OIDC authorization error: 400 bad request

[07nava]

Hi All,

Here are the steps in-details,

Followed the mentioned link to install the skooner,

• https://github.com/skooner-k8s/skooner(With OIDC enabled)
  Deployment.yml

`kind: Deployment
apiVersion: apps/v1
metadata:
name: skooner
namespace: kube-system
spec:
replicas: 1
selector:
matchLabels:
k8s-app: skooner
template:
metadata:
labels:
k8s-app: skooner
spec:
containers:
- name: skooner
image: ghcr.io/skooner-k8s/skooner:stable
ports:
- containerPort: 4654
livenessProbe:
httpGet:
scheme: HTTP
path: /
port: 4654
initialDelaySeconds: 30
timeoutSeconds: 30
env:
- name: OIDC_URL
valueFrom:
secretKeyRef:
name: skooner
key: url
- name: OIDC_CLIENT_ID
valueFrom:
secretKeyRef:
name: skooner
key: id
- name: OIDC_SECRET
valueFrom:
secretKeyRef:
name: skooner
key: secret
nodeSelector:
'beta.kubernetes.io/os': linux

---

`apiVersion: v1
kind: Service
metadata:
name: skooner
namespace: kube-system
annotations:
service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
service.beta.kubernetes.io/aws-load-balancer-internal: "false"
service.beta.kubernetes.io/aws-load-balancer-type: nlb
service.beta.kubernetes.io/aws-load-balancer-ssl-ports: https
service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:us-west-2:551934631674:certificate/3f4ac15a-3936-4f69-b393-7d257633beb3
spec:
ports:
- port: 80
protocol: TCP
targetPort: 4654
selector:
k8s-app: skooner
sessionAffinity: None
type: LoadBalancer``

`OIDC_URL=https://cuserskooner.auth.us-west-2.amazoncognito.com/oauth2/token
OIDC_ID=***
OIDC_SECRET=***

kubectl create secret -n kube-system generic skooner
--from-literal=url=$OIDC_URL
--from-literal=id=$OIDC_ID
--from-literal=secret=$OIDC_SECRET`

Pod Error logs,
POST /apis/authorization.k8s.io/v1/selfsubjectrulesreviews -> https://10.100.0.1:4432023-02-07T07:46:03.526Z POST /apis/authorization.k8s.io/v1/selfsubjectrulesreviews 403An error occurred during the request OPError: expected 200 OK, got: 400 Bad Request    at processResponse (/usr/src/app/node_modules/openid-client/lib/helpers/process_response.js:41:11)    at Function.discover (/usr/src/app/node_modules/openid-client/lib/issuer.js:179:18)    at runMicrotasks ()    at processTicksAndRejections (internal/process/task_queues.js:97:5)    at async getOidcProvider (/usr/src/app/index.js:143:20)    at async getOidcEndpoint (/usr/src/app/index.js:132:22)    at async getOidc (/usr/src/app/index.js:80:30) {  error: 'expected 200 OK, got: 400 Bad Request'} GET /oidc

Thanks for reading and supporting.
Navamaniraj.M

[yuqiuw]

Not sure about where the issue lies, could you follow the Troubleshooting section in our Readme and attach some screenshots of the errors you saw?

Also make sure your script doesn't end with a `

kubectl create secret -n kube-system generic skooner
--from-literal=url=$OIDC_URL
--from-literal=id=$OIDC_ID
--from-literal=secret=$OIDC_SECRET`

[07nava]

Hi @yuqiuw,

Yes, secret are already in place, and values are not ends with a `

OIDC_URL=https://cuserskooner.auth.us-west-2.amazoncognito.com/oauth2/token OIDC_ID=*** OIDC_SECRET=*** kubectl create secret -n kube-system generic skooner \ --from-literal=url=$OIDC_URL \ --from-literal=id=$OIDC_ID \ --from-literal=secret=$OIDC_SECRET

[yuqiuw]

Could you attach the logs generated on server side by kubectl logs deploy/skooner --namespace=kube-system?

Sorry for the late response, we're also just part-time voluntary maintainers, and I'm recently just too busy with work inside of the team

[sateesh4b]

hi
Please find log details

[HPM] POST /apis/authorization.k8s.io/v1/selfsubjectrulesreviews -> https://10.100.0.1:443 2023-03-24T13:00:05.923Z POST /apis/authorization.k8s.io/v1/selfsubjectrulesreviews 201 **An error occurred during the request OPError: expected 200 OK, got: 403 Forbidden** at processResponse (/usr/src/app/node_modules/openid-client/lib/helpers/process_response.js:41:11) at Function.discover (/usr/src/app/node_modules/openid-client/lib/issuer.js:179:18) at runMicrotasks (<anonymous>) at processTicksAndRejections (internal/process/task_queues.js:97:5) at async getOidcProvider (/usr/src/app/index.js:143:20) at async getOidcEndpoint (/usr/src/app/index.js:132:22) at async getOidc (/usr/src/app/index.js:80:30) { error: 'expected 200 OK, got: 403 Forbidden' } GET /oidc

2023-03-24T13:27:45.203Z GET /oidc 500

We added respective clusterrole and cluster bindings as well
@yuqiuw Please help on it