-
Feature Request
-
Resolution: Unresolved
-
Normal
-
None
-
None
-
None
-
Product / Portfolio Work
-
None
-
False
-
-
None
-
None
-
None
-
-
None
-
None
-
None
-
None
-
None
- Proposed title of this feature request
Support DPoP (Demonstrating Proof-of-Possession) in oc-oidc plugin for oc cli with BYO external auth.
2. What is the nature and description of the request?
Currently Cu is unable to use oc cli with his organization OIDC IdP. Within his organization, DPoP is required for public clients.
Example command:
oc login --exec-plugin=oc-oidc --issuer-url=[OIDC-ISSUER] --client-id=[CLIENT-ID] --extra-scopes=email --callback-port=8081 [API-ENDPOINT]
3. Why does the customer need this? (List the business requirements here)
Without this feature Cu is unable to use oc cli with OIDC IdP within his organization.
As a consequence, he is unable to deploy OpenShift clusters at scale.
DPoP is a security feature. As per RFC 9700 "Best Current Practice for OAuth 2.0 Security" DPoP should be used to prevent misuse of leaked tokens.
4. List any affected packages or components.
oc OpenShift cli, oc-oidc plugin.