Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-59353

Console's handling on the login scenarios should have useful prompts instead of be stuck in a quite misleading loop

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Normal Normal
    • None
    • 4.20.0
    • Management Console
    • None
    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • None
    • Moderate
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      Description of problem:

      After configure external odic provider in authentication cluster, cannot login to console, always endless loop to redirect to console. 
          

      Version-Release number of selected component (if applicable):

          v 4.20
          

      How reproducible:

           always
          

      Steps to Reproduce:

          1. Install external identity provider and configure callbackURL : https://<console_route>/auth/callback
          2. Login to openshift  and enable exteral oidc feature
          $oc patch featuregate/cluster -p   '{"spec":{"featureSet": "TechPreviewNoUpgrade"}}'  --type=merge
           
          3. Create secret with  client secret
              $oc create secret generic gitlab-secret --from-literal=clientSecret=<client-secret> -n openshift-config
      
          4. Configure gitlab as oidc provider 
      ```
        spec:
        oidcProviders:
        - claimMappings:
            groups:
              claim: groups
              prefix: 'oidc-groups-test:'
            username:
              claim: "email"
              prefixPolicy: "Prefix"
              prefix:
                prefixString: "oidc-user-test:"
          name: gitlab-oidc
          issuer:
            issuerURL: "https://gitlab.com"
            audiences:
            - "<CONSOLE_CLIENT_ID"
          oidcClients:
          - clientID: "<CLIENT_ID>"
            clientSecret:
              name: "gitlab-secret"
            componentName: console
            componentNamespace: openshift-console
         type: "OIDC"
      ```
           5. Login with openshift-console,  always  redirect  page with a dead loop, 
      
            6.Check apiserver log:
      Unable to authenticate the request" err="[invalid bearer token, oidc: parse username claims \"email\": claim not present]"
          

      Actual results:
      Cannot login to console with external idp provider, here's screenshot: https://drive.google.com/file/d/1-1I_z256Ff54HK0JTxHWBB0gIivpAcWG/view

          Expected results:{code:none}
         Should login in console successfully
          

      Additional info:

      
          

              rh-ee-jonjacks Jon Jackson
              rhn-support-wewang Wen Wang
              None
              None
              Wen Wang Wen Wang
              None
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: