OpenID Connect support (IBM Cloud)

[pbouillet]

Kubebox always wants me to enter login information, whereas it just should use the defined one.

To login into our IBM cloud environment, we need to export the KUBECONFIG environment variable pointing to a configuration which includes the following:

apiVersion: v1
clusters:
- cluster:
    certificate-authority: ...pem

The .pem file is in the same folder as the kubeconfig file. I'm guessing somehow it's not read and thus I cannot pass the login screen.

Should this work out of the box? kubectl works without any problems.

[pbouillet]

I tried converting the certificate to base64 and including this into the config file. kubectl still works, but kubebox doesn't.

Is there any debug option I could activate to see some log output?

[pbouillet]

After looking a little bit into the source, it seems like the certificate is not the problem but the lack of support for oidc user authentication which looks like: https://kubernetes.io/docs/reference/access-authn-authz/authentication/#option-1-oidc-authenticator

Any plans to support this?

[johnpoth]

Hi @pbouillet full oicd support needs #1. I've created a task to track oidc support. Also note that if you're running kubebox in the browser we currently aren't reading files referenced in your kubeconfig file.

[astefanutti]

+1 to supporting OIDC.

I think we could at least support reading the auth-provider section of the kubeconfig files and the automatic refreshing of the id_token.

Then #1 would provide support for the initial authentication for password based ID providers.

[astefanutti]

Reading the id-token has been done in 4612f5cc9aa8053d7939f2d66503dd2c240333ab thanks to @robholland.

[astefanutti]

It should be fixed with #30 thanks to @johnpoth.

[astefanutti]

Let me close this. Feel free to report any issues you might find.