 errorpage.go:28] AuthenticationError: Group.user.openshift.io "/rhbk-idp" is invalid: metadata.name: Invalid value: "/rhbk-idp": may not contain '/'
Expected results:
no error, login should work
Additional info:
when the claim for group is removed, login works, but group does not exist Group is documented at https://docs.openshift.com/container-platform/4.17/authentication/identity_providers/configuring-oidc-identity-provider.html#identity-provider-oidc-CR_configuring-oidc-identity-provider