StarlingX OIDC Authentication App
b78a185adc
When the user tries to authenticate using oidc-auth command externally, the oidc-auth script wasn't able to verify the local issuer certificate as following: user@external-machine$ oidc-auth -c <oam_ip> -u user2 -p <password> [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate When the StarlingX system has HTTPS certificate enabled, one of the steps to configure the Remote CLIs and Clients Container is to provide the ca certificate which oidc-auth script should use to verify the requests during the authentication procedure, the enviroment variable OS_CACERT will hold the ca certifile file name. Refer the guide: https://docs.starlingx.io/security/openstack/ configure-remote-clis-and-clients.html for more information. The fix basically lets the oidc-auth script know about which certificate should be used during the authentication procedure. By default, now the oidc-auth script will use the certificate file provided into the OS_CACERT enviroment variable. Additionally, an option was created for the users to specify a cacert file when using the oidc-auth command. Test Plan: PASS: Deploy a SX and configure the oidc-auth-apps. PASS: Create an ldap user and configure the user roles. PASS: Try to authenticate locally using oidc-auth, should be successed. PASS: Configure the Remote CLIs in your remote workstation in order to get access to the oidc-auth command, refer the guide: Configure Container-backed Remote CLIs and Clients. PASS: Authenticate from your remote workstation with the oidc-auth command: oidc-auth -c <oam_ip> -u <ldap_user> -p <ldap_user_password> The command should now successed. PASS: Opitional, authenticate from your remote workstation with the oidc-auth command specifying a cacert file: oidc-auth -c <oam_ip> -u <ldap_user> -p <ldap_user_password> -ca <path to ca-certificate file> Closes-Bug: 2086731 Change-Id: Ia8f37b44f846207a13b8b4983cc3ed0614d97a93 Signed-off-by: Joaci Morais <Joaci.deMorais@windriver.com> |
||
|---|---|---|
| helm-charts | ||
| oidc-auth-tools | ||
| python3-k8sapp-oidc | ||
| stx-oidc-auth-helm | ||
| stx-oidc-client/debian | ||
| .gitignore | ||
| .gitreview | ||
| .zuul.yaml | ||
| bindep.txt | ||
| debian_build_layer.cfg | ||
| debian_iso_image.inc | ||
| debian_pkg_dirs | ||
| debian_stable_docker_images.inc | ||
| requirements.txt | ||
| test-requirements.txt | ||
| tox.ini | ||