[OKD-SCOS v4.17] OAuth/cluster manifest with spaces in "name" used to work in OKD v4.15, cause problems in v4.17

[titou10titou10]

Not sure if it's a bug, and if it is specific to OKD vs OCP

Having an "OAuth/cluster" manifest with spaces in the "name" attribute is fine with OKD v4.15 . It causes the oauth-openshift pods to fail in OKD SCOS v4.17

apiVersion: config.openshift.io/v1
kind: OAuth
name: cluster
{...}
spec:
  identityProviders:
    - htpasswd:
        fileData:
          name: htpass-secret
      mappingMethod: claim
      name: OKD4 HTPasswd local
      type: HTPasswd

This works fine in OKD-FCOS v4.15

In OKD-SCOS v4.17, it causes the oauth-openshift pods to fail with this error

I1001 13:36:41.259012 1 dynamic_serving_content.go:113] "Loaded a new cert/key pair" name="serving-cert::/var/config/system/secrets/v4-0-config-system-serving-cert/tls.crt::/var/config/system/secrets/v4-0-config-system-serving-cert/tls.key"
I1001 13:36:41.261482 1 dynamic_serving_content.go:113] "Loaded a new cert/key pair" name="sni-serving-cert::/var/config/system/secrets/v4-0-config-system-router-certs/apps.okd5.denis.prive::/var/config/system/secrets/v4-0-config-system-router-certs/apps.okd5.denis.prive"
I1001 13:36:42.545146 1 requestheader_controller.go:244] Loaded a new request header values for RequestHeaderAuthRequestController
panic: parsing "/login/OKD5 HTPasswd local": at offset 0: invalid method "/login/OKD5"

goroutine 1 [running]:
net/http.(*ServeMux).register(...)
net/http/server.go:2738
net/http.(*ServeMux).Handle(0xc00060aa80?, {0xc00080e380?, 0x2?}, {0x2977660?, 0xc00077b380?})
net/http/server.go:2701 +0x56
github.com/openshift/oauth-server/pkg/server/login.(*Login).Install(...)
github.com/openshift/oauth-server/pkg/server/login/login.go:95
{...}

Note that the OAuth manifest is "accepted" in both versions, this is what is done with the manifest that differ. Maybe the validation of the OAuth manifest is not strict enough...

Setting a "name" with no spaces works in both versions

As said, maybe it is not a bug, just a difference between v4.15 and v4.17 and it will be reported in the release notes...

[Tyrone-W]

Found this on the weekend and need to raise a bug on the cluster authentication operator

The configmap that gets created in the openshift-authentication namespace is rendered badly

        "alwaysShowProviderSelection": false,
        "assetPublicURL": "https://console-openshift-console.test.okd.io",
        "grantConfig": {
            "method": "deny",
            "serviceAccountMethod": "prompt"
        },
        "identityProviders": [
            {
                "challenge": true,
                "login": true,
                "mappingMethod": "claim",
                "name":"Test
    Name LDAP","provider":{"apiVersion":"osin.config.openshift.io/v1"```

The name in this case was "Test Name LDAP", will open the bug today.

[GingerGeek]

@Tyrone-W can you reply with the bug filing when you have it :)

[Tyrone-W]

Issue raised

[titou10titou10]

It seems it is fixed in latest OKD version (4.17.0-okd-scos.ec.4) or is ts just for oauth idp?

refs:

• https://issues.redhat.com/browse/OCPBUGS-44118
• [release-4.17] OCPBUGS-44118: escape spaces in oauth callback path openshift/oauth-server#167