Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ui/oidc: Add 'groups' scope when requesting an id_token from Dex #2529

Merged
merged 2 commits into from
May 7, 2020

Conversation

gdemonet
Copy link
Contributor

@gdemonet gdemonet commented May 6, 2020

Component: ui

Context:

In the scopes we request from Dex when retrieving and id_token to then
authenticate to K8s API, we didn't include the 'groups' optional scope.
This meant that apiserver couldn't retrieve the 'groups' claim from the
generated token, hence the authenticated user wouldn't be able to assume
roles based on Group-based (Cluster)RoleBindings.

Summary:

We add this scope to the redux-oidc manager configuration, and this
resolves the issue.

Acceptance criteria:

See #2526 reproducing steps - group-based RBAC should be functional


Closes: #2526

gdemonet added 2 commits May 6, 2020 14:27
In the scopes we request from Dex when retrieving and id_token to then
authenticate to K8s API, we didn't include the 'groups' optional scope.
This meant that apiserver couldn't retrieve the 'groups' claim from the
generated token, hence the authenticated user wouldn't be able to assume
roles based on Group-based (Cluster)RoleBindings.

We add this scope to the `redux-oidc` manager configuration, and this
resolves the issue.

Fixes: #2526
@gdemonet gdemonet added kind:bug Something isn't working topic:ui UI-related issues complexity:easy Something that requires less than a day to fix topic:authentication Anything related to user authentication labels May 6, 2020
@gdemonet gdemonet added this to the MetalK8s 2.5.1 milestone May 6, 2020
@gdemonet gdemonet requested review from ChengYanJin and a team May 6, 2020 12:54
@bert-e
Copy link
Contributor

bert-e commented May 6, 2020

Hello gdemonet,

My role is to assist you with the merge of this
pull request. Please type @bert-e help to get information
on this process, or consult the user documentation.

Status report is not available.

@bert-e
Copy link
Contributor

bert-e commented May 6, 2020

Branches have diverged

This pull request's source branch bugfix/2526-add-groups-scope has diverged from
development/2.6 by more than 50 commits.

To avoid any integration risks, please re-synchronize them using one of the
following solutions:

  • Merge origin/development/2.6 into bugfix/2526-add-groups-scope
  • Rebase bugfix/2526-add-groups-scope onto origin/development/2.6

Note: If you choose to rebase, you may have to ask me to rebuild
integration branches using the reset command.

ChengYanJin
ChengYanJin previously approved these changes May 6, 2020
Copy link
Contributor

@ChengYanJin ChengYanJin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@gdemonet gdemonet changed the base branch from development/2.6 to development/2.5 May 6, 2020 14:49
@gdemonet gdemonet dismissed ChengYanJin’s stale review May 6, 2020 14:49

The base branch was changed.

@bert-e
Copy link
Contributor

bert-e commented May 6, 2020

Integration data created

I have created the integration data for the additional destination branches.

The following branches will NOT be impacted:

  • development/1.0
  • development/1.1
  • development/1.2
  • development/1.3
  • development/2.0
  • development/2.1
  • development/2.2
  • development/2.3
  • development/2.4

You can set option create_pull_requests if you need me to create
integration pull requests in addition to integration branches, with:

@bert-e create_pull_requests

@bert-e
Copy link
Contributor

bert-e commented May 6, 2020

Waiting for approval

The following approvals are needed before I can proceed with the merge:

  • the author

  • one peer

Peer approvals must include at least 1 approval from the following list:

@gdemonet
Copy link
Contributor Author

gdemonet commented May 7, 2020

/approve

@bert-e
Copy link
Contributor

bert-e commented May 7, 2020

In the queue

The changeset has received all authorizations and has been added to the
relevant queue(s). The queue(s) will be merged in the target development
branch(es) as soon as builds have passed.

The changeset will be merged in:

  • ✔️ development/2.5

  • ✔️ development/2.6

The following branches will NOT be impacted:

  • development/1.0
  • development/1.1
  • development/1.2
  • development/1.3
  • development/2.0
  • development/2.1
  • development/2.2
  • development/2.3
  • development/2.4

There is no action required on your side. You will be notified here once
the changeset has been merged. In the unlikely event that the changeset
fails permanently on the queue, a member of the admin team will
contact you to help resolve the matter.

IMPORTANT

Please do not attempt to modify this pull request.

  • Any commit you add on the source branch will trigger a new cycle after the
    current queue is merged.
  • Any commit you add on one of the integration branches will be lost.

If you need this pull request to be removed from the queue, please contact a
member of the admin team now.

The following options are set: approve

@bert-e
Copy link
Contributor

bert-e commented May 7, 2020

I have successfully merged the changeset of this pull request
into targetted development branches:

  • ✔️ development/2.5

  • ✔️ development/2.6

The following branches have NOT changed:

  • development/1.0
  • development/1.1
  • development/1.2
  • development/1.3
  • development/2.0
  • development/2.1
  • development/2.2
  • development/2.3
  • development/2.4

Please check the status of the associated issue None.

Goodbye gdemonet.

@bert-e bert-e merged commit 8ceed26 into development/2.5 May 7, 2020
@bert-e bert-e deleted the bugfix/2526-add-groups-scope branch May 7, 2020 14:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
complexity:easy Something that requires less than a day to fix kind:bug Something isn't working topic:authentication Anything related to user authentication topic:ui UI-related issues
Projects
None yet
Development

Successfully merging this pull request may close these issues.

MetalK8s UI isn't retrieving groups claim from Dex
3 participants