Bug 1261750 - Can not setup authentication with LDAPPasswordIdentityProvider
Can not setup authentication with LDAPPasswordIdentityProvider
Status: CLOSED CURRENTRELEASE
Product: OpenShift Origin
Classification: Red Hat
Component: Auth (Show other bugs)
3.x
Unspecified Unspecified
medium Severity medium
: ---
: ---
Assigned To: Jordan Liggitt
weiwei jiang
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2015-09-10 02:20 EDT by weiwei jiang
Modified: 2016-10-30 18:54 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-11-23 16:16:54 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description weiwei jiang 2015-09-10 02:20:00 EDT
Description of problem:
When setup authentication with LDAPPasswordIdentityProvider, will display a error:
# openshift start master --config=openshift.local.config/master/master-config.yaml
W0910 06:05:47.312265   13570 start_master.go:279] oauthConfig.identityProvider[0].provider.insecure: invalid value 'true', Details: validating passwords over an insecure connection could allow them to be intercepted
Invalid MasterConfig openshift.local.config/master/master-config.yaml
  oauthConfig.identityProvider[0].provider.attributes.id: invalid value '[]', Details: at least one id attribute is required (LDAP standard identity attribute is 'dn')

This is due to the PR(https://github.com/openshift/origin/pull/4264) change some config validation code.


Version-Release number of selected component (if applicable):
devenv_fedora_2313
# openshift version 
openshift v1.0.5-318-g1fb52fd
kubernetes v1.1.0-alpha.0-1605-g44c91b1


How reproducible:
always

Steps to Reproduce:
1. Set up authentication with LDAPPasswordIdentityProvider as following:
  identityProviders:
  - challenge: true
    login: true
    name: "testldap"
    provider:
      apiVersion: v1
      attributes:
        email: null
        id:
        - dn
        name:
        - cn
        preferredUsername:
        - uid
      bindDN: "cn=read-only-admin,dc=example,dc=com"
      bindPassword: "password"
      ca: ""
      kind: LDAPPasswordIdentityProvider
      insecure: true
      url: "ldap://ldap.forumsys.com/dc=example,dc=com?uid"
 
2. Start openshift master with the config file
openshift start master --config=<PATH TO CONFIG>
3.

Actual results:
# openshift start master --config=openshift.local.config/master/master-config.yaml
W0910 06:05:47.312265   13570 start_master.go:279] oauthConfig.identityProvider[0].provider.insecure: invalid value 'true', Details: validating passwords over an insecure connection could allow them to be intercepted
Invalid MasterConfig openshift.local.config/master/master-config.yaml
  oauthConfig.identityProvider[0].provider.attributes.id: invalid value '[]', Details: at least one id attribute is required (LDAP standard identity attribute is 'dn')

Expected results:
Should work well 

Additional info:
Comment 1 Jordan Liggitt 2015-09-10 07:20:29 EDT
Fixed in https://github.com/openshift/origin/pull/4610
Comment 2 weiwei jiang 2015-09-10 21:48:41 EDT
Checked with devenv-fedora_2323, and has been fixed now.

Note You need to log in before you can comment on or make changes to this bug.