Revert "Merge pull request openshift#24178 from deads2k/simplify-more"

This reverts commit a2333a6, reversing
changes made to 7cca2df.

test/extended/oauth/oauthcertfallback.go

@@ -94,7 +94,7 @@ var _ = g.Describe("[Feature:OAuthServer] OAuth server", func() {
 			"valid token, valid cert": {
 				token:        validToken,
 				cert:         validCert,
-				expectedUser: certUser,
+				expectedUser: tokenUser,
 			},
 			"valid token, invalid cert": {
 				token:        validToken,
@@ -107,9 +107,10 @@ var _ = g.Describe("[Feature:OAuthServer] OAuth server", func() {
 				expectedUser: tokenUser,
 			},
 			"invalid token, valid cert": {
-				token:        invalidToken,
-				cert:         validCert,
-				expectedUser: certUser,
+				token:         invalidToken,
+				cert:          validCert,
+				errorExpected: true,
+				errorString:   unauthorizedError,
 			},
 			"invalid token, invalid cert": {
 				token:         invalidToken,

test/extended/testdata/cmd/test/cmd/admin.sh

@@ -324,12 +324,10 @@ os::cmd::expect_success 'oc get sa my-sa-name'
 
 # extract token and ensure it links us back to the service account
 os::cmd::try_until_success 'oc sa get-token my-sa-name'
-# TODO re-enable once we can use tokens instead of certs
-#os::cmd::expect_success_and_text 'oc get user/~ --token="$( oc sa get-token my-sa-name )"' 'system:serviceaccount:.+:my-sa-name'
+os::cmd::expect_success_and_text 'oc get user/~ --token="$( oc sa get-token my-sa-name )"' 'system:serviceaccount:.+:my-sa-name'
 
 # add a new token and ensure it links us back to the service account
-# TODO re-enable once we can use tokens instead of certs
-#os::cmd::expect_success_and_text 'oc get user/~ --token="$( oc sa new-token my-sa-name )"' 'system:serviceaccount:.+:my-sa-name'
+os::cmd::expect_success_and_text 'oc get user/~ --token="$( oc sa new-token my-sa-name )"' 'system:serviceaccount:.+:my-sa-name'
 
 # add a new labeled token and ensure the label stuck
 os::cmd::expect_success 'oc sa new-token my-sa-name --labels="mykey=myvalue,myotherkey=myothervalue"'

test/extended/testdata/cmd/test/cmd/basicresources.sh

@@ -310,8 +310,7 @@ echo "delete all: ok"
 os::test::junit::declare_suite_end
 
 # service accounts should not be allowed to request new projects
-# TODO re-enable once we can use tokens instead of certs
-#os::cmd::expect_failure_and_text "oc new-project --token='$( oc sa get-token builder )' will-fail" 'Error from server \(Forbidden\): You may not request a new project via this API.'
+os::cmd::expect_failure_and_text "oc new-project --token='$( oc sa get-token builder )' will-fail" 'Error from server \(Forbidden\): You may not request a new project via this API.'
 
 os::test::junit::declare_suite_start "cmd/basicresources/patch"
 # Validate patching works correctly