-
Bug
-
Resolution: Unresolved
-
Normal
-
None
-
4.20.0
-
None
-
Quality / Stability / Reliability
-
False
-
-
None
-
Moderate
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
Description of problem:
After configure external odic provider in authentication cluster, cannot login to console, always endless loop to redirect to console.
Version-Release number of selected component (if applicable):
v 4.20
How reproducible:
always
Steps to Reproduce:
1. Install external identity provider and configure callbackURL : https://<console_route>/auth/callback 2. Login to openshift and enable exteral oidc feature $oc patch featuregate/cluster -p '{"spec":{"featureSet": "TechPreviewNoUpgrade"}}' --type=merge 3. Create secret with client secret $oc create secret generic gitlab-secret --from-literal=clientSecret=<client-secret> -n openshift-config 4. Configure gitlab as oidc provider ``` spec: oidcProviders: - claimMappings: groups: claim: groups prefix: 'oidc-groups-test:' username: claim: "email" prefixPolicy: "Prefix" prefix: prefixString: "oidc-user-test:" name: gitlab-oidc issuer: issuerURL: "https://gitlab.com" audiences: - "<CONSOLE_CLIENT_ID" oidcClients: - clientID: "<CLIENT_ID>" clientSecret: name: "gitlab-secret" componentName: console componentNamespace: openshift-console type: "OIDC" ``` 5. Login with openshift-console, always redirect page with a dead loop, 6.Check apiserver logļ¼ Unable to authenticate the request" err="[invalid bearer token, oidc: parse username claims \"email\": claim not present]"
Actual results:
Cannot login to console with external idp provider, here's screenshot: https://drive.google.com/file/d/1-1I_z256Ff54HK0JTxHWBB0gIivpAcWG/view
Expected results:{code:none} Should login in console successfully
Additional info: