Uploaded image for project: 'OpenShift Request For Enhancement'
  1. OpenShift Request For Enhancement
  2. RFE-8632

Support DPoP (Demonstrating Proof-of-Possession) in oc-oidc plugin for oc cli with BYO external auth.

XMLWordPrintable

    • None
    • Product / Portfolio Work
    • None
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      1. Proposed title of this feature request

      Support DPoP (Demonstrating Proof-of-Possession) in oc-oidc plugin for oc cli with BYO external auth.
           2.  What is the nature and description of the request?
      Currently Cu is unable to use oc cli with his organization OIDC IdP. Within his organization, DPoP is required for public clients.
      Example command:
      oc login --exec-plugin=oc-oidc --issuer-url=[OIDC-ISSUER] --client-id=[CLIENT-ID] --extra-scopes=email --callback-port=8081 [API-ENDPOINT]

      3. Why does the customer need this? (List the business requirements here)
      Without this feature Cu is unable to use oc cli with OIDC IdP within his organization.
      As a consequence, he is unable to deploy OpenShift clusters at scale.
      DPoP is a security feature. As per RFC 9700 "Best Current Practice for OAuth 2.0 Security" DPoP should be used to prevent misuse of leaked tokens.

      4. List any affected packages or components.
      oc OpenShift cli, oc-oidc plugin.

              atelang@redhat.com Anjali Telang
              rhn-support-shupadhy Shivam Upadhyay
              None
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                None
                None