Bug 1704827
| Summary: | oc login provides useless error when authentication is denied | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Eric Jones <erjones> |
| Component: | oc | Assignee: | Sally <somalley> |
| Status: | CLOSED ERRATA | QA Contact: | Xingxing Xia <xxia> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | 4.1.0 | CC: | aos-bugs, erich, jeder, jokerman, mfojtik, mmccomas, yinzhou |
| Target Milestone: | --- | ||
| Target Release: | 4.2.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-10-16 06:28:21 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1664187 | ||
|
Description
Eric Jones
2019-04-30 15:26:41 UTC
Digging into this further I identified that the issue is not with not authenticating or reaching the api but the fact that the Authentication provider blocks other users from logging into the cli. When I check the log-level=8 output I can see a DENY as the response, but instead of saying that the user is not a valid user or that the provider doesn't allow others to authenticate via CLI we simply get this "invalid character" error. So we need to change the response message from [0] to something along the lines of "not authenticated" or "authentication denied". [0] error: invalid character '<' looking for beginning of value This is not a bug per se, the error you're seeing states you're hitting web console URL (thus the starting < as the opening character from <html). We could try improving the message stating something along the lines: the provided URL is not a valid cluster. yes, what's going on is this: $ oc cluster-info Kubernetes master is running at https://api.sotest871.devcluster.openshift.com:6443 $ oc login -u kubeadmin -p blahh-blahh https://api.sotest871.devcluster.openshift.com:6443 Login successful. or $ oc login -u kubeadmin -p blahh-blahh (no server) Login successful. But if you use this instead: $ oc get routes -n openshift-console NAME HOST/PORT PATH SERVICES PORT TERMINATION WILDCARD console console-openshift-console.apps.sotest871.devcluster.openshift.com console https reencrypt/Redirect None $ oc login -u kubeadmin -p blahh-blahh https://console-openshift-console.apps.sotest871.devcluster.openshift.com you'll see the error: Use insecure connections? (y/n): y error: invalid character '<' looking for beginning of value I'll update the error msg to guide user to login using the cluster-info output Confirmed with latest oc , the issue has fixed: [zhouying@dhcp-140-138 ~]$ oc version Client Version: v4.2.0 Server Version: 4.2.0-0.nightly-2019-09-10-231328 [zhouying@dhcp-140-138 ~]$ oc login -u kubeadmin -p nJmnK-IvaBR-4rpEm-qDEN8 https://console-openshift-console.apps.yinzhou.qe.devcluster.openshift.com The server uses a certificate signed by an unknown authority. You can bypass the certificate check, but any data you send to the server could be intercepted by others. Use insecure connections? (y/n): y error: Seems you passed an HTML page (console?) instead of server URL. Verify provided address and try again. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:2922 |