Repository navigation
fix: allowing the kubernetes jwt test to pass on openshift (#49488) - #49614
Conversation
|
@vmuzikar It appears that the request can no longer contain the client_id against minishift in the backport. At first glance there doesn't appear to be differences in the org.keycloak.broker.kubernetes package or the operator-ci kube / minikube version to explain this. |
bdfa1ff to
89788df
Compare
| }; | ||
| )); | ||
| if (Utils.isOpenShift(k8sclient)) { | ||
| args.addAll(List.of("--data-urlencode", "client_id=kubernetes-client")); // the token may not contain the client |
There was a problem hiding this comment.
Unfortunately I don't have an OpenShift cluster at hand but I wonder if we really need it?
When using the "Signed JWT - Federated authentication", Keycloak selects an IdP and Client pair based on the JWT token (using the DefaultClientAssertionStrategy). The client_id param is not actively in the authentication process.
With the latest changes from #48026, when the client_id is passed in - it's validated.
Also related to this, @chance-coleman works on an inprovement of the Issuer discovery process: #49600. Since OpenShift uses Osin internally, it probably falls into the same category as other managed clusters (AKS/EKS). This improvement could help in this case as well.
There was a problem hiding this comment.
Unfortunately I don't have an OpenShift cluster at hand but I wonder if we really need it?
This could have to do with the order in which I fixed things. Initially with openshift the server side error was client_not_found, so I added the client_id (because it did appear in the minikube token, but not the openshift one). Things still failed, but that was because the openshift issuer is different than the minikube one. After that change, things seemed to work for both openshift and minikube.
I will spin up another openshift to see if it works with just the issuer fix.
There was a problem hiding this comment.
Fantasic! Thank you for looking into this @shawkins !
58bd981 to
d45dc2a
Compare
d45dc2a to
c14c8ab
Compare
…49488) closes: keycloak#49445 Signed-off-by: Steve Hawkins <shawkins@redhat.com> (cherry picked from commit 2e79884)
closes: keycloak#49445 Signed-off-by: Steve Hawkins <shawkins@redhat.com>
c14c8ab to
845327f
Compare
closes: #49445
Signed-off-by: Steve Hawkins shawkins@redhat.com
(cherry picked from commit 2e79884)