[Docker/K8s] Openid/OIDC configuration

[abeastmal]

I noted is not possible to pass an ENV var to the container to configure OpenId/OIDC

Is there a workaround in place for docker/k8s users?

Thanks!

[abeastmal]

Found a workaround myself, by creating a configmap with the full config and mounting it in the container 🤷

[abeastmal]

@fiftin is there a way to receive the actual user and email instead of random ones when loging in via github?

[tboerger]

Currently it's not possible, but IMHO this should be implemented as an option which @fiftin can disable on the cloud environment. Most users want to have the OIDC provider name and not some appended random string.

[abeastmal]

Well it partially works, if it's enough for some users, with version 2.9.58 you can do

"email_claim": "email | {{ .login }}@github.your-domain.com"

And it will bring your github username in the UI/email field.
It did not work for the rest of the fields in the config.json file (like name_claim)

[fiftin]

@abeastmal hm, it should works for all *_claim options. I will test, thank you.

[abeastmal]

EDIT:

No Idea why, but this piece "email_claim": "email | {{ .id }}@github.your-domain.com",

Got "templated out" from the config and it was just "email_claim": "email |" when I checked after redeploying. My guess is related to helm templating

It's working again, leaving it here if in case someone find the same issue

---

Did something change?

I redeployed and I'm receiving the error again

      "oidc_providers": {
        "github": {
          "icon": "github",
          "display_name": "Sign in with GitHub",
          "client_id": "",
          "client_secret": "",
          "redirect_url": "http://127.0.0.1:30080/api/auth/oidc/github/redirect",
          "endpoint": {
            "auth": "https://github.com/login/oauth/authorize",
            "token": "https://github.com/login/oauth/access_token",
            "userinfo": "https://api.github.com/user"
          },
          "scopes": ["read:user", "user:email"],
          "username_claim": "|",
          "email_claim": "email | {{ .id }}@github.your-domain.com",
          "name_claim": "name",
          "order": 1
        }
      }
    },

time="2024-04-17T09:22:30Z" level=error msg="claim 'email | @github.your-domain.com' missing or has bad format"

Pulling the latest image

[lbouriez]

I am trying to do the same for Azure but it's not working, I am getting
time="2024-04-09T14:17:45Z" level=error msg="oidc: id token issued by a different provider, expected "" got "https://login.microsoftonline.com/XXXXX/v2.0\""

Any idea ?

[tboerger]

Since this is not realted to the mentioned GitHub authentication and since this discussion have been solved please open a separate thread for the overview about pending/answered questions.