kubelogin icon indicating copy to clipboard operation
kubelogin copied to clipboard

Allow customizing the path of the local server

Open edjmao opened this issue 1 year ago • 0 comments

We are currently using VMWare TKGI, using the built-in Cloud Foundry auth provider. To my knowledge, we don't have the ability to add a new client and change the valid redirect URIs. As such, we can only reuse the only client entry that comes pre-installed. The only redirect URI is http://localhost:61235/callback.

I wrote my own implementation of a kubectl exec plugin that mimicked the same behavior as the client that it shipped with, but it has its limitations. kubelogin seems to provide much more flexibility, but the one thing that I cannot reconcile is the path in the redirect URI. It will not accept http://localhost:61235/ without the final /callback path.

In testing kubelogin manually, I'm able to take the URL that's dumped with the setup command, change the redirectUri parameter to match the one expected in the client configuration, and then POST the request. The browser will redirect back to http://localhost:61235/callback which results in a 404. Changing this URL back to http://localhost:61235/ will then complete the login flow.

I would like the introduction of a parameter (e.g. --oidc-redirect-url-path) that would allow the setting of the path in the redirect URL. This would also mean that the server would need to set the handler logic to listen to all requests, regardless of the path.

edjmao avatar Jul 22 '22 17:07 edjmao