Skip to content
This repository was archived by the owner on May 17, 2024. It is now read-only.
This repository was archived by the owner on May 17, 2024. It is now read-only.

claims from id_token are not passed to k8s cluster #185

Description

@SnehaMore20

I have deployed kube-oidc-proxy and authenticating using Keycloak into our K8s cluster. But I have observed that kube-oidc-proxy takes claims only from refresh_token and not from id_token.
e.g
refresh_token given below

{
  "aud": "https://keycloak.example.com/auth/realms/test",
  "azp": "k8s",
  "exp": 1611054882,
  "iat": 1611053082,
  "iss": "https://keycloak.example.com/auth/realms/test",
  "jti": "*",
  "scope": "openid profile email",
  "session_state": "*",
  "sub": "*",
  "typ": "Refresh"
}

id_token given below

{
  "acr": "1",
  "aud": "k8s",
  "auth_time": 0,
  "azp": "k8s",
  "email": "test@example.com",
  "email_verified": false,
  "exp": 1611052668,
  "family_name": "test",
  "given_name": "",
  "groups": [
    "/test1",
    "/test2"
  ],
  "iat": 1611052368,
  "iss": "https://keycloak.example.com/auth/realms/test",
  "jti": "*",
  "name": "test",
  "preferred_username": "test",
  "session_state": "*",
  "sub": "*",
  "typ": "ID"
}

when i pass "--oidc-username-claim=sub" to kube-oidc-proxy , it works and authenticates correctly.
but when i pass "--oidc-username-claim=email" to kube-oidc-proxy, logs throws error:

1 handlers.go:169] unauthenticated user request 10.12.12.192:51378

and kubectl throws error:

error: You must be logged in to the server (the server has asked for the client to provide credentials)

So basically I am not able to use claims from id_token.
Is there any way I can user claims from id_token?

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions