Red Hat Bugzilla – Bug 1326319
oc delete user makes user unable to log in again
Last modified: 2016-10-30 18:55:04 EDT
Description of problem: issuing "oc delete user" causes the username to be invalid forever. When attempting to log in, an error pops up instead of creating a fresh user with no permissions Version-Release number of selected component (if applicable): 3.1.1 How reproducible: Always Steps to Reproduce: 1. simple htpasswd setup (works with other auth providers as well) 2. create a user htpasswd /etc/origin/openshift-htpasswd deleteme 3. log in as deleteme into the WebUI 4. log out 5. delete user oc delete user deleteme oc delete group deleteme 6. try to log into the WebUI again Actual results: An unknown error has occurred. Please try again. Expected results: User logs in and a fresh profile is assigned Additional info: error on Master: Apr 12 14:00:42 master.demo.lan atomic-openshift-master[28137]: E0412 14:00:42.972098 28137 login.go:141] Unable to authenticate password: Error creating or updating mapping for: &api.DefaultUserIdentityInfo{ProviderName:"my_htpasswd_provider", ProviderUserName:"deleteme", Extra:map[string]string{}} due to users "deleteme" not found
You need to remove the identity as well. Deleting just the user leaves the identity in place referencing a user that no longer exists.
The name of the identity is a combination of the identity provider name (as configured in the master-config.yaml) and the provider user name. In the example above, the identity name would be "my_htpasswd_provider:deleteme"
Thanks, that works. I think we need to document this properly to avoid confusion on what has to be removed and what "oc delete user" is actually good for if it does not remove the user completely.
Since the failed login is by design, so verify this.
If this is by design - the "An unknown error has occurred. Please try again." message should not appear in the UI and E0412 should not appear in logs. This must all be handled properly.
We intentionally do not provide details about internal user configuration to unauthenticated users. We can improve the server log message.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2016:1064