Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(authproxy): set openshift oauth proxy prefix to match oauth2_proxy prefix #131

Merged
merged 1 commit into from
Apr 15, 2024

Conversation

andrewazores
Copy link
Member

@andrewazores andrewazores commented Apr 12, 2024

Fixes cryostatio/cryostat#365
Depends on cryostatio/cryostat#366

$ cat htpasswd.conf 
user:$2y$05$Ju.w7ibNuQ/xaAfKH74lJOJ5xqZbONaNWf7HnrjQuZP.4nhLrr0uS
$ oc create secret generic basicauth --from-file=htpasswd.conf
$ helm install cryostat \
--set authentication.openshift.enabled=true \
--set core.route.enabled=true \
--set openshiftOauthProxy.image.repository=quay.io/andrewazores/openshift-oauth-proxy \
--set openshiftOauthProxy.image.tag=test-14 \
--set authentication.basicAuth.enabled=true \
--set authentication.basicAuth.secretName=basicauth \
--set authentication.basicAuth.filename=htpasswd.conf \
--set core.image.repository=quay.io/andrewazores/cryostat \
--set core.image.tag=3.0.0-oauth-signout-1 \
./charts/cryostat/

It's a bit of a long incantation for testing this, but it's because OpenShift auth must be enabled, I also enable basic auth to test that second case, and then until cryostatio/cryostat#366 is merged it must be tested with a custom Cryostat image, and it must also be tested with a custom oauth-proxy image until openshift/oauth-proxy#272 is addressed.

After that, you should be able to open the Cryostat UI. You will first be greeted by the openshift-oauth-proxy login screen. Log in via htpasswd with user:pass. You should see the actual Cryostat UI. Click the user icon and Logout in the masthead. You should be returned to the login screen - refreshing the page should leave you on the login screen. Next try logging in with OpenShift SSO. This should work largely the same way, but use your OpenShift account credentials instead of user:pass.


Odd bug: if you don't also enable the htpasswd Basic auth mechanism and leave it on OpenShift SSO only, then the logout does not fully work due to a CORS issue.

Screenshot_2024-04-12_15-17-05

However after pressing the Logout button all UI requests fail (because you are actually logged out), and if you try to refresh the page then you will land on the OpenShift SSO login agin.

See cryostatio/cryostat-web#1237 for the bugfix.

@andrewazores
Copy link
Member Author

Maybe a hackish workaround for the bug above would be to just force a refresh on the web-client side if it looks like there was a request failure?

@andrewazores andrewazores merged commit 687bd83 into cryostatio:cryostat3 Apr 15, 2024
2 checks passed
@andrewazores andrewazores deleted the oauth-signout branch April 15, 2024 15:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants