Uploaded image for project: 'Red Hat Developer Hub Bugs'
  1. Red Hat Developer Hub Bugs
  2. RHDHBUGS-1823

OIDC auth provider attempts to map local part of email with catalog user entity

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Blocker Blocker
    • 1.2
    • None
    • Authentication
    • None
    • False
    • Hide

      None

      Show
      None
    • False
    • Release Note Not Required

      Description of problem:

      When trying to login to RHDH with the OIDC auth provider configured for keycloak, the auth provider will try to find an existing user entity in the catalog matching the local part of the email the user logged in with.

      However, the keycloak plugin entity provider ingests the users and assigns the username as the entityrefs. This results in a mismatch and user login will fail to with a `User Not Found` error.

      Prerequisites (if any, like setup, operators/versions):

      • RHDH 1.2-68 CI build
      • OIDC auth provider set up in the `catalog-info.yaml`
      • Keycloak instance (I personally used keycloak 24.0.3)
      • Keycloak backend plugin (to ingest users) v1.8.11 (dynamically installed)
      • Installed with the 1.1.2 helm chart

      Steps to Reproduce

      1. Setup keycloak instance following this guide (no need to setup the sidecar container since we're using OIDC).
      2. Setup the redirect URL to ` {RHDH_BACKEND}

        /api/auth/oidc/handler/frame`

      3. Create user with verified email (make sure local part of email and username don't match) ex: username: test, email: tester@test.com
      4. Configure OIDC auth provider with keycloak url, clientId, clientSecret according to this guide
      5. Enable the keycloak backend plugin and configure it with the client information of the keycloak instance to ingest the user
      6. Log in with OIDC

      Actual results:

      Login fails with User Not Found

      Expected results:

      Log in without issue and be mapped to the corresponding user entity ingested by the keycloak backend

      Reproducibility (Always/Intermittent/Only Once):

      Always

      Build Details:

      • RHDH 1.2-68 CI build
      • OIDC auth provider set up in the `catalog-info.yaml`
      • Keycloak instance (I personally used keycloak 24.0.3)
      • Keycloak backend plugin (to ingest users) v1.8.11 (dynamically installed)
      • Installed with the 1.1.2 helm chart

      Additional info (Such as Logs, Screenshots, etc):

              rh-ee-frkong Frank Kong
              rh-ee-frkong Frank Kong
              RHIDP - Cope
              Votes:
              1 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: