Using Openshift platform as OIDC provider

[thomasmeeus]

Hi,

I'm trying to use Openshift as a OIDC provider as mentioned in these docs: https://docs.openshift.com/container-platform/4.13/authentication/configuring-oauth-clients.html
I also tackled the issue in which Openshift isn't providing the correct jwks_uri by upgrading towards 4.15 as mentioned in: openshift/cluster-kube-apiserver-operator#1578

This is the response that Openshift provides:

sh-4.4$ curl -s  https://kubernetes.default.svc/.well-known/openid-configuration -k | python3 -m json.tool
{
    "issuer": "https://kubernetes.default.svc",
    "jwks_uri": "https://api.okd4-example.cluster.svc:6443/openid/v1/jwks",
    "response_types_supported": [
        "id_token"
    ],
    "subject_types_supported": [
        "public"
    ],
    "id_token_signing_alg_values_supported": [
        "RS256"
    ]
}

I followed these docs to configure Vault: https://developer.hashicorp.com/vault/tutorials/auth-methods/oidc-auth. I adjusted the OIDC endpoint towards the Openshift one & also configured my OAuthClient:

oc get OAuthClient/vault -o yaml
apiVersion: oauth.openshift.io/v1
grantMethod: auto
kind: OAuthClient
metadata:
  creationTimestamp: "2024-05-29T07:13:40Z"
  name: vault
  resourceVersion: "182621425"
  uid: 3c327138-e549-405e-9119-e1dd17155641
redirectURIs:
- https://vault.okd4-example.cluster.svc:/ui/vault/auth/oidc/oidc/callback
- http://localhost:8250/oidc/callback
secret: myS3cr3t

When attempting a login with oidc in Vault webinterface I get a popup which opens the Vault login page again.
This is the result when attempting a login from inside the vault pod via cl:

oc rsh vault-0
/ $ vault login -method=oidc role="reader"
Complete the login via your OIDC provider. Launching browser to:

    ?client_id=vault&code_challenge=mL-Xe3GgAa5aAxoWRZW8Mk12gcJ5zb86W6P0yFDfkQ0&code_challenge_method=S256&nonce=n_jZLdlJBaTm8PvCQQvMWJ&redirect_uri=http%3A%2F%2Flocalhost%3A8250%2Foidc%2Fcallback&response_type=code&scope=openid&state=st_kUrXrregO0PngPAuRMgE


Error attempting to automatically open browser: '1 error occurred:
        * exec: "xdg-open": executable file not found in $PATH

'.
Please visit the authorization URL manually.Waiting for OIDC authentication to complete...

as you can see the authURL is not correct; it only contains the params and not an actual domain.
I'm having trouble to locate where this issue can be situatued. On which values is this url assembled? I have the feeling that Openshift does not provide a required param, but then I need to know which one in order to go back to Redhat support.

Are there any experiences in using Openshift as OIDC provider?

Thanks

[thomasmeeus]

I see the same behaviour when using plain JWT