-
Bug
-
Resolution: Unresolved
-
Undefined
-
4.19, 4.20, 4.21
-
None
-
Quality / Stability / Reliability
-
False
-
-
1
-
None
-
None
-
None
-
None
-
None
-
OSDOCS Sprint 279, OSDOCS sprint 280
-
2
-
None
-
None
-
None
-
None
-
None
-
None
-
None
Description of problem:
If Console is not enabled, `oidcClients` should not be set when setting external oidc as auth provider, there is no such note or message in the authtication doc
set oidcClients when console is not enable, will prompt errors:
The Authentication "cluster" is invalid: <nil>: Invalid value: "object": no such key: oidcClients evaluating rule: all oidcClients in the oidcProviders must match their componentName and componentNamespace to either a previously configured oidcClient or they must exist in the status.oidcClients
Version-Release number of selected component (if applicable):
4.19+
How reproducible:
always
Steps to Reproduce:
1. oc get co console
Error from server (NotFound): clusteroperators.config.openshift.io "console" not found
oc patch authentication.config/cluster --type=merge -p="
spec:
oidcProviders:
- claimMappings:
groups:
claim: groups
prefix: 'oidc-groups-test:'
username:
claim: email
prefixPolicy: Prefix
prefix:
prefixString: 'oidc-user-test:'
issuer:
audiences:
- $CONSOLE_CLIENT_ID
- $CLI_CLIENT_ID
issuerURL: $ISSUER_URL
name: microsoft-entra-id
oidcClients:
- clientID: $CONSOLE_CLIENT_ID
clientSecret:
name: $CONSOLE_CLIENT_SECRET_NAME
componentName: console
componentNamespace: openshift-console
type: OIDC
webhookTokenAuthenticator: null
"
The Authentication "cluster" is invalid: <nil>: Invalid value: "object": no such key: oidcClients evaluating rule: all oidcClients in the oidcProviders must match their componentName and componentNamespace to either a previously configured oidcClient or they must exist in the status.oidcClients
2.Could set external oidc without oidcClients when console is not enabled
oc patch authentication.config/cluster --type=merge -p="
spec:
oidcProviders:
- claimMappings:
groups:
claim: groups
prefix: 'oidc-groups-test:'
username:
claim: email
prefixPolicy: Prefix
prefix:
prefixString: 'oidc-user-test:'
issuer:
audiences:
- $CLI_CLIENT_ID
issuerURL: $ISSUER_URL
name: microsoft-entra-id
type: OIDC
webhookTokenAuthenticator: null
"
authentication.config.openshift.io/cluster patched
oc login --exec-plugin=oc-oidc --issuer-url=$ISSUER_URL --client-id=$CLI_CLIENT_ID --extra-scopes=email --callback-port=8080
Please visit the following URL in your browser: http://localhost:8080/
Logged into "https://api.wxj-no-console.qe.devcluster.openshift.com:6443" as "oidc-user-test:xiuwang@redhat.com" from an external oidc issuer.
You don't have any projects. Contact your system administrator to request a project.
❯ oc auth whoami
ATTRIBUTE VALUE
Username oidc-user-test:xiuwang@redhat.com
UID *****
Groups **** system:authenticated]
3.
Actual results:
Expected results:
Need update authtication doc to add such note
Additional info:
- documents
-
OCPBUGS-59353 Console pod shows panics due to handling some negative user login scenarios not well, including stuck in a quite misleading forever loop
-
- ASSIGNED
-