Bug 1589072
| Summary: | - Invalid request Client state could not be verified | |||
|---|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Kim Borup <kborup> | |
| Component: | Management Console | Assignee: | Samuel Padgett <spadgett> | |
| Status: | CLOSED ERRATA | QA Contact: | Yadan Pei <yapei> | |
| Severity: | medium | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 3.9.0 | CC: | aos-bugs, deads, fshaikh, jokerman, jrosenta, ktadimar, mmccomas, spadgett, ssorce, xxia, yapei | |
| Target Milestone: | --- | |||
| Target Release: | 3.10.0 | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | Bug Fix | ||
| Doc Text: |
Previously, in some configurations, hitting the base URL of the master without the `/console` path could cause the first log in to the web console to fail with a "Client state could not be verified" error. This happened because the redirect to the console did not use the public console URL as defined in the webconsole-config config map in the openshift-web-console namespace.
The problem has been fixed and the master will now correctly redirect to the public console URL.
|
Story Points: | --- | |
| Clone Of: | ||||
| : | 1623315 (view as bug list) | Environment: | ||
| Last Closed: | 2018-07-30 19:17:19 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1623315 | |||
|
Description
Kim Borup
2018-06-08 10:29:30 UTC
I dont know if this should be seen as a reopen of bug 1537120 This doesn't look certificate related. If you start the login process from domain that doesn't match the console public URL, you'll see the error. It appears that the master is not redirecting you to the public URL in 3.9. This should be fixed in master by https://github.com/openshift/origin/pull/19194 The workaround is to use the console public URL directly. We could check in the console that the domain matches our public URL before starting login to avoid problems like this and bug 1488394. cc David, Simo First, per comment 2, figured out the steps that stably reproduce the bug in old version which had not merged above PR (OCP v3.9.30): Given the configmap shows consolePublicURL: https://host-8-246-90...redhat.com:8443/console/, access via IP format https://10.8.246.90:8443/console [1]. It will redirect to https://host-8-246-90...redhat.com:8443/login... , input user/password, the error stably happens. [1] https://10.8.246.90:8443 does not reproduce, though Then, test latest v3.10.0-0.64.0 that has merged above PR. It stably reproduces too: its configmap shows consolePublicURL: https://host-8-241-104...redhat.com:8443/console/. Access via IP format https://10.8.241.104:8443/console reproduces the error (In reply to Xingxing Xia from comment #4) > Then, test latest v3.10.0-0.64.0 that has merged above PR. It stably > reproduces too: its configmap shows consolePublicURL: > https://host-8-241-104...redhat.com:8443/console/. Access via IP format > https://10.8.241.104:8443/console reproduces the error That's expected. The problem fixed by the PR is that the redirect from the master to the console URL didn't use the console public URL. To reproduce, use URL `https://host-8-241-104...redhat.com:8443`. If that works, the problem should be fixed. Given consolePublicURL and masterPublicURL set as: consolePublicURL: https://host-8-241-104...redhat.com:8443/console/ masterPublicURL: https://host-8-241-104...redhat.com:8443 Visiting masterPublicURL will redirect to consolePublicURL, input u/p will successfully log user in w/o problem Hi Venkata, If we use following approach, > 1) Open tab A to the console, let it redirect you to the login page, DO NOT LOG IN 2) Open tab B to the console, let it redirect you to the login page, DO NOT LOG IN 3) Complete the log in from tab A. 4) Complete the log in from tab B, it will fail with "Client state could not be verified" At step4, user is expected to fail with "Client state could not be verified" See https://bugzilla.redhat.com/show_bug.cgi?id=1537120#c2 > What this will not change - once you log in through any of the tabs, the nonce will be destroyed so that it can not be reused, this is an intentional security measure. This means any other tabs still sitting on the log in page, you will not be able to just log in on those tabs, you will need to hit the back button to go back to the console. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:1816 I do not think that PR applies to 3.9 at all, it was created for new behavior in 3.10 that is not present in 3.9 AFAIK. Hi, Simo. The console was split out in 3.9. I'm not sure how 3.10 is different? Ah I may have mixed numbers in my head then ... Venkata, can you open a separate bug referencing/cloning this one for the backport ? |