Bug 1261750

Summary: Can not setup authentication with LDAPPasswordIdentityProvider
Product: OpenShift Container Platform Reporter: weiwei jiang <wjiang>
Component: apiserver-authAssignee: Jordan Liggitt <jliggitt>
Status: CLOSED CURRENTRELEASE QA Contact: weiwei jiang <wjiang>
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aos-bugs, wsun
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-11-23 21:16:54 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description weiwei jiang 2015-09-10 06:20:00 UTC
Description of problem:
When setup authentication with LDAPPasswordIdentityProvider, will display a error:
# openshift start master --config=openshift.local.config/master/master-config.yaml
W0910 06:05:47.312265   13570 start_master.go:279] oauthConfig.identityProvider[0].provider.insecure: invalid value 'true', Details: validating passwords over an insecure connection could allow them to be intercepted
Invalid MasterConfig openshift.local.config/master/master-config.yaml
  oauthConfig.identityProvider[0].provider.attributes.id: invalid value '[]', Details: at least one id attribute is required (LDAP standard identity attribute is 'dn')

This is due to the PR(https://github.com/openshift/origin/pull/4264) change some config validation code.


Version-Release number of selected component (if applicable):
devenv_fedora_2313
# openshift version 
openshift v1.0.5-318-g1fb52fd
kubernetes v1.1.0-alpha.0-1605-g44c91b1


How reproducible:
always

Steps to Reproduce:
1. Set up authentication with LDAPPasswordIdentityProvider as following:
  identityProviders:
  - challenge: true
    login: true
    name: "testldap"
    provider:
      apiVersion: v1
      attributes:
        email: null
        id:
        - dn
        name:
        - cn
        preferredUsername:
        - uid
      bindDN: "cn=read-only-admin,dc=example,dc=com"
      bindPassword: "password"
      ca: ""
      kind: LDAPPasswordIdentityProvider
      insecure: true
      url: "ldap://ldap.forumsys.com/dc=example,dc=com?uid"
 
2. Start openshift master with the config file
openshift start master --config=<PATH TO CONFIG>
3.

Actual results:
# openshift start master --config=openshift.local.config/master/master-config.yaml
W0910 06:05:47.312265   13570 start_master.go:279] oauthConfig.identityProvider[0].provider.insecure: invalid value 'true', Details: validating passwords over an insecure connection could allow them to be intercepted
Invalid MasterConfig openshift.local.config/master/master-config.yaml
  oauthConfig.identityProvider[0].provider.attributes.id: invalid value '[]', Details: at least one id attribute is required (LDAP standard identity attribute is 'dn')

Expected results:
Should work well 

Additional info:

Comment 1 Jordan Liggitt 2015-09-10 11:20:29 UTC
Fixed in https://github.com/openshift/origin/pull/4610

Comment 2 weiwei jiang 2015-09-11 01:48:41 UTC
Checked with devenv-fedora_2323, and has been fixed now.