Skip to content

Extract external OpenShift IDP configuration from authentication.config/cluster #23831

@tolusha

Description

@tolusha

Is your task related to a problem? Please describe

Eclipse Che doesn't work out of box on OpenShift cluster with exteranl IDP configured.

https://eclipse.dev/che/docs/next/administration-guide/installing-che-on-openshift-with-keycloak-as-oidc/
https://che.eclipseprojects.io/2026/04/20/@tolusha-openshift-external-idp.html

Describe the solution you'd like

authentication.config/cluster contains all the required configuration data for Eclipse Che.

spec:
  oidcProviders:
  - claimMappings:
      groups:
        claim: groups
        prefix: ''
      username:
        claim: preferred_username 
        prefixPolicy: Prefix
        prefix:
          prefixString: 'external-auth:'
    issuer:
      audiences: 
        - openshift-console
        - openshift-cli
      issuerCertificateAuthority:
        name: external-auth-ca
      issuerURL: $RHBK_HOST/realms/openshift 
    name: 'rhbk-external-auth'
    oidcClients:
      - clientID: openshift-cli
        componentName: cli
        componentNamespace: openshift-console
      - clientID: openshift-console
        clientSecret:
          name: external-auth-console-secret
        componentName: console
        componentNamespace: openshift-console
  type: OIDC
  webhookTokenAuthenticator: null

Describe alternatives you've considered

No response

Additional context

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    area/che-operatorIssues and PRs related to Eclipse Che Kubernetes Operatorkind/taskInternal things, technical debt, and to-do tasks to be performed.team/BThis team is responsible for the Web Terminal, the DevWorkspace Operator.

    Type

    No type

    Projects

    Status

    No status

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions