Updated Readme for Azure (OIDC) auth provider #58752

puja108 · 2018-01-24T14:41:54Z

What this PR does / why we need it:
When trying this documentation in the field, I ran into some issues based on details missing here. I got it working in the end with some help from @stuartleeks from Microsoft, this PR is to help others trying to set this up not have the same question marks I had.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
None AFAIK

Special notes for your reviewer:
Includes:

Added details and clarifications based on my experience
Some minor copy editing

Not sure if this requires release notes, I consider it a very small change.

Release note:

NONE

k8s-ci-robot · 2018-01-24T14:42:02Z

Hi @puja108. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

puja108 · 2018-01-24T14:46:04Z

staging/src/k8s.io/client-go/plugin/pkg/client/auth/azure/README.md

@@ -45,4 +46,4 @@ This plugin provides an integration with Azure Active Directory device flow. If
   To sign in, use a web browser to open the page https://aka.ms/devicelogin and enter the code DEC7D48GA to authenticate.


Actually, this step in the setup in my case could only be done on Windows. However, that was because of some iOS specific settings in the ADFS (with which the AAD was connected) that were somehow also breaking Mac browsers. I'm not sure if I should mention that here, as it might just be a very specific edge case.

puja108 · 2018-01-24T14:47:13Z

staging/src/k8s.io/client-go/plugin/pkg/client/auth/azure/README.md

@@ -21,8 +20,9 @@ This plugin provides an integration with Azure Active Directory device flow. If

   * Replace the `APISERVER_APPLICATION_ID` with the application ID of `apiserver` application
   * Replace `TENANT_ID` with your tenant ID.
+   * For a list of alternative username claims that are supported by the OIDC issuer check the JSON response at `https://sts.windows.net/TENANT_ID/.well-known/openid-configuration`.


sub is a very cryptic ID, which is not nice to map in a binding.

Agreed! We use upn instead ourselves.

puja108 · 2018-01-24T14:52:32Z

/assign @liggitt

puja108 · 2018-01-24T14:55:49Z

staging/src/k8s.io/client-go/plugin/pkg/client/auth/azure/README.md

@@ -45,4 +46,6 @@ This plugin provides an integration with Azure Active Directory device flow. If
   To sign in, use a web browser to open the page https://aka.ms/devicelogin and enter the code DEC7D48GA to authenticate.
   ```

-   * After signing in a web browser, the token is stored in the configuration, and it will be reused when executing next commands.
+   * After signing in a web browser, the token is stored in the configuration, and it will be reused when executing further commands.
+   * The user name in Kubernetes will look like the following: `https://sts.windows.net/TENANT_ID/#username_claim`. If you are using any authorization method you need to give permissions to that user, e.g. by binding the user to a role in the case of RBAC.


Tried to keep this independent from specific authz method

feiskyer

/ok-to-test

puja108 · 2018-02-06T10:32:18Z

anything I can do here to push this forward?

feiskyer · 2018-02-07T02:30:36Z

ping @liggitt @brendandburns

liggitt · 2018-02-07T03:44:29Z

staging/src/k8s.io/client-go/plugin/pkg/client/auth/azure/README.md

@@ -45,4 +46,6 @@ This plugin provides an integration with Azure Active Directory device flow. If
   To sign in, use a web browser to open the page https://aka.ms/devicelogin and enter the code DEC7D48GA to authenticate.
   ```

-   * After signing in a web browser, the token is stored in the configuration, and it will be reused when executing next commands.
+   * After signing in a web browser, the token is stored in the configuration, and it will be reused when executing further commands.
+   * The user name in Kubernetes will look like the following: `https://sts.windows.net/TENANT_ID/#username_claim`. If you are using any authorization method you need to give permissions to that user, e.g. by binding the user to a role in the case of RBAC.


The issuer prefix is actually optional now and can be omitted via the apiserver oidc username claim prefix flag

I see. I had not seen issuer prefixing in testing OIDC before, so I thought it was AAD that was including the prefix. Most probably cause I was always using the email claim. Just saw that this is documented at https://kubernetes.io/docs/admin/authentication/#configuring-the-api-server
I'll change this to make it more clear and link out to the source

liggitt · 2018-02-07T03:45:46Z

staging/src/k8s.io/client-go/plugin/pkg/client/auth/azure/README.md


 ## Usage

-1. Create an Azure Active Directory *Web App / API* application for `apiserver` following these [instructions](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-app-registration)
+1. Create an Azure Active Directory *Web App / API* application for `apiserver` following these [instructions](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-app-registration). The callback URL of your App needs to be set to the external URL of your Kubernetes API Server.


This surprises me… we don’t actually support redirecting to the apiserver for anything, right? @colemickens, was this how you configured stuff when you were adding this?

I think @stuartleeks told me that it's needed. Might be to identify the caller not for actually calling back?

@puja108 - apologies for any confusion. I don't believe that the callback URL is used in the auth flow that is used for RBAC, but Azure AD requires that something is specified in the field when you create the app so using the api server seems like a reasonable value as a way to mentally create a connection :-)

Getting back to this, as this seem to be the last open comment. I tested this and it does not matter, just is nice to have a connection. However, in our case for example they want to use the same apps for a bunch of clusters, so I'll just change this so it says that the Callback URL does not matter, and you can put whatever you want that helps you make a connection.

puja108 · 2018-04-10T15:27:51Z

Anything else I should do @liggitt?

liggitt · 2018-04-10T21:22:09Z

LGTM, needs squash

Includes: * Added details and clarifications based on my experience * Some minor copy editing added note about resulting username fixing last list item clarficiation of resulting username mainly just refering to OIDC docs fixed comment about callback URL

puja108 · 2018-04-11T10:05:21Z

squashed

liggitt · 2018-04-11T11:23:42Z

/lgtm

k8s-ci-robot · 2018-04-11T11:24:10Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liggitt, puja108

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~staging/src/k8s.io/client-go/OWNERS~~ [liggitt]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-github-robot · 2018-04-11T12:23:36Z

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions here.

k8s-ci-robot added release-note-none Denotes a PR that doesn't merit a release note. retest-not-required-docs-only size/S Denotes a PR that changes 10-29 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Jan 24, 2018

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jan 24, 2018

k8s-ci-robot requested review from feiskyer and gmarek January 24, 2018 14:42

puja108 commented Jan 24, 2018

View reviewed changes

k8s-ci-robot assigned liggitt Jan 24, 2018

puja108 commented Jan 24, 2018

View reviewed changes

feiskyer approved these changes Jan 24, 2018

View reviewed changes

feiskyer removed the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jan 24, 2018

liggitt reviewed Feb 7, 2018

View reviewed changes

puja108 force-pushed the patch-1 branch from dc687e0 to 2709a7e Compare April 11, 2018 10:03

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 11, 2018

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 11, 2018

k8s-github-robot merged commit 99e77a7 into kubernetes:master Apr 11, 2018

puja108 mentioned this pull request Jan 3, 2019

REQUEST: New membership for @puja108 kubernetes/org#327

Closed

6 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Updated Readme for Azure (OIDC) auth provider #58752

Updated Readme for Azure (OIDC) auth provider #58752

puja108 commented Jan 24, 2018 •

edited

Loading

k8s-ci-robot commented Jan 24, 2018

puja108 Jan 24, 2018

puja108 Jan 24, 2018

mirthy Mar 9, 2018

puja108 commented Jan 24, 2018

puja108 Jan 24, 2018

feiskyer left a comment

puja108 commented Feb 6, 2018

feiskyer commented Feb 7, 2018

liggitt Feb 7, 2018

puja108 Feb 7, 2018

liggitt Feb 7, 2018

puja108 Feb 7, 2018

stuartleeks Feb 7, 2018

puja108 Mar 12, 2018

puja108 commented Apr 10, 2018

liggitt commented Apr 10, 2018

puja108 commented Apr 11, 2018

liggitt commented Apr 11, 2018

k8s-ci-robot commented Apr 11, 2018

k8s-github-robot commented Apr 11, 2018

		@@ -45,4 +46,4 @@ This plugin provides an integration with Azure Active Directory device flow. If
		To sign in, use a web browser to open the page https://aka.ms/devicelogin and enter the code DEC7D48GA to authenticate.

Updated Readme for Azure (OIDC) auth provider #58752

Updated Readme for Azure (OIDC) auth provider #58752

Conversation

puja108 commented Jan 24, 2018 • edited Loading

k8s-ci-robot commented Jan 24, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

puja108 commented Jan 24, 2018

Choose a reason for hiding this comment

feiskyer left a comment

Choose a reason for hiding this comment

puja108 commented Feb 6, 2018

feiskyer commented Feb 7, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

puja108 commented Apr 10, 2018

liggitt commented Apr 10, 2018

puja108 commented Apr 11, 2018

liggitt commented Apr 11, 2018

k8s-ci-robot commented Apr 11, 2018

k8s-github-robot commented Apr 11, 2018

puja108 commented Jan 24, 2018 •

edited

Loading