{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/31380","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/31380/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/31380/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/31380/events","html_url":"https://github.com/kubernetes/kubernetes/issues/31380","id":173069530,"number":31380,"title":"OIDC authentication plugin: username claim is prefixed by issuer URL which isn't document","user":{"login":"ericchiang","id":2342749,"avatar_url":"https://avatars.githubusercontent.com/u/2342749?v=3","gravatar_id":"","url":"https://api.github.com/users/ericchiang","html_url":"https://github.com/ericchiang","followers_url":"https://api.github.com/users/ericchiang/followers","following_url":"https://api.github.com/users/ericchiang/following{/other_user}","gists_url":"https://api.github.com/users/ericchiang/gists{/gist_id}","starred_url":"https://api.github.com/users/ericchiang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ericchiang/subscriptions","organizations_url":"https://api.github.com/users/ericchiang/orgs","repos_url":"https://api.github.com/users/ericchiang/repos","events_url":"https://api.github.com/users/ericchiang/events{/privacy}","received_events_url":"https://api.github.com/users/ericchiang/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/component/kubelet","name":"component/kubelet","color":"0052cc"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/team/cluster","name":"team/cluster","color":"d2b48c"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":11,"created_at":"2016-08-24T22:06:54Z","updated_at":"2016-08-25T15:23:43Z","closed_at":null,"body":"This was brought up when investigating #31365\r\n\r\nCurrently if you use a claim other than \"email\" the value is prefixed by the issue URL when determining username. This means if I have a (non-standard) JWT with the following claims:\r\n\r\n```\r\n{\r\n    \"iss\": \"https://example.auth.com\",\r\n    \"profile-name\": \"janedoe\"\r\n}\r\n```\r\n\r\nAnd \"profile-name\" is used to indicate username claims through the API server flag\r\n\r\n```\r\n--oidc-username-claim=profile-name\r\n```\r\n\r\nThe username for this user will be:\r\n\r\n```\r\nhttps://example.auth.com#janedoe\r\n```\r\n\r\nEmail is special cased and not prefixed by this value.[0]\r\n\r\nThis needs to be documented, but it's also annoying that we can't turn this off, which was achnologed by @liggitt when this code was added[1]\r\n\r\n> the option to have fully-qualified issuer+sub usernames is good to have (and fully-qualified is probably good as a default), but in practice, most installations will not need such specificity, and having to express ACL rules like \"https://accounts.google.com:1234567890\" is almost impossible to use (especially once end-users are able to add ACL grants). As long as a cluster admin can choose between something like \"issuer:sub\" format and \"email\", I think our bases are covered.\r\n\r\nThe actual username being produced in by @mlbiam's setup using KeyCloak is:\r\n\r\n```\r\nhttps://kcdev.tremolosecurity.com:8443/auth/realms/kubernetes#mmosley.ent2k12.domain.com\r\n```\r\n\r\nWhich I think fits the bill of \"almost impossible to use\".\r\n\r\nSo I guess my question to @kubernetes/sig-auth is, would we still consider fully-qualifying the username claim useful? Or is it reasonable to drop this?\r\n\r\nEDIT: Also note that `--oidc-username-claim` is still marked as experimental[2]\r\n\r\n[0] https://github.com/kubernetes/kubernetes/blob/1952986a345b2106fc165530592eb9c689decc10/plugin/pkg/auth/authenticator/token/oidc/oidc.go#L238-L246\r\n[1] https://github.com/kubernetes/kubernetes/pull/10957#issuecomment-130010294\r\n[2] http://kubernetes.io/docs/admin/authentication/#openid-connect-tokens"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/242427555","html_url":"https://github.com/kubernetes/kubernetes/issues/31380#issuecomment-242427555","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/31380","id":242427555,"user":{"login":"mlbiam","id":8249283,"avatar_url":"https://avatars.githubusercontent.com/u/8249283?v=3","gravatar_id":"","url":"https://api.github.com/users/mlbiam","html_url":"https://github.com/mlbiam","followers_url":"https://api.github.com/users/mlbiam/followers","following_url":"https://api.github.com/users/mlbiam/following{/other_user}","gists_url":"https://api.github.com/users/mlbiam/gists{/gist_id}","starred_url":"https://api.github.com/users/mlbiam/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mlbiam/subscriptions","organizations_url":"https://api.github.com/users/mlbiam/orgs","repos_url":"https://api.github.com/users/mlbiam/repos","events_url":"https://api.github.com/users/mlbiam/events{/privacy}","received_events_url":"https://api.github.com/users/mlbiam/received_events","type":"User","site_admin":false},"created_at":"2016-08-25T15:23:43Z","updated_at":"2016-08-25T15:23:43Z","body":"Yeah, I think an idp specific prefix is a good idea.  gives you best of both worlds.  k8s can handle multiple idps without becoming an idp, or the complications that come with it.  but it gives idps the flexibility to provide management.  From a practical perspective the important data points are the user's \"id\" and the groups so adding a prefix probably wouldn't be too much of a burden.  Since its impossible for an idp to spoof the prefix, the prefix its self doesn't matter.  For instance if the prefix is just \"a\" and the idp sends the groups as \"aadmin\" then the result would be \"aadmin\".  A simple name or label would suffice."}}
{"actor":{"display_login":"mlbiam"}}