Bug 1849757 - ROKS: CodeReady Workspace not working with IBM IAM
Summary: ROKS: CodeReady Workspace not working with IBM IAM
Keywords:
Status: CLOSED DEFERRED
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: ibm-roks-toolkit
Version: 4.3.z
Hardware: All
OS: Unspecified
unspecified
low
Target Milestone: ---
: ---
Assignee: Cesar Wong
QA Contact: Xiaoli Tian
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-06-22 18:08 UTC by rovandep
Modified: 2023-03-09 00:58 UTC (History)
0 users

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2023-03-09 00:58:34 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description rovandep 2020-06-22 18:08:22 UTC
Description of problem:
When deploying the CodeReady Workspaces on ROKS and using the IBM Cloud IAM as a authentication provider, it is impossible to create a workspace because of the username format and special characters being IAM#user

Version-Release number of selected component (if applicable): 4.3.z

How reproducible: always

Steps to Reproduce:
1. ROKS
2. Create a namespace & deploy the Red Hat CodeReady Workspaces operator
3. Create an instance using "openShiftoAuth: true"
4. Access CodeReady Workspaces and create a workspace


Actual results:
1. with standard IAM username string iam#rovandep:
The specified namespace iam#rovandep is invalid: a DNS-1123 label must consist of lower case alphanumeric characters or '-', and must start and end with an alphanumeric character (e.g. 'my-name', or '123-abc', regex used for validation is '[a-z0-9]([-a-z0-9]*[a-z0-9])?')

2. with modification of IAM username within the Update profile windows at first login to email address here rovandep:
The specified namespace rovandep is invalid: a DNS-1123 label must consist of lower case alphanumeric characters or '-', and must start and end with an alphanumeric character (e.g. 'my-name', or '123-abc', regex used for validation is '[a-z0-9]([-a-z0-9]*[a-z0-9])?')

3. with modification of IAM username within the Update profile windows at first login to username without @domain.com like rovandep in my case
Working


Expected results:
Options in order of preferences from MHO:
1. update operator documentation about the character limitation to avoid such behavior which will required Admin privileges on keycloack to delete or modify the username
2. support the IBM IAM integration from a CodeReay Workspaces perspective with a routine to propose the username bit of the overall IBM Cloud IAM username
3. introduce RFE for CodeReady Workspaces to support # and @ characters

Additional info:

Comment 1 Cesar Wong 2020-06-22 18:32:33 UTC
Created CodeReady Workspaces issue: https://issues.redhat.com/browse/CRW-1002

Comment 2 Shiftzilla 2023-03-09 00:58:34 UTC
OpenShift has moved to Jira for its defect tracking! This bug can now be found in the OCPBUGS project in Jira.

https://issues.redhat.com/browse/OCPBUGS-8782


Note You need to log in before you can comment on or make changes to this bug.