Bug 1833206 - There is not way to get token after successful login to OCP 4.3 integrated with Redhat SSO
Summary: There is not way to get token after successful login to OCP 4.3 integrated wi...
Keywords:
Status: CLOSED DUPLICATE of bug 1727983
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: oauth-apiserver
Version: 4.3.0
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: ---
: ---
Assignee: Stefan Schimanski
QA Contact: Xingxing Xia
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-05-08 04:50 UTC by Ani
Modified: 2020-05-13 07:25 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-05-13 07:25:27 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description Ani 2020-05-08 04:50:18 UTC
Description of problem:

OCP 3.11
What we have is OCP 3.11 integrated with RedHat SSO for authenticating OCP users.
What we did is we have created OCP users for our automation script and web application with in RedHat SSO (These users have roles to create and delete resources like project,group,role,role-binding,user etc.).
From our java web application and automation script we call OpenShift Rest API to authenticate  OCP users (created for java web application and automation script in redhat SSO). On successful authentication OpenShift Rest API  return token in response, and we make use of this token when we have to make subsequent call to other OpenShift Rest API (create, delete OCP resources like project, group, roles, role-binding, users).


OCP 4.3 
What we have is OCP 4.3 integrated with same (as used for OCP 3.11) RedHat SSO for authenticating OCP users.
We have same OCP users for our automation script and web application with in RedHat SSO.
Since there is a change in OpenShit authentication Rest API so we don't know which api to be used and how to get the token from OpenShit 4.3 once our openshift user (created for automation script and web application in RedHat SSO)  is authenticated successfully from our java web application and automation script so that from within our web application and automation script we can make subsequent call to other OpenShift Rest API and perform create, delete OCP resources like project, group, roles, role-binding, users.

NOTE  
  1> We have to perform operations like create, delete on OpenShift resources like project, roles, group, role-binding, user etc from with in our java web application and automation scrip using OpenShift Rest API end point.
  2> OCP user used for this, is there in RedHat SSO and OCP 4.3 is integrated with Redhat SSO for authentication

Version-Release number of selected component (if applicable): OCP 4.3


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 1 Standa Laznicka 2020-05-12 11:27:26 UTC
Please fill in the steps to reproduce so that I can understand what's not working for you.

Comment 2 Ani 2020-05-12 15:13:33 UTC
Steps to Reproduce:
1. Integrate OCP 4.3 with RedHat SSO and create a user with in RHSSO.
2. Using CURL authenticate above user using OCP 4.3 authentication REST API end point.
3. Once authenticated, get the token for above user, using REST API end point (don't know which REST API to be used )
4. Validate whether token obtain above, works when try to create any OCP resource like project/role-binding using CURL with specific OCP 4.3 REST API end point
required for creating those resources.

Actual results:
Don't know how to get token and not sure if that token work when subsequent call is made to OCP 4.3 REST API endpoint to create OCP resources.

Expected results:
There must be a REST API end point to get token after successful authentication and this token work when subsequent call is made to OCP 4.3 REST API endpoint to create OCP resources.

Additional info:

In real above steps happen inside our web application, since web application is not accessible to reproduce this, so I suggested to user CURL command.

Comment 3 Standa Laznicka 2020-05-13 07:25:27 UTC
I am going to assume what you're asking for is "I want to be able to use my RHSSO, configured as an OIDC identity provider, to authenticate to OpenShift by using basic-auth, which worked for me in 3.11 as I was able to set configuration field 'challenge' to 'true', but I can't use this in 4.3 as OIDC identity provider does not allow challenge flows" and I will close this as a duplicate of another BZ that deals with exactly this problem.

*** This bug has been marked as a duplicate of bug 1727983 ***


Note You need to log in before you can comment on or make changes to this bug.