Bug 1855890

Summary: [3.11] LDAP user are not able to login through CLI .
Product: OpenShift Container Platform Reporter: Asmita <agawand>
Component: apiserver-authAssignee: Standa Laznicka <slaznick>
Status: CLOSED NOTABUG QA Contact: pmali
Severity: high Docs Contact:
Priority: unspecified    
Version: 3.11.0CC: aos-bugs, aprajapa, eparis, hpolava, jialiu, jokerman, mfojtik, nstielau, pdhamdhe, slaznick, wsun, xtian, xxia
Target Milestone: ---Keywords: Reopened
Target Release: 3.11.z   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-09-11 08:22:38 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Asmita 2020-07-10 20:23:57 UTC
Description of problem: Ldap user is able to login through web console but not through CLI. While accessing cluster through CLI user encounter "Login failed (401 Unauthorized)Verify you have provided correct credentials." error but the same user is able to access the cluster through UI.

API-logs shows below errors:
~~~
E0707 15:52:23.928464       1 authentication.go:62] Unable to authenticate the request due to an error: [invalid bearer token, [invalid bearer token, token lookup failed]]
E0707 15:52:23.979650       1 authentication.go:62] Unable to authenticate the request due to an error: [invalid bearer token, [invalid bearer token, token lookup failed]]
~~~


Actual results: Unable to login through CLI

Expected results: Users should be able to login through CLI without any issue.



Additional info:

Comment 10 Ashish Prajapati 2020-09-10 20:05:52 UTC
Hello,

I was on a remote with customer, I removed all the Identity providers excluding the ADFS(RHSSO-OpenID).

It still fails but now with 401 error. Attached complete output of 'oc login' with loglevel=8 and also API and Controllers logs.

There were a ton of errors logged as below:

~~~
Unable to authenticate the request due to an error: [invalid bearer token, [invalid bearer token, token lookup failed]]
~~~

Do OpenId support 'oc login' using CLI?
How to request token using CLI?

Thank you,
Ashish

Comment 11 Standa Laznicka 2020-09-11 08:22:38 UTC
This bugzilla is _COMPLETELY_ unrelated to whatever you're trying to solve. Also, the problem must be elsewhere to be found in the logs, this one line won't help you.

Don't comment here, don't reopen.