Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-52936

'oc adm policy' shouldn't check OpenShift OAuth specific group/user resource in external OIDC cluster

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • None
    • 4.19
    • oc
    • None
    • Moderate
    • None
    • False
    • Hide

      None

      Show
      None

      Description of problem:

          Testing in latest OCP env built with cluster-bot payload `build 4.19,openshift/cluster-authentication-operator#740`, `oc adm policy add-cluster-role-to-user` and `oc adm policy add-cluster-role-to-group` still check OpenShift OAuth specific group/user resource, those should be removed after configured external OIDC

      Version-Release number of selected component (if applicable):

       cluster-bot payload built today with:
      `build 4.19,openshift/cluster-authentication-operator#740`  

      How reproducible:

          Always

      Steps to Reproduce:

      1. Launch a TechPreviewNoUpgrade standalone OCP cluster with above build.
      2. Configure Entra ID external OIDC.
      3. oc login with OIDC user
      
      Logged into "https://a065xxxx.elb.ap-southeast-1.amazonaws.com:6443" as "oidc-user-test:xiuwang@redhat.com" from an external oidc issuer.
      You don't have any projects. Contact your system administrator to request a project. 
      
       oc auth whoami
      ATTRIBUTE                                           VALUE
      Username                                            oidc-user-test:xiuwang@redhat.com
      Groups                                              [oidc-groups-test:xxxxxxxx oidc-groups-test:xxxxxxxx system:authenticated]
      Extra: authentication.kubernetes.io/credential-id   [JTI=e9991805-912d-4f74-8954-ca89c5ea63c0]
      
      4. Grant cluster-admin to OIDC user 'oidc-user-test:xiuwang@redhat.com':  
      oc adm policy add-cluster-role-to-user cluster-admin 'oidc-user-test:xiuwang@redhat.com' --context=admin
      Warning: User 'oidc-user-test:xiuwang@redhat.com' not found
      clusterrole.rbac.authorization.k8s.io/cluster-admin added: "oidc-user-test:xiuwang@redhat.com" 
      
       oc adm policy add-cluster-role-to-group self-provisioner 'oidc-groups-test:external-oidc-group' --context=admin
      Warning: Group 'oidc-groups-test:external-oidc-group' not found
      clusterrole.rbac.authorization.k8s.io/self-provisioner added: "oidc-groups-test:external-oidc-group"  

      Actual results:

          The oc cmd still checks group and user resources, and prompt warnings.

      Expected results:

          The oc cmd should not check OpenShift OAuth specific group/user resource after configured external OIDC

      Additional info:

          

              aos-workloads-staff Workloads Team Bot Account
              rh-ee-xiuwang XiuJuan Wang
              XiuJuan Wang XiuJuan Wang
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated: