About authentication in Red Hat OpenShift Container Platform
To control access to an Red Hat OpenShift Container Platform cluster, a cluster administrator can configure user authentication and ensure only approved users access the cluster.
To interact with an Red Hat OpenShift Container Platform cluster, users must first authenticate to the Red Hat OpenShift Container Platform API in some way. You can authenticate by providing an OAuth access token or an X.509 client certificate in your requests to the Red Hat OpenShift Container Platform API.
|
|
If you do not present a valid access token or certificate, your request is unauthenticated and you receive an HTTP 401 error. |
An administrator can configure authentication through the following tasks:
-
Configuring an identity provider: You can define any supported identity provider in Red Hat OpenShift Container Platform and add it to your cluster.
-
Configuring the internal OAuth server: The Red Hat OpenShift Container Platform control plane includes a built-in OAuth server that determines the user’s identity from the configured identity provider and creates an access token. You can configure the token duration and inactivity timeout, and customize the internal OAuth server URL.
Users can view and manage OAuth tokens owned by them.
-
Registering an OAuth client: Red Hat OpenShift Container Platform includes several default OAuth clients. You can register and configure additional OAuth clients.
When users send a request for an OAuth token, they must specify either a default or custom OAuth client that receives and uses the token.
-
Managing cloud provider credentials using the Cloud Credentials Operator: Cluster components use cloud provider credentials to get permissions required to perform cluster-related tasks.
-
Impersonating a system admin user: You can grant cluster administrator permissions to a user by impersonating a system admin user.