Skip to content

Commit d38aaec

Browse files
huffmancahuffmanca
committed
BZ-1694825: Adjusted the configuration details of the OAuth server.
1 parent d96f8de commit d38aaec

File tree

5 files changed

+14
-90
lines changed

5 files changed

+14
-90
lines changed

‎authentication/configuring-internal-oauth.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ include::modules/oauth-internal-options.adoc[leveloffset=+1]
1818

1919
include::modules/oauth-configuring-internal-oauth.adoc[leveloffset=+1]
2020

21-
include::modules/oauth-register-additional-server.adoc[leveloffset=+1]
21+
include::modules/oauth-register-additional-client.adoc[leveloffset=+1]
2222

2323
include::modules/oauth-server-metadata.adoc[leveloffset=+1]
2424

‎modules/oauth-configuring-internal-oauth.adoc

Lines changed: 2 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -5,52 +5,11 @@
55
[id="oauth-configuring-internal-oauth-{context}"]
66
= Configuring options for the internal OAuth server
77

8-
You can configure default options for the internal OAuth server's session,
9-
session secrets, token duration, and grant options.
8+
You can configure default options for the internal OAuth server's
9+
token duration.
1010

1111
.Procedure
1212

13-
. Create the OAuth session secret file:
14-
+
15-
[source,yaml]
16-
----
17-
apiVersion: v1
18-
kind: SessionSecrets
19-
secrets: <1>
20-
- authentication: "..." <2>
21-
encryption: "..." <3>
22-
- authentication: "..."
23-
encryption: "..."
24-
...
25-
----
26-
<1> List of secrets used to authenticate and encrypt cookie sessions. Specify
27-
at least one secret. Each secret must set an authentication and
28-
encryption secret.
29-
<2> Signing secret, used to authenticate sessions using HMAC. Recommended to use
30-
a secret with 32 or 64 bytes.
31-
<3> Encrypting secret, used to encrypt sessions. Must be 16, 24, or 32
32-
characters long, to select AES-128, AES-192, or AES-256.
33-
34-
35-
. Set the session options:
36-
+
37-
[source,yaml]
38-
----
39-
oauthConfig:
40-
...
41-
sessionConfig:
42-
sessionMaxAgeSeconds: 300 <1>
43-
sessionName: ssn <2>
44-
sessionSecretsFile: "..." <3>
45-
----
46-
<1> Controls the maximum age of a session; sessions auto-expire once a token
47-
request is complete. If the `auto-grant` grant option is not enabled for the cluster, sessions
48-
must last as long as the user is expected to take to approve or reject a client
49-
authorization request.
50-
<2> Name of the cookie used to store the session.
51-
<3> File name containing serialized `SessionSecrets` object. If empty, a
52-
random signing and encryption secret is generated at each server start.
53-
5413
. Set the token duration options:
5514
+
5615
[source,yaml]
@@ -59,22 +18,6 @@ oauthConfig:
5918
...
6019
tokenConfig:
6120
accessTokenMaxAgeSeconds: 86400 <1>
62-
authorizeTokenMaxAgeSeconds: 300 <2>
6321
----
6422
<1> Set `accessTokenMaxAgeSeconds` to control the lifetime of access tokens.
6523
The default lifetime is 24 hours, or 86400 seconds.
66-
<2> Set `authorizeTokenMaxAgeSeconds` to control the lifetime of authorize
67-
codes. The default lifetime is five minutes, or 300 seconds.
68-
69-
. Set the grant options:
70-
+
71-
[source,yaml]
72-
----
73-
oauthConfig:
74-
...
75-
grantConfig:
76-
method: auto <1>
77-
----
78-
<1> Specify the grant option: `auto` to automatically approve the grant and
79-
retry the request, `prompt` to prompt the user to approve or deny the grant, or
80-
`deny` to deny the grant and return a failure error to the client.

‎modules/oauth-internal-options.adoc

Lines changed: 0 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -36,22 +36,3 @@ methods:
3636
`auto`:: Auto-approve the grant and retry the request.
3737
`prompt`:: Prompt the user to approve or deny the grant.
3838
`deny`:: Auto-deny the grant and return a failure error to the client.
39-
40-
[id="oauth-session-options-{context}"]
41-
== OAuth session options
42-
43-
The OAuth server uses a signed and encrypted cookie-based session during login
44-
and redirect flows. You can configure how long each session lasts and which
45-
secrets file to use for the session. With this file, you separate secret values
46-
from the configuration file and retain the ability to distribute the secrets,
47-
if required for debugging
48-
49-
If you do not create this `sessionSecretsFile` file, a random signing and encryption
50-
secret is generated at each start of the master server. This means that any
51-
login attempts in progress have their sessions invalidated if the master is
52-
restarted. It also means they cannot decode sessions generated by one of the other masters.
53-
54-
You can specify multiple secrets can be specified in the `sessionSecretsFile` to enable
55-
rotation. New sessions are signed and encrypted using the first secret in the
56-
list. Existing sessions are decrypted and authenticated by each secret until one
57-
succeeds.

‎modules/oauth-register-additional-server.adoc renamed to ‎modules/oauth-register-additional-client.adoc

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@
22
//
33
// * authentication/configuring-internal-oauth.adoc
44

5-
[id="oauth-register-additional-server-{context}"]
6-
= Register an additional OAuth server
5+
[id="oauth-register-additional-client-{context}"]
6+
= Register an additional OAuth client
77

8-
If you need an additional OAuth server to manage authentication for your
8+
If you need an additional OAuth client to manage authentication for your
99
{product-title} cluster, you can register one.
1010

1111
.Procedure

‎modules/oauth-server-metadata.adoc

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,19 +5,19 @@
55
[id="oauth-server-metadata-{context}"]
66
= OAuth server metadata
77

8-
Applications running in {product-title} may need to discover information about
9-
the built-in OAuth server. For example, they might need to discover what the
10-
address of the `<master>` server is without manual configuration. To aid in
11-
this, {product-title} implements the IETF
8+
Applications running in {product-title} may need to discover information
9+
about the built-in OAuth server. For example, they might need to discover
10+
what the address of the `<namespace_route>` is without manual
11+
configuration. To aid in this, {product-title} implements the IETF
1212
link:https://tools.ietf.org/html/draft-ietf-oauth-discovery-10[OAuth 2.0 Authorization Server Metadata] draft specification.
1313

14-
Thus, any application running inside the cluster can issue a `GET` request to
15-
*_\https://openshift.default.svc/.well-known/oauth-authorization-server_* to fetch
16-
the following information:
14+
Thus, any application running inside the cluster can issue a `GET` request
15+
to *_\https://openshift.default.svc/.well-known/oauth-authorization-server_*
16+
to fetch the following information:
1717

1818
----
1919
{
20-
"issuer": "https://<master>", <1>
20+
"issuer": "https://<namespace_route>", <1>
2121
"authorization_endpoint": "https://<namespace_route>/oauth/authorize", <2>
2222
"token_endpoint": "https://<namespace_route>/oauth/token", <3>
2323
"scopes_supported": [ <4>

0 commit comments

Comments
 (0)