Hide Forgot
Active Directory's (ADFS) OpenID implementation can potentially send a "/" character in the subject identifier (sub) claim during the authentication process. OpenShift 4 then tries to use this sub claim to create a resource within OpenShift. However, you cannot create a resource with a "/" in the name, resulting in authentication to fail. Here's the bug for the unsupported character in "sub" returned by ADFS: https://bugzilla.redhat.com/1812206 There's no known workaround (there's an unsupported workaround which is not recommended) There's a number of support cases attached to https://issues.redhat.com/browse/RFE-700 and feature epic https://issues.redhat.com/browse/MSTR-1093 Currently, the fix is planned for not sooner than 4.9! Needs to be implemented in 4.7! There is a rule, which checks this issue for Must-Gather. Msg to find: "AuthenticationError: invalid resource name", "[may not contain '/']" Where to search: authentication current logs, path in MG: namespaces/openshift-authentication/pods/*/*/*/logs/current.log
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: OpenShift Container Platform 4.7.0 security, bug fix, and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2020:5633