Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-61564

Console login in external oidc env fails if the application client uses PKCE

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Not a Bug
    • Icon: Undefined Undefined
    • None
    • 4.20, 4.21
    • Management Console
    • None
    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • None
    • Critical
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      Description of problem:

      Console login in external oidc env succeeds if the application client doesn't use PKCE (Proof Key for Code Exchange).
      
      But console login in external oidc env fails if the application client uses PKCE (Proof Key for 
      Code Exchange).
      
      oc login works with PKCE application, doesn't have the issue.
      

      Version-Release number of selected component (if applicable):

      4.20.0-0.nightly-2025-09-10-095237
      

      How reproducible:

      Always
      

      Steps to Reproduce:

      1. Create applications in the 3-rd party oidc provider. Enable PKCE on them.
      2. Launch a HyperShift hosted cluster or OCP cluster with external oidc configuration, using above 3-rd party oidc provider and the applications.
      3. Test oc login and console login
      

      Actual results:

      oc login works. But console login fails. After open the console URL, the browser address bar shows error, like `https://console-openshift-console.apps.<xxxx>/auth/error?error=PKCE+code+challenge+is+required+by+the+application.&error_type=auth` (Okta, see the screenshot https://drive.google.com/file/d/1qMsYA1RCFuGUUTTiw89D42YYOv3vSkPH/view?usp=drive_link ) or `https://console-openshift-console.apps.<xxxx>/auth/error?error=Missing+parameter%3A+code_challenge_method&error_type=auth` (Keycloak, see the screenshot https://drive.google.com/file/d/1t9I7P87P0eMtBkPE-Gcs-zVd6yDy3Dp9/view?usp=drive_link ).
      
      And the browser page shows sth like:
                                              Authentication error
                             There was an authentication error. Please log out and try again.
      If the problem persists, contact a cluster administrator, Red Hat Support or check our status page for known outages.
                                                  Try again

      Expected results:

      Console login should succeed.
      

      Additional info:

       

       

              jhadvig@redhat.com Jakub Hadvig
              xxia-1 Xingxing Xia
              None
              None
              YaDan Pei YaDan Pei
              None
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: