-
Bug
-
Resolution: Not a Bug
-
Undefined
-
None
-
4.20, 4.21
-
None
-
Quality / Stability / Reliability
-
False
-
-
None
-
Critical
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
Description of problem:
Console login in external oidc env succeeds if the application client doesn't use PKCE (Proof Key for Code Exchange). But console login in external oidc env fails if the application client uses PKCE (Proof Key for Code Exchange). oc login works with PKCE application, doesn't have the issue.
Version-Release number of selected component (if applicable):
4.20.0-0.nightly-2025-09-10-095237
How reproducible:
Always
Steps to Reproduce:
1. Create applications in the 3-rd party oidc provider. Enable PKCE on them. 2. Launch a HyperShift hosted cluster or OCP cluster with external oidc configuration, using above 3-rd party oidc provider and the applications. 3. Test oc login and console login
Actual results:
oc login works. But console login fails. After open the console URL, the browser address bar shows error, like `https://console-openshift-console.apps.<xxxx>/auth/error?error=PKCE+code+challenge+is+required+by+the+application.&error_type=auth` (Okta, see the screenshot https://drive.google.com/file/d/1qMsYA1RCFuGUUTTiw89D42YYOv3vSkPH/view?usp=drive_link ) or `https://console-openshift-console.apps.<xxxx>/auth/error?error=Missing+parameter%3A+code_challenge_method&error_type=auth` (Keycloak, see the screenshot https://drive.google.com/file/d/1t9I7P87P0eMtBkPE-Gcs-zVd6yDy3Dp9/view?usp=drive_link ). And the browser page shows sth like: Authentication error There was an authentication error. Please log out and try again. If the problem persists, contact a cluster administrator, Red Hat Support or check our status page for known outages. Try again
Expected results:
Console login should succeed.
Additional info:
- causes
-
RFE-8158 Support PKCE (Proof Key for Code Exchange) in Console OIDC Login Flow
-
- Backlog
-
- is related to
-
HOSTEDCP-1246 hypershift control plane wired with external oidc
-
- Closed
-