Skip to content
This repository was archived by the owner on May 17, 2024. It is now read-only.
This repository was archived by the owner on May 17, 2024. It is now read-only.

claims from id_token are not passed to k8s cluster #185

Open
@SnehaMore20

Description

@SnehaMore20

I have deployed kube-oidc-proxy and authenticating using Keycloak into our K8s cluster. But I have observed that kube-oidc-proxy takes claims only from refresh_token and not from id_token.
e.g
refresh_token given below

{
  "aud": "https://keycloak.example.com/auth/realms/test",
  "azp": "k8s",
  "exp": 1611054882,
  "iat": 1611053082,
  "iss": "https://keycloak.example.com/auth/realms/test",
  "jti": "*",
  "scope": "openid profile email",
  "session_state": "*",
  "sub": "*",
  "typ": "Refresh"
}

id_token given below

{
  "acr": "1",
  "aud": "k8s",
  "auth_time": 0,
  "azp": "k8s",
  "email": "[email protected]",
  "email_verified": false,
  "exp": 1611052668,
  "family_name": "test",
  "given_name": "",
  "groups": [
    "/test1",
    "/test2"
  ],
  "iat": 1611052368,
  "iss": "https://keycloak.example.com/auth/realms/test",
  "jti": "*",
  "name": "test",
  "preferred_username": "test",
  "session_state": "*",
  "sub": "*",
  "typ": "ID"
}

when i pass "--oidc-username-claim=sub" to kube-oidc-proxy , it works and authenticates correctly.
but when i pass "--oidc-username-claim=email" to kube-oidc-proxy, logs throws error:

1 handlers.go:169] unauthenticated user request 10.12.12.192:51378

and kubectl throws error:

error: You must be logged in to the server (the server has asked for the client to provide credentials)

So basically I am not able to use claims from id_token.
Is there any way I can user claims from id_token?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions