Bug 1922267
| Summary: | Collect specific ADFS error | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Serhii Zakharov <szakharo> |
| Component: | Insights Operator | Assignee: | Serhii Zakharov <szakharo> |
| Status: | CLOSED ERRATA | QA Contact: | Pavel Šimovec <psimovec> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 4.7 | CC: | aos-bugs, inecas, mklika, tremes |
| Target Milestone: | --- | ||
| Target Release: | 4.7.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Enhancement | |
| Doc Text: |
Active Directory's (ADFS) OpenID implementation can potentially send a "/" character in the subject identifier (sub) claim during the authentication process. OpenShift 4 then tries to use this sub claim to create a resource within OpenShift. However, you cannot create a resource with a "/" in the name, resulting in authentication to fail.
Here's the bug for the unsupported character in "sub" returned by ADFS: https://bugzilla.redhat.com/1812206
There's no known workaround (there's an unsupported workaround which is not recommended)
There's a number of support cases attached to https://issues.redhat.com/browse/RFE-700
and feature epic https://issues.redhat.com/browse/MSTR-1093
Currently, the fix is planned for not sooner than 4.9! Needs to be implemented in 4.7!
There is a rule, which checks this issue for Must-Gather.
Msg to find: "AuthenticationError: invalid resource name", "[may not contain '/']"
Where to search: authentication current logs, path in MG:
namespaces/openshift-authentication/pods/*/*/*/logs/current.log
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-02-24 15:57:13 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Serhii Zakharov
2021-01-29 14:46:43 UTC
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: OpenShift Container Platform 4.7.0 security, bug fix, and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2020:5633 |