Uploaded image for project: 'OpenShift Java Client'
  1. OpenShift Java Client
  2. OSJC-10

openshift-java-client: incompatibility with OpenShift Enterprise and Origin when using the remote-user authentication plugin

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • Major
    • 2.5.0
    • None
    • None

    Description

      OpenShift Enterprise and Origin both ship an authentication plugin that allows parts of authentication to be handled by Apache and other parts to be delegated to the openshift-origin-controller codebase. I've found that all versions of openshift-java-client after 2.3.0.Final change a (poorly documented) requirement for the OpenShift remote-user plugin.

      In order for a request to bypass the Apache authentication and passthrough to the OpenShift Broker the user-agent header is inspected. If the user-agent is 'OpenShift' then the Broker will require an encrypted authentication token. Today this is used by the jenkins cartridge but I believe it's also still used for scaling.

      You can see this for details:
      https://github.com/openshift/origin-server/blob/master/documentation/archive/how_nodes_act_on_behalf_of_users.md#how-the-encrypted-token-is-used

      In 2.3.0.Final of the openshift-java-client the user-agent was 'OpenShift' however all versions after this set the user-agent to the java version (eg, User-Agent: Java/1.7.0_45).

      Attachments

        Issue Links

          Activity

            People

              adietish@redhat.com André Dietisheim
              rh-ee-bleanhar Brenton Leanhardt
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: