Red Hat OpenShift Container Platform

Updating users for an htpasswd identity provider

Update users in the htpasswd identity provider so login credentials in Red Hat OpenShift Container Platform stay in sync when you add or remove accounts.

Prerequisites

You have created a Secret object named htpass-secret that contains the htpasswd user file.
You have configured an htpasswd identity provider named my_htpasswd_provider.
You have access to the htpasswd utility. On Red Hat Enterprise Linux (RHEL), this is available by installing the httpd-tools package.
You have cluster administrator privileges.

Procedure

Retrieve the htpasswd file from the htpass-secret Secret object and save it to your local machine by running the following command:
```
$ oc get secret htpass-secret -ojsonpath={.data.htpasswd} -n openshift-config | base64 --decode > users.htpasswd
```

Add or remove users from the users.htpasswd file by running the following commands:

To add a new user:

$ htpasswd -bB users.htpasswd <username> <password>

Example output

Adding password for user <username>

To remove an existing user:

$ htpasswd -D users.htpasswd <username>

Example output

Deleting password for user <username>

Replace the htpass-secret Secret object with the updated users in the users.htpasswd file by running the following command:

$ oc create secret generic htpass-secret --from-file=htpasswd=users.htpasswd --dry-run=client -o yaml -n openshift-config | oc replace -f -

You can also apply the following YAML to replace the secret:

apiVersion: v1
kind: Secret
metadata:
  name: htpass-secret
  namespace: openshift-config
type: Opaque
data:
  htpasswd: <base64_encoded_htpasswd_file_contents>

If you removed one or more users, you must remove the existing resources for each user by running the following commands:
1. Delete the User object:
  $ oc delete user <username>
  Example output
  user.user.openshift.io "<username>" deleted
  Be sure to remove the user, otherwise the user can continue using their token as long as it has not expired.
2. Delete the Identity object for the user:
  $ oc delete identity my_htpasswd_provider:<username>
  Example output
  identity.user.openshift.io "my_htpasswd_provider:<username>" deleted