Bug 1958097 - don't show "old, insecure token format" if the token does not actually exist
Summary: don't show "old, insecure token format" if the token does not actually exist
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: oauth-apiserver
Version: 4.8
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
: 4.8.0
Assignee: Standa Laznicka
QA Contact: pmali
Depends On:
TreeView+ depends on / blocked
Reported: 2021-05-07 07:50 UTC by Standa Laznicka
Modified: 2021-07-27 23:07 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: No Doc Update
Doc Text:
Clone Of:
Last Closed: 2021-07-27 23:07:23 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Github openshift oauth-apiserver pull 52 0 None open Bug 1958097: tokenreviews: improve errors on old-format access tokens 2021-05-07 07:51:17 UTC
Red Hat Product Errata RHSA-2021:2438 0 None None None 2021-07-27 23:07:35 UTC

Description Standa Laznicka 2021-05-07 07:50:42 UTC
Description of problem:
When inspecting error messages when serviceaccount token authentication fails such as the one in https://bugzilla.redhat.com/show_bug.cgi?id=1956879, we could see that the oauth-apiserver's token review returns a message "old, insecure token format".

The message from oauth-apiserver should instead warn about the token not being found if it really does not exist not to confuse the person debugging the issue. In case an old token was really found, it shoud not use commas so that it does not appear like two separate error messages.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. attempt to login with an invalid bearer token

Comment 7 errata-xmlrpc 2021-07-27 23:07:23 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.8.2 bug fix and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.