Open AndrewSav opened 7 months ago
Hey @AndrewSav When you say it doesn't let me log in is it not showing the Sign In page or It doesn't work after completing the signin flow.
@yolossn it does show the sign in page, but it should not since the kubeconfig is already in the usable state there is no need for the signin UI flow, it should just work. Neither OpenLens nor kubectl require any visible signin flow with this config.
The sign-in page does not work, either but I'm not surprised about this because it could not possibly know how to login to my cluster, so I'm not concerned about it.
Hey also similar issue on my side:
We are authenticating via OpenUnison: https://openunison.github.io/ I can either copy a command from their dashboard and it then generates the whole kubeconfig or via their CLI. The kubeconfig then looks like this:
- name: my-username
user:
auth-provider:
config:
client-id: kubernetes
client-secret: "" #this is empty
id-token: eyJh...
idp-certificate-authority-data: ""
idp-issuer-url: OUR-DOMAIN-URL/auth/idp/k8sIdp
refresh-token: q1b....
name: oidc
When i manually create/refresh the kubeconfig, it works via openlens.
But with headlamp when i then press "Sing In" it opens following URL :
http://localhost:4466/oidc-callback?error=unauthorized_client
and says
invalid request state is empty
I don't see from where this URL is getting picked up or how i could adjust it to my idp-issuer-url
value from the kubeconfig.
Or could we even just skip this check, because we can outside of headlamp create/refresh the token manually ? That worked would work fine for me now as it's also the state with openlens
This is a fragment of my kubeconfig (redacted) that works perfectly with
kubectl
and open lensHowever it does not let me log in with the headlamp desktop app.