Hi. Has anyone successfully gotten RKE to use OIDC (Keycloak) as an authentication provider? This is separate from the Rancher front-end, just the cluster itself. I have this config set in the kube-api extra_args section:

oidc-client-id: <http://myclient.example.org|myclient.example.org>
          oidc-groups-claim: groups
          oidc-issuer-url: <https://keycloak.example.org/realms/test>
          oidc-username-claim: preferred_username

When I get a token and try to use it to authenticate (just did a kubectl --token=XXXXXXXXXX get nodes, I get a message: error: You must be logged in to the server (the server has asked for the client to provide credentials) and the kube-api server just logs this:

time="2023-01-26T18:31:29Z" level=info msg="Processing v1Authenticate request..."
time="2023-01-26T18:31:29Z" level=error msg="found 1 parts of token"

has anyone done this?

do you want to use oidc as well as rancher for authentication or is this without rancher, just RKE? I've only set up KC as a Rancher Auth Provider, but I find your question intruiging.

I'm trying to use a 3rd party application that won't really work with the way rancher handles users and stuff, so it needs to point directly to the cluster. So, yes, rancher will use OIDC if people need to log into directly, but this one app would have to go around the back

I have a feeling you need to set oidc as an extra authentication method in the kubelet args somewhere, not just the oidc settings

hmm. I'm not sure where that would be (I haven't seen anything online anywhere for it)...maybe other K8s distros don't need those options by default and rke does.

yes you're right, at least the k8s.io docs don't mention anything other than the params you provided

I wouldn't be surprised about anything.

try it with an rke cluster that isn't provisioned via rancher

I think that was one of my next things to try,

this is what I had in mind before though https://rancher.com/docs/rke/latest/en/config-options/authentication/

By any chance have you connected directly to the rancher api (through kubectl) using the oidc token rather than a Rancher token?

I haven't done that, as I mentioned we only use oidc / keycloak as the login auth provider.

Ok. I was just looking at this vague documentation page: https://ranchermanager.docs.rancher.com/v2.7/reference-guides/cli-with-rancher/kubectl-utility....but I think I'd still need to make a user API token, which defeats the purpose

yes, I know what you mean