{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/18549","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/18549/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/18549/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/18549/events","html_url":"https://github.com/kubernetes/kubernetes/issues/18549","id":121611583,"number":18549,"title":"Refresh Tokens","user":{"login":"bobbyrullo","id":9629,"avatar_url":"https://avatars.githubusercontent.com/u/9629?v=3","gravatar_id":"","url":"https://api.github.com/users/bobbyrullo","html_url":"https://github.com/bobbyrullo","followers_url":"https://api.github.com/users/bobbyrullo/followers","following_url":"https://api.github.com/users/bobbyrullo/following{/other_user}","gists_url":"https://api.github.com/users/bobbyrullo/gists{/gist_id}","starred_url":"https://api.github.com/users/bobbyrullo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bobbyrullo/subscriptions","organizations_url":"https://api.github.com/users/bobbyrullo/orgs","repos_url":"https://api.github.com/users/bobbyrullo/repos","events_url":"https://api.github.com/users/bobbyrullo/events{/privacy}","received_events_url":"https://api.github.com/users/bobbyrullo/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/priority/P2","name":"priority/P2","color":"fbca04"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/team/control-plane","name":"team/control-plane","color":"d2b48c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-12-11T00:52:51Z","updated_at":"2015-12-14T20:05:20Z","closed_at":null,"body":"A little ways back, support was added to the APIServer for authenticating with JWTs obtained from OpenID Identity Providers ( #10957 ). However, these tokens tend to be short-lived, so we'd like to add support for refresh tokens.\r\n\r\nThe obvious place for this at first glance is `kubectl`, but that presents a number of problems: a refresh token request requires a client ID and secret; surely we don't want to distribute the API Server client secret to every user who want to use the command line?\r\n\r\nSo should the APIServer instead be able to consume Refresh tokens? If that's the case, it would seem that it would need to have an endpoint where someone can go to obtain one in the first place (eg., they navigate to some URL, do the OAuth2 dance with their OIDC IDP, end up back at the APIServer on a page that displays the refresh token, which they can then embed in their kubectl config file. Does this approach make more sense?\r\n\r\nThanks! \r\n\r\nBobby\r\ncc: @ericchiang, @bcwaldon, @philips @yifan-gu "},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/164544176","html_url":"https://github.com/kubernetes/kubernetes/issues/18549#issuecomment-164544176","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/18549","id":164544176,"user":{"login":"liggitt","id":980082,"avatar_url":"https://avatars.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"created_at":"2015-12-14T20:05:20Z","updated_at":"2015-12-14T20:05:20Z","body":"I'm hesitant to introduce a `kubectl login` command that only deals with one auth method. There are many authentication methods we'll want to allow (OIDC, x509 client cert, auth proxy, kerberos, etc). I would expect `kubectl login` to:\r\n\r\n* accept username/password (or prompt) for basic-auth logins\r\n* auto-login for SPNEGO/kerberos and client-cert logins\r\n* redirect to a web flow for OIDC-based logins\r\n\r\nWe've gone through a lot of iterations in OpenShift for various auth methods, and have settled on an approach that we're pretty happy with. The highlights are:\r\n\r\n1. Integrated OAuth server that funnels various auth integrations into an OAuth token flow:\r\n  * authenticates identities via many different methods (auth proxy, basic auth, LDAP, OIDC)\r\n    * can surface web-based login flow (or redirect to third party web-based login flow) for browser clients\r\n    * can send WWW-Authenticate challenges to CLI/API clients\r\n  * maps authenticated identity to user (allows different auth methods to identity the same user)\r\n  * mints API token for user\r\n2. API access uses token auth\r\n\r\nThere's the start of a proposal to upstream parts of that at https://github.com/kubernetes/kubernetes/issues/17440 and [doc around OpenShift auth integrations](https://docs.openshift.org/latest/install_config/configuring_authentication.html)"}}