holgerkoser
commented
5 years ago Dex as federated OpenID Connect provider cannot work because it also must be configured at the api server in order to work. Since you don't have access to the aks control plane it could never work.
You will have to use the ADD/OIDC server connected to your apiserver directly (without dex) in your dashboard configuration. The tennant_id ist the Directory-ID you will find in the Azure Active Directory > Properties. As application_id I would try to use the Server application ID since it is of type WebApp. In the manifest of this you will have to enable implicit outh flow "oauth2AllowImplicitFlow": true and you have add the dashboard-callback-url as redirect uri to the Server Application https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-configure-app-access-web-apis#add-redirect-uris-to-your-application. Unfortunately I am not able to try that this works with our ADD :-(
jwt:
audience: "{{application_id}}"
issuer: "https://sts.windows.net/{{tenant_id}}/"
algorithms: [ RS256 ]
jwks:
strictSsl: true
rejectUnauthorized: true
cache: true
rateLimit: false
jwksRequestsPerMinute: 5
jwksUri: https://login.microsoftonline.com/common/discovery/keys
frontend:
oidc:
authority: "https://sts.windows.net/{{tenant_id}}/"
client_id: "{{application_id}}"
redirect_uri: "{{public_dashboard_url}}/callback"
response_type: 'token id_token'
scope: 'openid email profile groups'
loadUserInfo: falseI hope this hints will help you.
Best regards, Holger
bergerx
praveendhac
Only solution I see is to move to complete oidc flow to the backend and use authorization code flow and provide the token from the backend. Or ask Azure to support CORS for the keys endpoint.
eaterm
petersutter
TL;DR: OAuth parameter for AKS kube-apiserver's OIDC parameters are not known, and we are not able to configure the Gardener Dashboard the correct way.
We are hosting our Garden and Seed clusters on AKS as described in docs/deployment/aks.md. But with one change. In our Garden AKS cluster now we have AAD enabled. After we wrote that doc AKS went GA and they enabled RBAC and AAD integrations. I created https://github.com/gardener/gardener/issues/551 to update the AKS deployment doc.
Previously we were not able to do that since the we had no control over AKS OIDC parameters. We were not able to deploy the Gardener Dashboard since it requires the Garden Kubernetes cluster authentication work with Oauth token. After AKS went GA and they enabled AAD and RBAC on AKS clusters (https://docs.microsoft.com/en-us/azure/aks/aad-integration), this now enabled us deploy the Dashboard on top AKS. At least we thought that it would.
We enabled AAD on our AKS Garden clusters and started investigating how to configure the Gardener Dashboard to work with AKS. But the Dashboard needs to be configured with the same OIDC parameters with the underlying Kubernetes cluster. But we were on AKS and we don't have visibility on control plane components configuration including the kube-apiserver of the cluster which has the OIDC configuration.
We tried to configure the Gardener with whatever we are able to find in the https://docs.microsoft.com/en-us/azure/aks/aad-integration page create a compatible OIDC parameters for Gardener Dashboard. But we were not able to be successful figure out the right configuration values for the Dashboard.
Next, we tried putting DEX as an intermediary server, Dashboard was using Dex and DEX was authenticating us to the same AAD with the AKS. This time we were able to login to the Dashboard but we were not able to see any resources. This is because the Auth Token provided by DEX is actually not valid in AKS, DEX was kind of proxying the Token.
After spending some time dealing with AAD and DEX configuration we gave up.