unauthorized error after login with External OIDC

[MohamedAnouar]

Describe the bug

When trying to configure eclipse che with external OIDC (keycloak / Azure AD) with AKS version 1.21.2, we run into unauthorized issues after deployment : we used the following configuration file :
spec:
server:
customCheProperties:
CHE_OIDC_USERNAME__CLAIM: "email"
auth:
externalIdentityProvider: true
openShiftoAuth: false
identityProviderURL: "https://login.microsoftonline.com/XXXXXXXX/v2.0"
identityProviderRealm: "XXXXX"
identityProviderClientId: "XXXXX"
oAuthClientName: "XXXX"
identityProviderSecret: "XXXX"
oAuthSecret: "XXXXX"

The command we used to install :

chectl server:deploy
--domain=xxxx.com
--platform=k8s
--telemetry=off
--che-operator-cr-patch-yaml=checluster.yml
--skip-oidc-provider-check

Che version

7.47@latest

Steps to reproduce

1. Start a AKS cluster on Azure (version used 1.21.2)
2. login with admin in K8S and start eclipse che deployment. with the following command :
3. chectl server:deploy
   --domain=xxxx.com
   --platform=k8s
   --telemetry=off
   --che-operator-cr-patch-yaml=checluster.yml
   --skip-oidc-provider-check
4. login the eclipse with the provided URL
5. In the eclipse che web interface the is a popup saying "unauthorized"
6. Click to create a workspace
7. Error message "unauthorized"

Expected behavior

The user is able to access and to launch the workspace

Runtime

Kubernetes (vanilla)

Screenshots

Installation method

chectl/latest

Environment

Linux

Eclipse Che Logs

No response

Additional context

No response

[Ryder05]

You need to configure you kubernetes API server to use your externel OIDC provider.

#21049 (comment)

[MohamedAnouar]

Hello, in AKS we already enabled OIDC access :

[Ryder05]

Hello, in AKS we already enabled OIDC access :

you need to specify the flags --oidc-issuer-url and --oidc-client-id on the API server.

https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens

I had the same problem as you and i resolved it by confuguring the kube api as this image indicates.

[MohamedAnouar]

Hello

Hello, in AKS we already enabled OIDC access :

you need to specify the flags --oidc-issuer-url and --oidc-client-id on the API server.

https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens

I had the same problem as you and i resolved it by confuguring the kube api as this image indicates.
Hello AKS is managed service, activating the OIDC option, is the same as adding the OIDC flag to the API server.

[MohamedAnouar]

Any recommendations?

[karatkep]

@MohamedAnouar I had the same issue for my AKS. So I have patched che-operator to pass access token to AKS. And it solved the issue for me. You can try to add below during server:deploy

--che-operator-image=docker.io/karatkep/che-operator:gamma

Hope it will help you as well.

[che-bot]

Issues go stale after 180 days of inactivity. lifecycle/stale issues rot after an additional 7 days of inactivity and eventually close.

Mark the issue as fresh with /remove-lifecycle stale in a new comment.

If this issue is safe to close now please do so.

Moderators: Add lifecycle/frozen label to avoid stale mode.