Connecting authservice of kubeflow to keycloak as an oidc provider #REOPENED about oidc-authservice HOT 6 OPEN

@Hmr-ramzi I am able to get the Keycloak integration working with Kubeflow. I was also facing the issue where after authentication redirection was failing. I resolved it by updating Valid redirect URIs configuration at Keycloak's Kubeflow client to *

hi i have deploy the kubeflow with dex can you tell me how to replace dex with keyclock for the existing kubeflow setup

from oidc-authservice.

@mohamed-fazil-saleem did u solve the logout part??
I changed /logout to keycloak session logout page directly, but it seems oidc doesn't revoke session.

from oidc-authservice.

@Hmr-ramzi Did you get it working?

from oidc-authservice.

@Hmr-ramzi I am able to get the Keycloak integration working with Kubeflow. I was also facing the issue where after authentication redirection was failing. I resolved it by updating Valid redirect URIs configuration at Keycloak's Kubeflow client to *

from oidc-authservice.

@ShilpaGopal I would strongly discourage this setting:

updating Valid redirect URIs configuration at Keycloak's Kubeflow client to *

as it's one of the most usual reasons for OAuth-OIDC related hacks. For example:

• Using the implicit grant flow (response_type=token), an attacker can steal a user's access token by constructing a a login link that redirects (and sends the token) to an attacker-controlled website.
• Using the auth code flow, an attacker can steal a user's auth code and state by constructing a a login link that redirects (and sends the code and state) to an attacker-controlled website. Then, the attacker can present them to the client and login as the user.

Both of those attacks are prevented by using specific redirect urls and validating them. See:

• https://habr.com/en/post/449182/
• http://blog.intothesymmetry.com/2015/06/on-oauth-token-hijacks-for-fun-and.html
• https://tools.ietf.org/id/draft-ietf-oauth-security-topics-06.html#rfc.section.3.1

from oidc-authservice.

@yanniszark Thanks for the input. In my use-case its for internal use only. But, I see your point I will try by adding specific redirect URLs.

from oidc-authservice.