Direct OIDC configuration #1614

stlaz · 2023-10-11T12:06:13Z

This is an API to openshift/enhancements#1493

openshift-ci · 2023-10-11T12:06:44Z

Hello @stlaz! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

config/v1/types_authentication.go

deads2k · 2023-10-16T18:41:42Z

config/v1/types_authentication.go

 	KubeConfigKey = "kubeConfig"
 )
+
+type OIDCProvider struct {


Consider for future, no need right now.

Is this the right scope for configuring a clientID and reference to a clientSecret for the console

Pros:

keeps configuration close together from a user perspective

will allow different clientIDs for different oidc providers for console

Cons?

Each client for each application should be different, or should be provided with means to request tokens with different audiences (e.g. the resource parameter). That means that should we choose to configure client parameters via this API, we need to make it configurable for a number of clients. That can get messy, but is still doable.

Yesterday, Seth argued the opposite: specifically name every clientID/secret pair. We should get on the same page.

config/v1/types_authentication.go

deads2k · 2023-10-24T15:55:45Z

config/v1/types_authentication.go

+	// +kubebuilder:validation:Enum={"", "NoPrefix", "Prefix"}
+	PrefixPolicy UsernamePrefixPolicy `json:"prefixPolicy"`
+
+	Prefix *UsernamePrefix `json:"prefix"`


There is still no CEL here.

Test should be able to prove CEL is missing.

Not sure which CEL validation is missing. I defined some rules on the object level.

I added tests that prove that the current CEL works as expected.

Oh, I see my review mistake. Realized it in the shower this morning. Agreed.

deads2k · 2023-10-25T13:02:15Z

/lgtm

deads2k · 2023-10-25T13:07:22Z

/approve

deads2k · 2023-10-25T13:09:18Z

/refresh

openshift-ci · 2023-10-25T13:11:01Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: deads2k, stlaz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [deads2k]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Oct 11, 2023

openshift-ci bot requested review from bparees and jwforres October 11, 2023 12:10

stlaz force-pushed the direct_oidc_config branch from 53f216a to 475a752 Compare October 11, 2023 12:27

deads2k reviewed Oct 11, 2023

View reviewed changes

config/v1/types_authentication.go Show resolved Hide resolved

deads2k reviewed Oct 11, 2023

View reviewed changes

config/v1/types_authentication.go Show resolved Hide resolved

deads2k reviewed Oct 11, 2023

View reviewed changes

config/v1/types_authentication.go Show resolved Hide resolved

deads2k reviewed Oct 11, 2023

View reviewed changes

config/v1/types_authentication.go Show resolved Hide resolved

deads2k reviewed Oct 11, 2023

View reviewed changes

config/v1/types_authentication.go Show resolved Hide resolved

deads2k reviewed Oct 11, 2023

View reviewed changes

config/v1/types_authentication.go Outdated Show resolved Hide resolved

deads2k reviewed Oct 11, 2023

View reviewed changes

config/v1/types_authentication.go Show resolved Hide resolved

deads2k reviewed Oct 11, 2023

View reviewed changes

config/v1/types_authentication.go Show resolved Hide resolved

deads2k reviewed Oct 11, 2023

View reviewed changes

config/v1/types_authentication.go Outdated Show resolved Hide resolved

deads2k reviewed Oct 11, 2023

View reviewed changes

config/v1/types_authentication.go Outdated Show resolved Hide resolved

deads2k reviewed Oct 11, 2023

View reviewed changes

config/v1/types_authentication.go Show resolved Hide resolved

stlaz mentioned this pull request Oct 11, 2023

HOSTEDCP-1240: WIP: auth: add an enhancement on a supported direct OIDC config openshift/enhancements#1493

Closed

stlaz force-pushed the direct_oidc_config branch 2 times, most recently from 166804e to d44bc77 Compare October 12, 2023 11:12

deads2k reviewed Oct 12, 2023

View reviewed changes

config/v1/types_authentication.go Outdated Show resolved Hide resolved

deads2k reviewed Oct 12, 2023

View reviewed changes

config/v1/types_authentication.go Show resolved Hide resolved

deads2k reviewed Oct 12, 2023

View reviewed changes

config/v1/types_authentication.go Show resolved Hide resolved

stlaz force-pushed the direct_oidc_config branch 2 times, most recently from cdd7c02 to f17549a Compare October 12, 2023 14:41

deads2k reviewed Oct 12, 2023

View reviewed changes

config/v1/types_authentication.go Show resolved Hide resolved

stlaz force-pushed the direct_oidc_config branch from f17549a to 67c5422 Compare October 12, 2023 15:58

stlaz mentioned this pull request Oct 16, 2023

AUTH-439: loosen authentication.spec.type validation openshift/kubernetes#1770

Merged

deads2k reviewed Oct 16, 2023

View reviewed changes

config/v1/types_authentication.go Show resolved Hide resolved

deads2k reviewed Oct 16, 2023

View reviewed changes

config/v1/types_authentication.go Show resolved Hide resolved

sjenning reviewed Oct 16, 2023

View reviewed changes

config/v1/types_authentication.go Show resolved Hide resolved

sjenning reviewed Oct 16, 2023

View reviewed changes

config/v1/types_authentication.go Show resolved Hide resolved

stlaz force-pushed the direct_oidc_config branch from 67c5422 to 4f09bdb Compare October 18, 2023 09:04

deads2k reviewed Oct 18, 2023

View reviewed changes

config/v1/types_authentication.go Outdated Show resolved Hide resolved

deads2k reviewed Oct 18, 2023

View reviewed changes

config/v1/types_authentication.go Show resolved Hide resolved

deads2k reviewed Oct 18, 2023

View reviewed changes

config/v1/types_authentication.go Outdated Show resolved Hide resolved

stlaz force-pushed the direct_oidc_config branch 2 times, most recently from 2bb98ac to 1969932 Compare October 20, 2023 13:10

deads2k reviewed Oct 23, 2023

View reviewed changes

config/v1/types_authentication.go Outdated Show resolved Hide resolved

deads2k reviewed Oct 23, 2023

View reviewed changes

config/v1/types_authentication.go Show resolved Hide resolved

stlaz added 3 commits October 24, 2023 13:16

config/authetication: add direct OIDC config API

fa2f9ad

add CEL validation of prefix policies

6e53997

make generate

90a73ec

stlaz force-pushed the direct_oidc_config branch from 1969932 to 90a73ec Compare October 24, 2023 11:17

openshift-ci bot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Oct 24, 2023

stlaz added 2 commits October 24, 2023 14:39

update the authn resource to match new verify expectations

0362fb8

make generate

d0f11a6

stlaz force-pushed the direct_oidc_config branch from 0dac365 to d0f11a6 Compare October 24, 2023 12:39

config: add testsuites for the custom/techprevew authentication crds

ebfadc3

deads2k reviewed Oct 24, 2023

View reviewed changes

auth: add tests for username prefixes

d24e07e

openshift-ci bot assigned deads2k Oct 25, 2023

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Oct 25, 2023

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 25, 2023

openshift-ci bot merged commit c103851 into openshift:master Oct 25, 2023

Direct OIDC configuration #1614

Direct OIDC configuration #1614

Uh oh!

Conversation

stlaz commented Oct 11, 2023

Uh oh!

openshift-ci bot commented Oct 11, 2023

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

deads2k Oct 16, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stlaz Oct 17, 2023

Choose a reason for hiding this comment

Uh oh!

deads2k Oct 17, 2023

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

deads2k Oct 24, 2023

Choose a reason for hiding this comment

Uh oh!

deads2k Oct 24, 2023

Choose a reason for hiding this comment

Uh oh!

stlaz Oct 25, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

deads2k Oct 25, 2023

Choose a reason for hiding this comment

Uh oh!

deads2k commented Oct 25, 2023

Uh oh!

deads2k commented Oct 25, 2023

Uh oh!

deads2k commented Oct 25, 2023

Uh oh!

openshift-ci bot commented Oct 25, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

deads2k Oct 16, 2023 •

edited

Loading

stlaz Oct 25, 2023 •

edited

Loading