| Summary: | [atomic registry]Can't add username with email address format to project | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | DeShuai Ma <dma> |
| Component: | Management Console | Assignee: | Dominik Perpeet <dperpeet> |
| Status: | CLOSED ERRATA | QA Contact: | DeShuai Ma <dma> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 3.3.1 | CC: | aos-bugs, dma, jokerman, mmccomas, mpitt, pweil, tdawson, yapei |
| Target Milestone: | --- | ||
| Target Release: | 3.4.z | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-03-02 20:58:34 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
|
Description
DeShuai Ma
2016-10-10 09:31:06 UTC
Please forgive my ignorance, I'm new to all this. Are user names in the form of an email address even valid in OpenShift? I am looking at https://docs.openshift.com/container-platform/3.4/architecture/core_concepts/projects_and_users.html and there is no indication about email-style user names? Is there some documentation/specification that suggests that it is? Thanks! Hi Martin, For OpenShift, we have multiple authentication methods(https://docs.openshift.com/container-platform/3.4/install_config/configuring_authentication.html#install-config-configuring-authentication), if we could add email-style user name successfully for one authentication method then we should take user name in the form of email address as valid for OpenShift. Does this answer your question? User names in the form of email address is valid in openshift. On master get users, we can see: [root@openshift-105 ~]# oc get users|grep test test1 5aa46fbc-deed-11e6-87db-fa163ea061ca allow_all:test1 test 292c7804-deed-11e6-87db-fa163ea061ca allow_all:test But in registry-console can't add email format user to project. Apparently OpenShift itself does not make any restrictions wrt. member names. Email format works fine:
[root@f1 ~]# oc patch --namespace=marmalade policybinding ':default' -p '{"roleBindings":[{"name":"edit","roleBinding":{"metadata":{"name":"edit","namespace":"marmalade"},"userNames":["foo"],"groupNames":null,"subjects":[{"kind":"User","name":"foo"},{"kind":"User","name":"foo"}],"roleRef":{"name":"edit"}}}]}'
[root@f1 ~]# oc get rolebindings
NAME ROLE USERS GROUPS SERVICE ACCOUNTS SUBJECTS
edit /edit foo
But even a completely ridiculous one works:
# oc patch --namespace=marmalade policybinding ':default' -p '{"roleBindings":[{"name":"edit","roleBinding":{"metadata":{"name":"edit","namespace":"marmalade"},"userNames":["foo ^ bar"],"groupNames":null,"subjects":[{"kind":"User","name":"foo ^ bar"},{"kind":"User","name":"foo ^ bar"}],"roleRef":{"name":"edit"}}}]}'
[root@f1 ~]# oc get rolebindings
NAME ROLE USERS GROUPS SERVICE ACCOUNTS SUBJECTS
edit /edit foo ^ bar
So it seems fine to me to make this more liberal in the registry.
kubernetes also supports/suggests email-style user names: https://kubernetes.io/docs/admin/authentication/ Fix proposed in https://github.com/cockpit-project/cockpit/pull/5785 Merged upstream, will be part of Cockpit 130 upstream commit with fix: https://github.com/cockpit-project/cockpit/commit/ba6896c3c1c9eeba32d9b146f3e9475fd7071f3d This is fixed in 3.4 with image openshift3/registry-console:3.4-4 Those images should be in the usual testing areas for testing. Verify on openshift3/registry-console:3.4-4, now can add member with email address format. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:0434 |