-
Feature Request
-
Resolution: Won't Do
-
Minor
-
None
-
None
-
None
-
Product / Portfolio Work
-
None
-
False
-
-
None
-
None
-
-
-
None
-
-
None
-
None
-
None
1. Proposed title of this feature request
Non cluster-admin users should be able to change their own password in RHOCP 4.
2. What is the nature and description of the request?
As of now only Cluster admin can reset the user password for any user added in the cluster using htpasswd Identityprovider,
However end users should also be able to maintain his/her own passwords.
In OCP only cluster administrator can change all user passwords.
If we compare this with OS user management, root user creates a new user and sets the initial password.
Subsequently user is allowed to change its own password in OCP.
3. Why does the customer need this? (List the business requirements here)
As customer mentioned :
Having a cluster-admin change / manage the passwords for all users is an overhead for cluster administrator
Running htpasswd with -c will recreate the htpasswd file and cluster admin can accidently create a secret based on wrong file, which means previously created users will be lost
Cluster admin user and end user knowing same password for that user is compromise on user access.
Cluster admin can have privilege to reset the user password, but end user should be able to maintain his/her own password.
4. List any affected packages or components.
Additional Details : Users are getting created like mentioned below -
$ htpasswd -B -b users.htpasswd ocpdev ocpdev
$ oc create secret generic users-secret --from-file=htpasswd=/root/users.htpasswd -n openshift-config
$ cat htpasswdcr.yaml
~~~
apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
name: cluster
spec:
identityProviders:
- name: IDP
mappingMethod: claim
type: HTPasswd
htpasswd:
fileData:
name: users-secret
~~~
$ oc apply -f htpasswdcr.yaml