{"action":"created","issue":{"url":"https://api.github.com/repos/coreos/dex/issues/1215","repository_url":"https://api.github.com/repos/coreos/dex","labels_url":"https://api.github.com/repos/coreos/dex/issues/1215/labels{/name}","comments_url":"https://api.github.com/repos/coreos/dex/issues/1215/comments","events_url":"https://api.github.com/repos/coreos/dex/issues/1215/events","html_url":"https://github.com/coreos/dex/issues/1215","id":312183682,"node_id":"MDU6SXNzdWUzMTIxODM2ODI=","number":1215,"title":"invalid bearer token, crypto/rsa: verification error","user":{"login":"austbot","id":4331331,"node_id":"MDQ6VXNlcjQzMzEzMzE=","avatar_url":"https://avatars2.githubusercontent.com/u/4331331?v=4","gravatar_id":"","url":"https://api.github.com/users/austbot","html_url":"https://github.com/austbot","followers_url":"https://api.github.com/users/austbot/followers","following_url":"https://api.github.com/users/austbot/following{/other_user}","gists_url":"https://api.github.com/users/austbot/gists{/gist_id}","starred_url":"https://api.github.com/users/austbot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/austbot/subscriptions","organizations_url":"https://api.github.com/users/austbot/orgs","repos_url":"https://api.github.com/users/austbot/repos","events_url":"https://api.github.com/users/austbot/events{/privacy}","received_events_url":"https://api.github.com/users/austbot/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2018-04-07T07:55:54Z","updated_at":"2018-07-24T21:12:26Z","closed_at":null,"author_association":"NONE","body":"I'm getting an error I cant find any other material on.\r\nWe have a Kops provisioned Kubernetes 1.9.4 cluster with Dex installed.\r\nOkta is installed in Dex as a connector.\r\nUsing the example app I am able get a token using the Okta auth strategy. But when I try to use the token I get this in the ApiServer logs and literally nothing else.\r\n\r\n`Unable to authenticate the request due to an error: [invalid bearer token, [invalid bearer token, crypto/rsa: verification error]]`\r\n\r\nHere is the API Server config using the kops yaml:\r\n  ```\r\noidcIssuerURL: https://blahblahblah.com\r\noidcClientID: okta\r\noidcUsernameClaim: email\r\noidcGroupsClaim: groups\r\noidcCAFile: /etc/kubernetes/ssl/DigiCertCA.crt\r\n```\r\nWe are using a public url for dex that is looping back into our cluster, the endpoint is an AWS ELB with an AWS provisioned cert. The Digicert CA is installed and there are no SSL issues reaching the dex server at least from outside. And Kubernetes is not reporting any errors hitting the oidc provider.\r\n\r\nHere is the Dex config:\r\n```\r\nconfig.yaml: |\r\n    issuer: https://blahblahblah.com\r\n    storage:\r\n      type: kubernetes\r\n      config:\r\n        inCluster: true\r\n    logger:\r\n      level: debug\r\n    web:\r\n      https: 0.0.0.0:5556\r\n      tlsCert: /etc/dex/tls/tls.crt\r\n      tlsKey: /etc/dex/tls/tls.key\r\n    oauth2:\r\n      skipApprovalScreen: false\r\n    staticClients:\r\n    - id: okta\r\n      redirectURIs:\r\n      - 'http://127.0.0.1:5555/callback'\r\n      name: 'Example App'\r\n      admin: true\r\n      secret: ZXhhbXBsZS1hcHAtc2VjcmV0\r\n    connectors:\r\n    - type: saml\r\n      id: saml\r\n      name: Okta\r\n      config:\r\n        ssoIssuer: http://www.okta.com/exke8lzz0vbR268cm0h7\r\n        ssoURL: https://https://blahblahblah.oktapreview.com/app/https://blahblahblahsandbox_kube/nonsense/sso/saml\r\n        ca: /etc/dex-saml/okta.cert\r\n        insecureSkipSignatureValidation: true\r\n        redirectURI: https://blahblahblah/callback\r\n        usernameAttr: name\r\n        emailAttr: email\r\n        groupsAttr: groups\r\n        nameIDPolicyFormat: emailAddress\r\n```\r\n\r\nAt first we were using the same SSL certs that were on the load balancer for dex, but I then switched to the certs provided by the ./gencerts.sh in examples/k8s. I wasn't sure if the tls.key was used in anyway for the jwt. I didn't think so but I am grasping at straws. \r\n\r\nAgain the error message only says `Unable to authenticate the request due to an error: [invalid bearer token, [invalid bearer token, crypto/rsa: verification error]]`\r\nI doesn't give any more reasons like the other issues I have seen posted with crypto/rsa errors.\r\n\r\nFor reference here is the full api server config:\r\n```\r\naddress: 127.0.0.1\r\n  admissionControl:\r\n  - Initializers\r\n  - NamespaceLifecycle\r\n  - LimitRanger\r\n  - ServiceAccount\r\n  - PersistentVolumeLabel\r\n  - DefaultStorageClass\r\n  - DefaultTolerationSeconds\r\n  - NodeRestriction\r\n  - Priority\r\n  - DenyEscalatingExec\r\n  - ResourceQuota\r\n  allowPrivileged: true\r\n  anonymousAuth: false\r\n  apiServerCount: 3\r\n  authorizationMode: RBAC\r\n  cloudProvider: aws\r\n  etcdServers:\r\n  - http://127.0.0.1:4001\r\n  etcdServersOverrides:\r\n  - /events#http://127.0.0.1:4002\r\n  image: gcr.io/google_containers/kube-apiserver:v1.9.4\r\n  insecurePort: 8080\r\n  kubeletPreferredAddressTypes:\r\n  - InternalIP\r\n  - Hostname\r\n  - ExternalIP\r\n  logLevel: 2\r\n  requestheaderAllowedNames:\r\n  - aggregator\r\n  requestheaderExtraHeaderPrefixes:\r\n  - X-Remote-Extra-\r\n  requestheaderGroupHeaders:\r\n  - X-Remote-Group\r\n  requestheaderUsernameHeaders:\r\n  - X-Remote-User\r\n  securePort: 443\r\n  serviceClusterIPRange: 100.64.0.0/13\r\n  storageBackend: etcd2\r\n  oidcIssuerURL: https://blahblahblah.com\r\noidcClientID: okta\r\noidcUsernameClaim: email\r\noidcGroupsClaim: groups\r\noidcCAFile: /etc/kubernetes/ssl/DigiCertCA.crt\r\n```\r\n\r\nAny help is appreciated."},"comment":{"url":"https://api.github.com/repos/coreos/dex/issues/comments/407553857","html_url":"https://github.com/coreos/dex/issues/1215#issuecomment-407553857","issue_url":"https://api.github.com/repos/coreos/dex/issues/1215","id":407553857,"node_id":"MDEyOklzc3VlQ29tbWVudDQwNzU1Mzg1Nw==","user":{"login":"kiich","id":4416324,"node_id":"MDQ6VXNlcjQ0MTYzMjQ=","avatar_url":"https://avatars1.githubusercontent.com/u/4416324?v=4","gravatar_id":"","url":"https://api.github.com/users/kiich","html_url":"https://github.com/kiich","followers_url":"https://api.github.com/users/kiich/followers","following_url":"https://api.github.com/users/kiich/following{/other_user}","gists_url":"https://api.github.com/users/kiich/gists{/gist_id}","starred_url":"https://api.github.com/users/kiich/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kiich/subscriptions","organizations_url":"https://api.github.com/users/kiich/orgs","repos_url":"https://api.github.com/users/kiich/repos","events_url":"https://api.github.com/users/kiich/events{/privacy}","received_events_url":"https://api.github.com/users/kiich/received_events","type":"User","site_admin":false},"created_at":"2018-07-24T21:12:26Z","updated_at":"2018-07-24T21:12:26Z","author_association":"NONE","body":"Ah nice one @jecafarelli - indeed, those options for api-server are what my config has as well - sorry, me pasting that in the first place would have helped you out earlier I just realised! rookie github user mistake ;-)\r\n\r\nGlad to hear it is working now!"}}
{"actor":{"display_login":"kiich"}}