Red Hat OpenShift Container Platform

Sample request header custom resource

Review the sample request header OAuth custom resource (CR) to understand provider parameters and acceptable values before you configure the identity provider in your cluster.

apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
  name: cluster
spec:
  identityProviders:
  - name: requestheaderidp
    mappingMethod: claim
    type: RequestHeader
    requestHeader:
      challengeURL: "https://www.example.com/challenging-proxy/oauth/authorize?${query}"
      loginURL: "https://www.example.com/login-proxy/oauth/authorize?${query}"
      ca:
        name: ca-config-map
      clientCommonNames:
      - my-auth-proxy
      headers:
      - X-Remote-User
      - SSO-User
      emailHeaders:
      - X-Remote-User-Email
      nameHeaders:
      - X-Remote-User-Display-Name
      preferredUsernameHeaders:
      - X-Remote-User-Login

where:

spec.identityProviders.name

Specifies that the provider name is prefixed to the username in the request header to form an identity name.

spec.identityProviders.mappingMethod

Specifies how mappings are established between the identities of this provider and User objects.

spec.identityProviders.requestHeader.challengeURL

Specifies the URL for redirecting unauthenticated /oauth/authorize requests to an authenticating proxy that authenticates browser-based clients and then proxies the request to https://<namespace_route>/oauth/authorize. The URL that proxies to https://<namespace_route>/oauth/authorize must end with /authorize with no trailing slash and must also proxy subpaths for OAuth approval flows to work properly. ${url} is replaced with the current URL, escaped to be safe in a query parameter. ${query} is replaced with the current query string. If this attribute is not defined, loginURL must be used. This value is optional.

spec.identityProviders.requestHeader.loginURL

Specifies the URL for redirecting unauthenticated /oauth/authorize requests to an authenticating proxy that authenticates clients expecting WWW-Authenticate challenges and then proxies them to https://<namespace_route>/oauth/authorize. ${url} is replaced with the current URL, escaped to be safe in a query parameter. ${query} is replaced with the current query string. If this attribute is not defined, challengeURL must be used. This value is optional.

spec.identityProviders.requestHeader.ca

Specifies a reference to an Red Hat OpenShift Container Platform ConfigMap object containing a Privacy-Enhanced Mail (PEM)-encoded certificate bundle used as a trust anchor to validate the Transport Layer Security (TLS) certificates presented by the remote server.

As of Red Hat OpenShift Container Platform 4.1, the ca field is required for this identity provider. This means that your proxy must support mutual TLS.

spec.identityProviders.requestHeader.clientCommonNames

Specifies a list of common names (cn). If set, a valid client certificate with a Common Name (cn) in the specified list must be presented before the request headers are checked for usernames. If empty, any Common Name is allowed. Can only be used in combination with ca. This value is optional.

spec.identityProviders.requestHeader.headers

Specifies header names to check, in order, for the user identity. The first header containing a value is used as the identity. This field is required, and header matching is case-insensitive.

spec.identityProviders.requestHeader.emailHeaders

Specifies header names to check, in order, for an email address. The first header containing a value is used as the email address. Header matching is case-insensitive. This value is optional.

spec.identityProviders.requestHeader.nameHeaders

Specifies header names to check, in order, for a display name. The first header containing a value is used as the display name. Header matching is case-insensitive. This value is optional.

spec.identityProviders.requestHeader.preferredUsernameHeaders

Specifies header names to check, in order, for a preferred username, if different from the immutable identity determined from the headers specified in headers. The first header containing a value is used as the preferred username when provisioning. Header matching is case-insensitive. This value is optional.