KubeSphere对接Keycloak有什么好思路吗？

sunshuyan

直接把用户写到KubeSphere的OpenLDAP貌似在KubeSphere上显示不出来用户。

hongming

sunshuyan kubesphere内置的openldap会逐步移除，3.0.0中用户实体通过CRD定义，可以直接通过kubectl进行管理

sunshuyan

hongming 那是不是说没有用ldap或oauth2的统一认证系统的keycloak，就不能和kubesphere进行对接了呢？

hongming

sunshuyan 目前还没有提供keycloak的接入方式(和keycloak接入其他的账户系统没有关系), 我们会逐步增加一些主流的 Identity provider。keycloak 可以作为一种 Identity provider 通过 OIDC 接入 kubesphere，https://github.com/kubesphere/kubesphere/issues/2941

sunshuyan

hongming 了解了。支持OIDC identity provider这个功能大概什么时候能有呢？

hongming

sunshuyan 计划是在3.1.0

sunshuyan

hongming 那再请问一下。3.1.0版本大概是什么时间发布呢^^

calvinyu

sunshuyan 2021 年的年初

calvinyu

sunshuyan 3.0 只是我们没有提供 keycloak 的插件，用户可以参照这个文档自己实现一个插件， https://kubesphere.com.cn/docs/access-control-and-account-management/oauth2/。 3.1 优化了使用流程，前端支持也更好了

Richardwei

dex也可以考虑一下

moliunian

@hongming 刚出的3.1版本我接入keycloak，已经可以redirect到 keycloak页面登录了，输入账号密码后，进不去kubesphere，自动跳到这个地址"http://xx.xx.x.x:30880/login?referer=/oauth/redirect"

ks-apiserver没有报错；ks-console报错：

<-- GET /oauth/redirect?state=openid&session_state=297994d3xxxxx5c 2021/05/06T22:02:30.658
UnauthorizedError: Not Login
    at Object.throw (/opt/kubesphere/console/server/server.js:19582:11)
    at getCurrentUser (/opt/kubesphere/console/server/server.js:5379:14)
    at renderView (/opt/kubesphere/console/server/server.js:66605:7)
    at dispatch (/opt/kubesphere/console/server/server.js:3115:32)
    at next (/opt/kubesphere/console/server/server.js:3116:18)
    at /opt/kubesphere/console/server/server.js:37113:16
    at dispatch (/opt/kubesphere/console/server/server.js:3115:32)
    at next (/opt/kubesphere/console/server/server.js:3116:18)
    at /opt/kubesphere/console/server/server.js:45119:37
    at dispatch (/opt/kubesphere/console/server/server.js:3115:32)
  --> GET /oauth/redirect?state=openid&session_state=29xxxxxxssc5b5c 302 75ms 91b 2021/05/06T22:02:30.733
  <-- GET /login?referer=/oauth/redirect 2021/05/06T22:02:30.745
  --> GET /login?referer=/oauth/redirect 200 5ms 15.5kb 2021/05/06T22:02:30.750

moliunian

moliunian 我的配置如下：

      oauthOptions:
        accessTokenMaxAge: 1h
        accessTokenInactivityTimeout: 30m
        identityProviders:
        - name: openid
          type: OIDCIdentityProvider
          mappingMethod: auto
          provider:
            clientID: 'ksclient'
            clientSecret: '2e2910dd-5896-4b1d-9d1f-dcbd7cf56849'
            issuer: 'http://xxx.xx.x.x:31899/auth/realms/k8s_realm'
            redirectURL: 'http://xx.x.xx.x:30880/oauth/redirect'

    ldap:
      host: openldap.kubesphere-system.svc:389
      managerDN: cn=admin,dc=kubesphere,dc=io
      managerPassword: admin

RolandMa1986

moliunian OIDC 配置参考：
重定向的url需要使用以下格式：
‘http://{{域名}:{端口}/oauth/redirect/{配置的name}’

    - name: okta
      type: OIDCIdentityProvider
      mappingMethod: auto
      provider:
        issuer: https://yunify.okta.com
        clientID: 'abc'
        clientSecret: 'abc'
        redirectURL: 'http://localhost:30880/oauth/redirect/okta'

moliunian

RolandMa1986
补充name后，报下面错误，这个是keycloak接口返回不支持吗

E0507 04:32:38.290166       1 utils.go:76] /root/go/src/kubesphere.io/kubesphere/pkg/kapis/oauth/handler.go:195 Unauthorized: no id_token in token response
I0507 04:32:38.290185       1 apiserver.go:615] 10.244.0.232 - "GET /oauth/callback/openid?state=openid&session_state=497asxxx3e2d273&code=dc81xxxx0-6f48e41c5b5c HTTP/1.1" 401 44 11ms

有人说可能是 scope参数没传，我配置了好像没起作用

       - name: openid
          type: OIDCIdentityProvider
          mappingMethod: auto
          provider:
            clientID: 'ksclient'
            clientSecret: '2e2910dd-5896-4b1xxx9'
            issuer: 'http://xxx.xx.x.x:31899/auth/realms/k8s_realm'
            redirectURL: 'http://xxx.xx.x.x:30880/oauth/redirect/openid'
          scopes:
            - kubesphere

moliunian

moliunian 不好意思，看了下源码才发现，scopes无效是因为我把缩进搞错了，应该是属于provide的属性；

nerrissaniu

moliunian 你的可以正常登录吗？
这边配置scopes，会报下面的错
10:06:56,237 ERROR [org.keycloak.services] (default task-63) KC-SERVICES0093: Invalid parameter value for: scope

不配置的话，跳转以后需要手动输入用户名和密码，而且提示用户名或者密码错误

hongming

nerrissaniu 跳转到哪需要输入用户名？如果你没有登录过当然需要登录一次呀，可以贴一下具体的错误信息，或者描述的清楚一点

moliunian

nerrissaniu 你也是用keycloak吗，我这边是成功了的。
scopes这样配置

iocloud

moliunian may you help me to solve this issue?

kubesphere/kubesphere#5140

iocloud

When i try to connect keycloak and kubesphere, I have faced issue like this kubesphere/kubesphere#5140

Different tries for connecting Keycloak with kubesphere failed.

Where do I make a mistake?

moliunian

iocloud scopes in your config should be like this , in my screenshot.

scopes and provider are not of the same level