Chapter 4. Configuring OAuth clients

Procedure

• To register additional OAuth clients:

  $ oc create -f <(echo '
  kind: OAuthClient
  apiVersion: oauth.openshift.io/v1
  metadata:
   name: demo
  secret: "..."
  redirectURIs:
   - "http://www.example.com/"
  grantMethod: prompt
  ')

  where:

  metadata.name

  Specifies the OAuth client name. This value is used as the client_id parameter when making requests to <namespace_route>/oauth/authorize and <namespace_route>/oauth/token.

  secret

  Specifies the secret value used as the client_secret parameter when making requests to <namespace_route>/oauth/token.

  redirectURIs

  Specifies the list of valid redirect URIs. The redirect_uri parameter specified in requests to <namespace_route>/oauth/authorize and <namespace_route>/oauth/token must be equal to or prefixed by one of these URIs.

  grantMethod

  Specifies the action to take when this client requests tokens and has not yet been granted access by the user. Use auto to automatically approve the grant and retry the request, or prompt to prompt the user to approve or deny the grant.

Prerequisites

• You have access to the cluster as a user with the cluster-admin role.
• You have configured an identity provider (IDP).

Procedure

• Update the OAuthClient configuration to set a token inactivity timeout.

  1. Edit the OAuthClient object:

     $ oc edit oauthclient <oauth_client>

     Replace <oauth_client> with the OAuth client to configure, for example, console.

     Add the accessTokenInactivityTimeoutSeconds field and set your timeout value:

     apiVersion: oauth.openshift.io/v1
     grantMethod: auto
     kind: OAuthClient
     metadata:
     ...
     accessTokenInactivityTimeoutSeconds: 600

     where:

     accessTokenInactivityTimeoutSeconds

     Specifies the token inactivity timeout in seconds. The minimum allowed value is 300.

  2. Save the file to apply the changes.