Bug 1488505

Description of problem:

When setting OpenID with extra parameters (include_granted_scopes: "true") within the ansible inventory file (using variable openshift_master_identity_providers), the "true" value is taken as true (without quotes) as outcome.

This causes Openshift does not retrieve all the sub fields for the users.

As a test, when you set it manually within the master-config.yaml with the proper format (include_granted_scopes: "true", enclosed between double quotes), it works:


###############################################
  identityProviders:
  - challenge: false
    login: true
    mappingMethod: claim
    name: companyokta
    provider:
      apiVersion: v1
      claims:
        email:
        - email
        id:
        - sub
        name:
        - name
        preferredUsername:
        - preferred_username
      clientID: xxx
      clientSecret: xxx
      extraAuthorizeParameters:
        include_granted_scopes: "true"
      kind: OpenIDIdentityProvider
      urls:
        authorize: https://<url>.com/oauth2/v1/authorize
        token: https://<url>.com/oauth2/v1/token
        userInfo: https://<url>.com/oauth2/v1/userinfo
###############################################
 

Version-Release number of the following components:
rpm -q openshift-ansible
rpm -q ansible
ansible --version

How reproducible:
100%

Steps to Reproduce:
1. Set openshift_master_identity_providers as follows:

###############################################
openshift_master_identity_providers=[{"name": "companyokta", "login": "true", "challenge": "false", "mappingMethod": "claim", "kind": "OpenIDIdentityProvider", "client_id": "xxx", "client_secret": "xxx", "extraAuthorizeParameters" : {"include_granted_scopes": "true"}, "claims": {"id": ["sub"], "preferredUsername": ["preferred_username"], "name": ["name"], "email": ["email"]}, "urls": {"authorize": "https://<url>.com/oauth2/v1/authorize", "token": "https://<url>.com/oauth2/v1/token", "userInfo": "https://<url>.com/oauth2/v1/userinfo"} }]
###############################################


2. Run the installer


Actual results:

➜  ~ oc get identities
NAME                                IDP NAME       IDP USER NAME          USER NAME                     USER UID
companyokta:00u11e13mwxxxxxx   companyokta   00u11e13mwNM1xxxxxx   myemailaddress.uk         4380c342-7603-11e7-bb8b-xxxxxx
companyokta:00u14da2xxxxxxxx   companyokta   00u14da2dbitr4xxxxxx   00u14da2xxxxxxx43TR0i7          8999013b-8e30-11e7-a0e2-xxxxx

On the first line, under USER NAME, you see the email of the user authenticated for the first time while openshift had the right configuration ("true" with quotes).
On the second line you see instead another user authenticated using the configuration provisioned by ansible (true without quotes).

Expected results:

OCP to recognize true (without double quotes) as a proper value for the include_granted_scopes variable.

Additional info:

https://github.com/openshift/openshift-ansible/blob/master/roles/openshift_master_facts/filter_plugins/openshift_master.py#L383-L386