Red Hat OpenShift Container Platform

Disabling direct authentication

Disable direct authentication to revert your cluster back to using the built-in Red Hat OpenShift Container Platform OAuth server for authentication when external OIDC integration is no longer needed.

Prerequisites

You have access to the kubeconfig file generated by the installation program for the cluster.

Procedure

Ensure that you are using the kubeconfig file generated by the installation program, or another long-lived method of logging in as a cluster administrator.
Update the authentication configuration to use the built-in Red Hat OpenShift Container Platform OAuth server by running the following command:
```
$ oc patch authentication.config/cluster --type=merge -p='
spec:
  type: ""
  oidcProviders: null
'
```
where:

spec.type

Specifies the authentication type. Set to "" to use the built-in Red Hat OpenShift Container Platform OAuth server. A value of IntegratedOAuth is also equivalent.

spec.oidcProviders

Specifies the OIDC provider configuration. Set to null to remove the external OIDC provider configuration.
Wait for the cluster to roll out new revisions to all nodes.
1. Check the Kubernetes API server Operator status by running the following command:
  $ oc get co kube-apiserver
  Example output
  NAME VERSION AVAILABLE PROGRESSING DEGRADED SINCE MESSAGE kube-apiserver 4.22.0 True True False 85m NodeInstallerProgressing: 2 node are at revision 12; 1 node is at revision 14
  The message in the preceding example shows that one node has progressed to the new revision and two nodes have not yet updated. It can take 20 minutes or more to roll out the new revision to all nodes, depending on the size of your cluster.
2. To troubleshoot any issues, you can also check the Cluster Authentication Operator and kube-apiserver pod logs for errors.
If necessary, restore any existing authentication configuration.

Verification

Verify that you can successfully log in to the Red Hat OpenShift Container Platform web console and OpenShift CLI (oc).