Configure KubeSphere as an OIDC Identity Provider
OpenID Connect is an interoperable authentication protocol based on the OAuth 2.0 framework (IETF RFC 6749 and 6750). KubeSphere v4.1.3 implements the Authorization Code Flow of OpenID Connect protocol for extensions to integrate with KubeSphere’s account system. This tutorial uses Harbor as an OIDC client - after configuration, you can use KubeSphere accounts to log in to Harbor.
SSO Implementation Flow via OIDC
End user navigates to a website or web application via a browser.
End user clicks sign-in and types their username and password.
The RP (Client) sends a request to the OpenID Provider (OP).
The OP authenticates the User and obtains authorization.
The OP responds with an Identity Token and usually an Access Token.
The RP can send a request with the Access Token to the User device.
The UserInfo Endpoint returns Claims about the End-User.
Deploy KubeSphere 4.1.3
helm upgrade --install -n kubesphere-system --create-namespace ks-core https://charts.kubesphere.io/main/ks-core-1.1.4.tgz --debug --wait \
--set portal.hostname=172.31.17.16.nip.io \
--set portal.https.port=30491 \
--set ingress.enabled=true \
--set ingress.tls.enabled=true \
--set ingress.ingressClassName=kubesphere-router-cluster| Note |
|---|
Before applying configurations, ks-console must be exposed via HTTPS. This tutorial uses Ingress to expose ks-console. The cluster gateway is created using the KubeSphere Gateway extension, with corresponding IngressClass as |
| Parameter | Description |
|---|---|
| Domain or IP for accessing KubeSphere Console (replace with actual node IP) |
| Ports for accessing KubeSphere Console |
| Ingress and TLS configurations |
| IngressClass for the Ingress (must reference a pre-existing IngressClass) |
Create OAuth Client
cat << EOF | kubectl apply -f -
apiVersion: v1
stringData:
configuration.yaml: |
name: harbor
secret: password123
grantMethod: auto
scopeRestrictions:
- 'openid'
- 'email'
- 'profile'
redirectURIs:
- https://harbor.172.31.19.17.nip.io/c/oidc/callback
kind: Secret
metadata:
name: oauthclient-harbor
namespace: kubesphere-system
labels:
config.kubesphere.io/type: oauthclient
type: config.kubesphere.io/oauthclient
EOF| Parameter | Description |
|---|---|
| OAuth Client ID |
| OAuth Client Secret |
| List of callback URLs supported by OAuth Client |
OIDC Configuration Reference
Harbor OIDC Configuration
Log in to Harbor via OIDC
Log in to KubeSphere Console
Associate Harbor account at the first-time login
Feedback
Was this page Helpful?
Receive the latest news, articles and updates from KubeSphere
Thanks for the feedback. If you have a specific question about how to use KubeSphere, ask it on Slack. Open an issue in the GitHub repo if you want to report a problem or suggest an improvement.
Previous
What’s on this Page