+++ This bug was initially created as a clone of Bug #1434983 +++

+++ This bug was initially created as a clone of Bug #1421629 +++

Description of problem:
Error message "The requested URL /oauth/approve was not found on this server" returns, when accessing Jenkins application created by default template "jenkins-persistent".

Version-Release number of selected component (if applicable):
OpenShift Master: v3.4.1.2
Kubernetes Master: v1.4.0+776c994

How reproducible:
Always

Steps to Reproduce:
1. Configure server with RequestHeaderIdentityProvider
2. Create Jenkins application using default template "jenkins-persistent"("OAuth OpenShift integration" is enabled);
3. After all the pods are running well, check if Jenkins can be accessed or not.

Actual results:
3. After clicking "Login with Openshift", error message "The requested URL /oauth/approve was not found on this server" returns.


cluster is using RequestHeaderIdentityProvider:
...
  identityProviders:
  - challenge: false
    provider:
      headers:
      - Remote-User
      kind: RequestHeaderIdentityProvider
      nameHeaders:
      - Remote-User-Name
      loginURL: https://auth-proxy.example.com/mod_auth_mellon/?${query}
      apiVersion: v1
      clientCA: /etc/origin/master/ca.crt
    mappingMethod: lookup
    login: true
    name: myidp
...

--- Additional comment from Jordan Liggitt on 2017-02-14 12:45:18 EST ---

Currently, two URLs are accessed during the OAuth flow that require authentication information:

  $master/oauth/authorize
  $master/oauth/approve

When using a RequestHeaderIdentityProvider, all authentication information must come from the auth proxy.

loginURL is used to specify the URL that proxies to $master/oauth/authorize

There is no option to configure the URL that proxies to $master/oauth/approve (this was an oversight). When approval is needed during an OAuth flow, a redirect to /oauth/approve is done.


Temporary workaround:
1. Change the auth proxy to proxy https://auth-proxy.example.com/oauth/* to $master/oauth/*
2. Change the origin config to
  loginURL: https://auth-proxy.example.com/oauth/authorize?${query}


This "fixes" the issue by making the auth proxy paths match the /oauth/* paths on the API server, and makes the auth proxy proxy both /oauth/authorize and /oauth/approve

Long term, we have a couple options:
1. Add another config option to specify the approve proxy path, and make the proxy explicitly set up a proxy rule for /oauth/approve

2. Move /oauth/approve under /oauth/authorize/approve and depend on the loginURL proxy path proxying subpaths as well

--- Additional comment from Jordan Liggitt on 2017-02-14 13:03:57 EST ---

See https://github.com/openshift/request-header-saml-service-provider/pull/7 for changes to the SAML pod to support the temporary workaround

--- Additional comment from Jordan Liggitt on 2017-02-14 14:46:28 EST ---

verified with the changes in https://github.com/openshift/request-header-saml-service-provider/pull/7 we can run grant approval through the auth proxy

--- Additional comment from Troy Dawson on 2017-02-16 17:29:31 EST ---

Should be fixed in openshift3/saml-service-provider:1.0-5 which is available in testing areas.

--- Additional comment from Jordan Liggitt on 2017-02-16 17:36:14 EST ---

the following config changes are needed when deploying that version:

for the saml pod, instead of:
OSE_API_PUBLIC_URL=https://api.example.com/oauth/authorize
set
PROXY_PATH=/oauth/
PROXY_DESTINATION=https://api.example.com/oauth/


for the apiserver, change the master-config.yaml loginURL to:
loginURL: https://auth-proxy.example.com/oauth/authorize?${query}

--- Additional comment from Jordan Liggitt on 2017-04-04 14:36:42 EDT ---

The workaround for this issue is to make the auth proxy paths match the API server paths for these paths:

These are the paths that require proxying currently:
  https://api.acme.com/oauth/authorize (and subpaths)
  https://api.acme.com/oauth/approve

The auth proxy paths would be:
  https://auth.acme.com/oauth/authorize (and subpaths)
  https://auth.acme.com/oauth/approve

The master-config.yaml would be:
...
oauthConfig:
  identityProviders:
  - name: ...
    login: true
    ...
    provider:
      apiVersion: v1
      kind: RequestHeaderIdentityProvider
      loginURL: "https://auth.acme.com/oauth/authorize?${query}"
      ...


https://github.com/openshift/origin/pull/13569 will move the approval flow to /oauth/authorize/approve so there is a single root that auth proxies need to proxy.