Okd OIDC Login Failure

[andrebiegel]

Hello , i installed a okd in version 4.15 in gcp and configured oidc. the login seems to function but when i get redirected back okd it says " an authentication error ocurred". can somebody give me a hint which service in the master nodes should provide more information in its logs ? sry but i´m new to okd..
greets André

[nate-duke]

Check the logs for the pods in the "openshift-authentication" namespace. You'll likely have more than one so you may have to look through them all to find the relevant error.

[andrebiegel]

ok thanks @nate-duke . i found this "Error getting access token from an external OIDC provider" "This application is required to be configured with an application-specific signing key. It is either not configured with one, or the key has expired or is not yet valid." how to configure that in an existing oauth config ?

[nate-duke]

That should be the client/key you configured in your initial installation. Probably good to go back and verify that was all correct.

I've not done integrated that flavour of OIDC as we use a local oauth service in our clusters so I won't be of much specific help with Google authentication.

[andrebiegel]

the auth itself is with azure ad .. so my client secret is incorrect ? ok so nothing additional .. thanks i will check that

[nate-duke]

could be, yes, though i've not searched for that error message. I'd just make sure all bits of the OIDC client are correct.

[andrebiegel]

could be, yes, though i've not searched for that error message. I'd just make sure all bits of the OIDC client are correct.

By the way it was Not the secret ... Any other idea?

[nate-duke]

Is there any more to that error message? perhaps a longer error identifier or something?

Search results for that string "This application is required to be configured with an application-specific signing key." have all sorts of azure/openOIDC related results. There's a whole world of possibilities so the more information we're using to troubleshoot the better!

I'll admit that generally with OIDC i poke at it gently, then when it works slowly back away and never glance at it again.

[JaimeMagiera]

Just a heads up that OKD 4.15 is very outdated at this point and has much less support from the community. We strongly suggest you install 4.18 or 4.19.

[andrebiegel]

thx for .. at that time the 4.15 was the only version which worked on gcp and 18 und 19 was not released yet .. is there a migration path or do i have to recreate the cluster completly @JaimeMagiera ?

[nate-duke]

@andrebiegel you can follow this process.

https://okd.io/docs/project/upgrade-notes/from-4-15/

We did this over the winter holidays and it worked perfectly.