{"action":"created","issue":{"url":"https://api.github.com/repos/openshift/openshift-ansible/issues/2083","repository_url":"https://api.github.com/repos/openshift/openshift-ansible","labels_url":"https://api.github.com/repos/openshift/openshift-ansible/issues/2083/labels{/name}","comments_url":"https://api.github.com/repos/openshift/openshift-ansible/issues/2083/comments","events_url":"https://api.github.com/repos/openshift/openshift-ansible/issues/2083/events","html_url":"https://github.com/openshift/openshift-ansible/issues/2083","id":162202397,"number":2083,"title":"RFE: Make adding different types of identity providers easier to the inventory file","user":{"login":"mwoodson","id":236828,"avatar_url":"https://avatars.githubusercontent.com/u/236828?v=3","gravatar_id":"","url":"https://api.github.com/users/mwoodson","html_url":"https://github.com/mwoodson","followers_url":"https://api.github.com/users/mwoodson/followers","following_url":"https://api.github.com/users/mwoodson/following{/other_user}","gists_url":"https://api.github.com/users/mwoodson/gists{/gist_id}","starred_url":"https://api.github.com/users/mwoodson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mwoodson/subscriptions","organizations_url":"https://api.github.com/users/mwoodson/orgs","repos_url":"https://api.github.com/users/mwoodson/repos","events_url":"https://api.github.com/users/mwoodson/events{/privacy}","received_events_url":"https://api.github.com/users/mwoodson/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-06-24T18:18:54Z","updated_at":"2016-07-06T16:48:50Z","closed_at":null,"body":"Let me preface this by saying this isn't an easy issue to solve.  But this is one that I would like to get some improvements on.  It would help Openshift Ops quite a bit.\r\n\r\n**The current problem:**\r\n\r\nWe are using the BYO inventory file to configure a lot of clusters with all sorts of authentication schemes.  There is one variable to configure all of these:\r\n\r\n_openshift_master_identity_providers_\r\n\r\nThen, we need to set this var as a json dict.  There are multiple problem with this:\r\n\r\n- there is no good examples with all of the different supported auth types (at least I couldn't find them)\r\n- the auth types don't have all of the options documented. (https://gist.github.com/detiber/da042623b26522fcd5767825eafe97a0 as an example)\r\n- the dictionaries that are needed do NOT line us with official docs of the auth type.  What i mean by this, we pass in a dictionary of values that are then put in the right place in the yaml code by the byo.  For example, I can't look at https://docs.openshift.com/enterprise/3.2/install_config/configuring_authentication.html and come up with what the json dictionary should be.\r\n- each dictionary takes different options depending on the auth type.\r\n- the dictionaries are hard to read\r\n- not all options in the dict are needed. It's hard to know what is, what isn't.  IT would help if this was lined up with documents.\r\n"},"comment":{"url":"https://api.github.com/repos/openshift/openshift-ansible/issues/comments/230833925","html_url":"https://github.com/openshift/openshift-ansible/issues/2083#issuecomment-230833925","issue_url":"https://api.github.com/repos/openshift/openshift-ansible/issues/2083","id":230833925,"user":{"login":"detiber","id":915544,"avatar_url":"https://avatars.githubusercontent.com/u/915544?v=3","gravatar_id":"","url":"https://api.github.com/users/detiber","html_url":"https://github.com/detiber","followers_url":"https://api.github.com/users/detiber/followers","following_url":"https://api.github.com/users/detiber/following{/other_user}","gists_url":"https://api.github.com/users/detiber/gists{/gist_id}","starred_url":"https://api.github.com/users/detiber/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/detiber/subscriptions","organizations_url":"https://api.github.com/users/detiber/orgs","repos_url":"https://api.github.com/users/detiber/repos","events_url":"https://api.github.com/users/detiber/events{/privacy}","received_events_url":"https://api.github.com/users/detiber/received_events","type":"User","site_admin":false},"created_at":"2016-07-06T16:48:50Z","updated_at":"2016-07-06T16:48:50Z","body":"Just wanted to add another consideration to the list. It is currently possible to configure multiple providers of the same type currently (2 google identity providers that are tied to different domains for example) as long as the name attribute on the identity provider config is specified...  \r\n\r\nWe definitely need to provide a better experience outside of the complex variable we currently expose, but how that is done isn't clear to me yet. \r\n\r\n@mwoodson there are definitely components of your proposal that I like very much, since it is clear what is being configured, I just wonder if throwing in things like falling back to openshift_master_oauth_* for the github, google, gitlab, etc providers is the right answer, since it seems like it may actually detract a bit from the simplicity both in end user use and in the implementation.\r\n\r\nI do think that we should (at some point) refactor the identity provider complex variable to support the upstream syntax instead of the failed attempt at simplification that I originally created.\r\n\r\nJust spitballing here, but maybe the right answer is to provide a simplified interface for a limited number of identity providers (ideally 1, but I could be convinced to go for 2 or 3), and any configuration beyond that would require dropping down to the complex variable. We could even have a filter that translates from the simplified interface to the complex interface (which could then potentially remove the need for limiting it to just a small number of providers).\r\n\r\n@abutcher thoughts?"}}
{"actor":{"display_login":"detiber"}}