hashicorp / hashicorp/vault-plugin-auth-jwt
Using Openshift platform as OIDC provider
- Dominant language
- Go
- Stars
- 107
- Forks
- 73
- Avg merge
- 13h 49m
- Merged PRs (30d)
- 7
Description
Hi,
I'm trying to use Openshift as a OIDC provider as mentioned in these docs: https://docs.openshift.com/container-platform/4.13/authentication/configuring-oauth-clients.html
I also tackled the issue in which Openshift isn't providing the correct jwks_uri by upgrading towards 4.15 as mentioned in: https://github.com/openshift/cluster-kube-apiserver-operator/pull/1578
This is the response that Openshift provides:
```
sh-4.4$ curl -s https://kubernetes.default.svc/.well-known/openid-configuration -k | python3 -m json.tool
{
"issuer": "https://kubernetes.default.svc",
"jwks_uri": "https://api.okd4-example.cluster.svc:6443/openid/v1/jwks",
"response_types_supported": [
"id_token"
],
"subject_types_supported": [
"public"
],
"id_token_signing_alg_values_supported": [
"RS256"
]
}
```
I followed these docs to configure Vault: https://developer.hashicorp.com/vault/tutorials/auth-methods/oidc-auth. I adjusted the OIDC endpoint towards the Openshift one & also configured my OAuthClient:
```
oc get OAuthClient/vault -o yaml
apiVersion: oauth.openshift.io/v1
grantMethod: auto
kind: OAuthClient
metadata:
creationTimestamp: "2024-05-29T07:13:40Z"
name: vault
resourceVersion: "182621425"
uid: 3c327138-e549-405e-9119-e1dd17155641
redirectURIs:
- https://vault.okd4-example.cluster.svc:/ui/vault/auth/oidc/oidc/callback
- http://localhost:8250/oidc/callback
secret: myS3cr3t
```
When attempting a login with oidc in Vault webinterface I get a popup which opens the Vault login page again.
This is the result when attempting a login from inside the vault pod via cl:
```
oc rsh vault-0
/ $ vault login -method=oidc role="reader"
Complete the login via your OIDC provider. Launching browser to:
?client_id=vault&code_challenge=mL-Xe3GgAa5aAxoWRZW8Mk12gcJ5zb86W6P0yFDfkQ0&code_challenge_method=S256&nonce=n_jZLdlJBaTm8PvCQQvMWJ&redirect_uri=http%3A%2F%2Flocalhost%3A8250%2Foidc%2Fcallback&response_type=code&scope=openid&state=st_kUrXrregO0PngPAuRMgE
Error attempting to automatically open browser: '1 error occurred:
* exec: "xdg-open": executable file not found in $PATH
'.
Please visit the authorization URL manually.Waiting for OIDC authentication to complete...
```
as you can see the authURL is not correct; it only contains the params and not an actual domain.
I'm having trouble to locate where this issue can be situatued. On which values is this url assembled? I have the feeling that Openshift does not provide a required param, but then I need to know which one in order to go back to Redhat support.
Are there any experiences in using Openshift as OIDC provider?
Thanks
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.