Search

Chapter 4. Configuring OAuth clients

download PDF

Several OAuth clients are created by default in OpenShift Container Platform. You can also register and configure additional OAuth clients.

4.1. Default OAuth clients

The following OAuth clients are automatically created when starting the OpenShift Container Platform API:

OAuth clientUsage

openshift-browser-client

Requests tokens at <namespace_route>/oauth/token/request with a user-agent that can handle interactive logins. [1]

openshift-challenging-client

Requests tokens with a user-agent that can handle WWW-Authenticate challenges.

openshift-cli-client

Requests tokens by using a local HTTP server fetching an authorization code grant.

  1. <namespace_route> refers to the namespace route. This is found by running the following command:

    $ oc get route oauth-openshift -n openshift-authentication -o json | jq .spec.host

4.2. Registering an additional OAuth client

If you need an additional OAuth client to manage authentication for your OpenShift Container Platform cluster, you can register one.

Procedure

  • To register additional OAuth clients:

    $ oc create -f <(echo '
    kind: OAuthClient
    apiVersion: oauth.openshift.io/v1
    metadata:
     name: demo 1
    secret: "..." 2
    redirectURIs:
     - "http://www.example.com/" 3
    grantMethod: prompt 4
    ')
    1
    The name of the OAuth client is used as the client_id parameter when making requests to <namespace_route>/oauth/authorize and <namespace_route>/oauth/token.
    2
    The secret is used as the client_secret parameter when making requests to <namespace_route>/oauth/token.
    3
    The redirect_uri parameter specified in requests to <namespace_route>/oauth/authorize and <namespace_route>/oauth/token must be equal to or prefixed by one of the URIs listed in the redirectURIs parameter value.
    4
    The grantMethod is used to determine what action to take when this client requests tokens and has not yet been granted access by the user. Specify auto to automatically approve the grant and retry the request, or prompt to prompt the user to approve or deny the grant.

4.3. Configuring token inactivity timeout for an OAuth client

You can configure OAuth clients to expire OAuth tokens after a set period of inactivity. By default, no token inactivity timeout is set.

Note

If the token inactivity timeout is also configured in the internal OAuth server configuration, the timeout that is set in the OAuth client overrides that value.

Prerequisites

  • You have access to the cluster as a user with the cluster-admin role.
  • You have configured an identity provider (IDP).

Procedure

  • Update the OAuthClient configuration to set a token inactivity timeout.

    1. Edit the OAuthClient object:

      $ oc edit oauthclient <oauth_client> 1
      1
      Replace <oauth_client> with the OAuth client to configure, for example, console.

      Add the accessTokenInactivityTimeoutSeconds field and set your timeout value:

      apiVersion: oauth.openshift.io/v1
      grantMethod: auto
      kind: OAuthClient
      metadata:
      ...
      accessTokenInactivityTimeoutSeconds: 600 1
      1
      The minimum allowed timeout value in seconds is 300.
    2. Save the file to apply the changes.

Verification

  1. Log in to the cluster with an identity from your IDP. Be sure to use the OAuth client that you just configured.
  2. Perform an action and verify that it was successful.
  3. Wait longer than the configured timeout without using the identity. In this procedure’s example, wait longer than 600 seconds.
  4. Try to perform an action from the same identity’s session.

    This attempt should fail because the token should have expired due to inactivity longer than the configured timeout.

4.4. Additional resources

Red Hat logoGithubRedditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

© 2024 Red Hat, Inc.