Configuring a Google identity provider

    Using Google as an identity provider allows any Google user to authenticate to your server. You can limit authentication to members of a specific hosted domain with the hostedDomain configuration attribute.

    By default, only a kubeadmin user exists on your cluster. To specify an identity provider, you must create a custom resource (CR) that describes that identity provider and add it to the cluster.

    Identity providers use OKD Secret objects in the openshift-config namespace to contain the client secret, client certificates, and keys.

    Procedure

    • Create a Secret object containing a string by using the following command:

      You can alternatively apply the following YAML to create the secret:

      1. apiVersion: v1
      2. kind: Secret
      3. metadata:
      4.   name: <secret_name>
      6. type: Opaque
      7.   clientSecret: <base64_encoded_client_secret>

    The following custom resource (CR) shows the parameters and acceptable values for a Google identity provider.

    Google CR

    1. apiVersion: config.openshift.io/v1
    2. kind: OAuth
    3. metadata:
    4.   name: cluster
    5. spec:
    6.   identityProviders:
    7.   - name: googleidp (1)
    8.     mappingMethod: claim (2)
    9.     type: Google
    10.       clientID: {...} (3)
    11.       clientSecret: (4)
    12.         name: google-secret
    13.       hostedDomain: "example.com" (5)

    Additional resources

    After you install your cluster, add an identity provider to it so your users can authenticate.

    Prerequisites

    • Create an OKD cluster.

    • Create the custom resource (CR) for your identity providers.

    • You must be logged in as an administrator.

    1. Apply the defined CR:

      If a CR does not exist, oc apply creates a new CR and might trigger the following warning: Warning: oc apply should be used on resources created by either oc create —save-config or oc apply. In this case you can safely ignore this warning.

    2. Obtain a token from the OAuth server.

      As long as the kubeadmin user has been removed, the command provides instructions on how to access a web page where you can retrieve the token.

      You can also access this page from the web console by navigating to (?) Help → Command Line Tools → Copy Login Command.

    3. Log in to the cluster, passing in the token to authenticate.

      1. Confirm that the user logged in successfully, and display the user name.