[Hosted che] Openshift oAuth returns invalid token

[vinokurig]

Openshift oAuth provider returns invalid token for the Openshift which runs hosted Che.

Describe the bug

Che version

• latest
• nightly
• other: please specify

Steps to reproduce

1. Create a workpspace with openshift connector plugin.
2. Start the workspace
3. See error:
   
4. Open terminal for the openshift-connector sidecar
5. Execute curl -H 'Authorization: Bearer <user token>' https://che.openshift.io/api/oauth/token?oauth_provider=openshift and see the token
6. execute oc get user --token <token from the request>
7. See authorisation error.

It is strange that the oauth/token request can return a token even without specifying oauth_provider parameter (curl -H 'Authorization: Bearer <user token>' https://che.openshift.io/api/oauth/token)

Expected behavior

The token must be valid

Runtime

• kubernetes (include output of kubectl version)
• Openshift (include output of oc version)
• minikube (include output of minikube version and kubectl version)
• minishift (include output of minishift version and oc version)
• docker-desktop + K8S (include output of docker version and kubectl version)
• other: (please specify)

Screenshots

Installation method

• chectl
  • provide a full command that was used to deploy Eclipse Che (including the output)
  • provide an output of chectl version command
• OperatorHub
• I don't know

Environment

• my computer
  • Windows
  • Linux
  • macOS
• Cloud
  • Amazon
  • Azure
  • GCE
  • other (please specify)
• other: please specify

Eclipse Che Logs

Additional context

[ibuziuk]

sorry, not following what is the expected behaviour? Have you seen #16890 ?

[vinokurig]

The expected behaviour should be a valid openshift token response from the curl -H 'Authorization: Bearer <user token>' https://che.openshift.io/api/oauth/token?oauth_provider=openshift request

[vinokurig]

#16890 needs this to login automatically

[ibuziuk]

@vinokurig could you clarify how the plugin works atm? as you can see it login to the *-che namespace:

https://user-images.githubusercontent.com/1461122/81581490-1808a100-93af-11ea-9cf2-fd8a44a7f262.png

I do not understand what is expected to be done on Hosted Che end. Also see: #16890 (comment)

[vinokurig]

@ibuziuk

could you clarify how the plugin works atm? as you can see it login to the *-che namespace:

It is loged in as system:serviceaccount:*-che:che-workspace (oc whoami output) but to get access to the user's cluster:

I've logged in via login and password, but to automate the login flow we need the user openshift token which can be received by the oAuth API. The oauth API works nice in my local minishift assembly but https://che.openshift.io/api/oauth/token API request returns an invalid token.

[ibuziuk]

@vinokurig based on the #16890 (comment) It looks like it is not a good idea to fall back on che specific API. Also, I do not understand why if the login is failing the OpenShift connector still logs in to the *-che namespace correctly? (what login mechanism is used there?)

https://user-images.githubusercontent.com/1461122/81581490-1808a100-93af-11ea-9cf2-fd8a44a7f262.png

@ericwill wdyt about closing the issue in favor of #16890 and continue the discussion in one place?

[ericwill]

@ericwill wdyt about closing the issue in favor of #16890 and continue the discussion in one place?

Yes, sure. @vinokurig let's continue the discussion in #16890