Tokens exceeding 4k in size do not work with the kubernetes dashboard

[skattoju-zz]

Environment

Kubernetes 1.10 was installed with kubespray on Redhat 7. Node or go not installed.
Client Version: version.Info{Major:"1", Minor:"10", GitVersion:"v1.10.0+coreos.0", GitCommit:"6bb2e725fc2876cd94b3900fc57a1c98ca87a08b", GitTreeState:"clean", BuildDate:"2018-04-02T16:49:31Z", GoVersion:"go1.9.3", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"10", GitVersion:"v1.10.0+coreos.0", GitCommit:"6bb2e725fc2876cd94b3900fc57a1c98ca87a08b", GitTreeState:"clean", BuildDate:"2018-04-02T16:49:31Z", GoVersion:"go1.9.3", Compiler:"gc", Platform:"linux/amd64"}
The dashboard is being accessed from a windows laptop using the chrome browser at the following url : https://:6443/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/#!/login

Dashboard version: k8s.gcr.io/kubernetes-dashboard-amd64:v1.8.3
Kubernetes version: 1.10
Operating system: Redhat 7
Node.js version: N/A
Go version: N/A
Chrome version: 66.0.3359.181 (Official Build) (64-bit)

Steps to reproduce

1. Configure Azure Active Directory
2. Execute kubectl command to get Token from Azure (populated in kubeconfig by azure plugin)
3. Attempt to login to the dashboard https://:6443/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/#!/login
4. Use the Azure token to login to the dashboard

Observed result

No error given in the UI, opening the console shows the following error:
Cookie 'jweToken' possibly not set or overflowed because it was too large (4329 > 4096 bytes)!

Expected result

Login successful, redirected to dashboard

Comments

This occurs when group claims are included in the token from azure. It works fine when group claims are not included and the resulting token is smaller.

[trunet]

possible duplicate of #2981 ?

[trunet]

this is difficult problem to solve.

browser limits the cookie size to 4k. the token have to be somewhere because all the requests send the token. as the token is signed, you can't simply shrink or cut it.

the solution would be to save the token on local storage instead of a cookie, but local storage is not recommended to save a token.

[floreks]

Closing as duplicate of #2981.