<p>I am using a brand new installation of openshift:</p>

<pre><code>oc v3.11.0+62803d0-1
kubernetes v1.11.0+d4cacc0
features: Basic-Auth GSSAPI Kerberos SPNEGO

Server https://master.mydomain.fr:8443
openshift v3.11.0+2bcedfc-77
kubernetes v1.11.0+d4cacc0
</code></pre>

<p>I have 3 nodes:</p>

<pre><code>[root@master centos]# oc get node
NAME                 STATUS    ROLES     AGE       VERSION
master.mydomain.fr   Ready     master    1d        v1.11.0+d4cacc0
node1.mydomain.fr    Ready     infra     1d        v1.11.0+d4cacc0
node2.mydomain.fr    Ready     compute   1d        v1.11.0+d4cacc0
node3.mydomain.fr    Ready     compute   1d        v1.11.0+d4cacc0
node4.mydomain.fr    Ready     compute   1d        v1.11.0+d4cacc0
</code></pre>

<p>I successfully configured everything but now I am trying to access to my grafana dashboards. I created a route:</p>

<pre><code>grafana.mydomain.fr
</code></pre>

<p>I am redirected to the Login Button of the OauthProxy. When I click on Login I am redirected to a blank page with Json:</p>

<pre><code>{"error":"invalid_request","error_description":"The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed.","state":"7f3a18c95ae8237d39d35bf8ff317ae4:/"}
</code></pre>

<p>Here is the URI I am getting:</p>

<pre><code>https://master.mydomain.fr:8443/oauth/authorize?approval_prompt=force&amp;client_id=system%3Aserviceaccount%3Aopenshift-monitoring%3Agrafana&amp;redirect_uri=https%3A%2F%2Fgrafana.mydomain.fr%2Foauth%2Fcallback&amp;response_type=code&amp;scope=user%3Ainfo+user%3Acheck-access&amp;state=7f3a18c95ae8237d39d35bf8ff317ae4%3A%2F
</code></pre>

<p>After looking at the log I am getting:</p>

<pre><code>no RBAC policy matched
</code></pre>

<p>I am pretty sure it is linked to my configuration (maybe the redirect URI is not correct) but to be honnest I don't know how to configure it. Do you have an idea ?</p>

<p>Thanks in advance</p>

Geoffrey
<p>I was facing the exact same issue while trying to expose Prometheus (OpenShift 3.11) and this is how I solved the issue.</p>
<p>As the question does not make it clear about the route name and in case you have created a route other than <code>grafana</code> which is the default account that comes with openshift. Then one of the reasons could be the route name and that's because the <code>serviceAccount</code> that is being used in the authentication process is expecting to be used with a route named <code>grafana</code> according to the section:</p>
<pre><code># Taken from grafana's serviceAccount
metadata:
  annotations:
    serviceaccounts.openshift.io/oauth-redirectreference.grafana: '{&quot;kind&quot;:&quot;OAuthRedirectReference&quot;,&quot;apiVersion&quot;:&quot;v1&quot;,&quot;reference&quot;:{&quot;kind&quot;:&quot;Route&quot;,&quot;name&quot;:&quot;grafana&quot;}}'
</code></pre>
<p>This makes the authentication work specifically with a route named <code>grafana</code>, so either modify the original route with the desired domain or modify this annotation with the new router that you have created.</p>
