Repository navigation
|
Hello, apiVersion: k8s.keycloak.org/v2alpha1
kind: KeycloakOIDCClient
metadata:
finalizers:
- keycloakoidcclients.k8s.keycloak.org/finalizer
generation: 1
labels:
app: keycloak
app.kubernetes.io/component: keycloak
app.kubernetes.io/instance: keycloak
app.kubernetes.io/version: 26.8.0
version: 26.8.0
name: istio
namespace: keycloak
spec:
client:
appUrl: https://www.sylvain.desbureaux.lb.innovation.nif-cd.fr
enabled: true
loginFlows:
- DEVICE
- DIRECT_GRANT
- IMPLICIT
- STANDARD
redirectUris:
- http://localhost:18000
- http://localhost:8000
- https://www.toto.fr/oauth2/callback
webOrigins:
- +
keycloakCRName: keycloak
realm: redCreation in keycloak is fine, but when used, I see the following log line multiple times in keycloak:
If I go into the UI, go the client and click save, it disappears Did I do something wrong or is there something not yet available on thanks! |
Replies: 1 comment 5 replies
|
If you omit the auth stanza, the current behavior will create the client marked as public and without an authentication method - that causes the message you are seeing. The UI save is likely assigning a default authentication method client-secret, which is then also triggering the generation of a secret, so the message then goes away. Any changes you make in the UI however will be undone by any further changes you make to custom resource. The current expectation with KeycloakOIDCClient if you want to use a client secret is that you are explicitly provide the auth stanza with a reference to a Kubernetes Secret containing the value. |
|
Hi, adding a secret indeed made it work! I think it would be nice to state it in the doc as we can assume we don't always need it but it seems to be the case unless I'm mistaken. |
Since the behavior with v2 seems to differ from the v1 UI behavior, I agree this should be called out more. Please create an issue for us to resolve this. cc @keycloak/cloud-native it does seem like we shouldn't by default create something that will emit a server side warning - at a minimum there should be a warning attached to the KeycloakOIDCClient CR. |
It's not Operator's responsibility to do the validation of the Client spec. It can't possibly know all the nuances like Client Profiles. But it'd be good to somehow expose the validation warnings in the CR status (I think errors are already exposed). |
I don't mean to imply that the operator is doing the validation - but there is no formal validation being performed here, it's just a log that is happening in ClientAuthenticationFlow. The v2 (or refactored common logic) would need to perform this validation earlier and the validation result would need attached to the response either as a header or we'd need the expand the response payload (include a status or similar stanza somehow). |
|
Not sure to understand but it seems that having a client secret is kind of mandatory now, at least in order to not have the warning log? Because in the doc, nothing says that |
If you omit the auth stanza, the current behavior will create the client marked as public and without an authentication method - that causes the message you are seeing.
The UI save is likely assigning a default authentication method client-secret, which is then also triggering the generation of a secret, so the message then goes away. Any changes you make in the UI however will be undone by any further changes you make to custom resource.
The current expectation with KeycloakOIDCClient if you want to use a client secret is that you are explicitly provide the auth stanza with a reference to a Kubernetes Secret containing the value.