kubero-dev / kubero-dev/kubero

oauth2 login is not enforced and does not work - potential missing documentation

Open
#755 0 comments 1 reaction 0 assignees View on GitHub
bug
Dominant language
TypeScript
Stars
4.4k
Forks
213
PR merge metrics
No merged PRs in 30d

Description

### Which component(s) is affected?

Kubero UI

### Describe the bug

I configured Kubero according to the latest documentation with `kubero.auth.oauth2.enabled` set to `true` and all the relevant values filled out;

```
....
spec:
kubero:
readonly: false
webhook_url: https://....
auth:
oauth2:
enabled: true
....
```

First thing is that the container refused to run unless I also set `OAUTH2_CLIENT_SECRET` in the secret. Which is weird, because in the documentation it says to (also?) set this in the oauth2 config. Both are now set.

This does nothing. The UI just shows up without ANY authentication at all. I can open the URL and it just goes into the UI and I can perform all operations.

Next I set `KUBERO_USERS` to an empty list (`W10=` which is base64 for `[]`).
Now the UI shows a login form, but only for username and password.

There is no indication in the documentation on how to log in with oauth2 or how to enforce it.

### Steps to reproduce

1. Deploy kubero as per documentation
2. Edit the deployment config to set up oauth2
3. Restart the pod or re-do the deployment
4. Open the UI - no login of any kind is enforced

### Expected behavior

I expect the login screen to show up and offer me an option to log in with oauth2.
If local users are enabled (even as empty list), I expect some option to go for oauth2.

### Screenshots

Image

### Additional information

_No response_

### Debug information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the deployment from the documentation with kubero.auth.oauth2.enabled, OAUTH2_CLIENT_SECRET, and KUBERO_USERS configured as described. Inspect the Kubero UI login flow and deployment configuration to determine why OAuth2 is not offered or enforced. Done means OAuth2 behavior matches the expected login flow and the required configuration is documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
kubernetes, typescript
Domain
authentication, documentation, frontend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.