Uploaded image for project: 'OpenShift Request For Enhancement'
  1. OpenShift Request For Enhancement
  2. RFE-3124

Non cluster-admin users should be able to change their own password in RHOCP 4

XMLWordPrintable

    • None
    • Product / Portfolio Work
    • None
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • None
    • None

      1. Proposed title of this feature request
      Non cluster-admin users should be able to change their own password in RHOCP 4.

      2. What is the nature and description of the request?
      As of now only Cluster admin can reset the user password for any user added in the cluster using htpasswd Identityprovider,
      However end users should also be able to maintain his/her own passwords.

      In OCP only cluster administrator can change all user passwords.
      If we compare this with OS user management, root user creates a new user and sets the initial password.
      Subsequently user is allowed to change its own password in OCP.

      3. Why does the customer need this? (List the business requirements here)
      As customer mentioned :
      Having a cluster-admin change / manage the passwords for all users is an overhead for cluster administrator
      Running htpasswd with -c will recreate the htpasswd file and cluster admin can accidently create a secret based on wrong file, which means previously created users will be lost
      Cluster admin user and end user knowing same password for that user is compromise on user access.
      Cluster admin can have privilege to reset the user password, but end user should be able to maintain his/her own password.

      4. List any affected packages or components.

      Additional Details : Users are getting created like mentioned below -
      $ htpasswd -B -b users.htpasswd ocpdev ocpdev
      $ oc create secret generic users-secret --from-file=htpasswd=/root/users.htpasswd -n openshift-config
      $ cat htpasswdcr.yaml
      ~~~
      apiVersion: config.openshift.io/v1
      kind: OAuth
      metadata:
        name: cluster
      spec:
        identityProviders:
        - name: IDP
          mappingMethod: claim 
          type: HTPasswd
          htpasswd:
            fileData:
              name: users-secret
      ~~~
      $ oc apply -f htpasswdcr.yaml

              atelang@redhat.com Anjali Telang
              rhn-support-sdharma Suruchi Dharma
              None
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved:
                None
                None