{"action":"created","issue":{"url":"https://api.github.com/repos/openshift/origin/issues/1482","labels_url":"https://api.github.com/repos/openshift/origin/issues/1482/labels{/name}","comments_url":"https://api.github.com/repos/openshift/origin/issues/1482/comments","events_url":"https://api.github.com/repos/openshift/origin/issues/1482/events","html_url":"https://github.com/openshift/origin/issues/1482","id":64782534,"number":1482,"title":"If the port is not specified in the for --public-master it will default to 8443, even if the scheme is explicitly declared","user":{"login":"brenton","id":832,"avatar_url":"https://avatars.githubusercontent.com/u/832?v=3","gravatar_id":"","url":"https://api.github.com/users/brenton","html_url":"https://github.com/brenton","followers_url":"https://api.github.com/users/brenton/followers","following_url":"https://api.github.com/users/brenton/following{/other_user}","gists_url":"https://api.github.com/users/brenton/gists{/gist_id}","starred_url":"https://api.github.com/users/brenton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brenton/subscriptions","organizations_url":"https://api.github.com/users/brenton/orgs","repos_url":"https://api.github.com/users/brenton/repos","events_url":"https://api.github.com/users/brenton/events{/privacy}","received_events_url":"https://api.github.com/users/brenton/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-03-27T15:18:36Z","updated_at":"2015-03-27T15:25:11Z","closed_at":"2015-03-27T15:24:12Z","body":"If I set `--public-master` to https://myproxy.example.com the automatically generated oauth clients will have redirect URIs like `https://myproxy.example.com:8443/oauth/token/display`.\r\n\r\nI had to explicitly set `:443` on the end.  I think this will be surprising to admins trying to configuration authentication proxies.  If the code gets messy to implement the least surprising cases I would prefer:\r\n\r\n* `--public-master=myproxy.example.com` behaves the same as today\r\n* `--public-master=https://myproxy.example.com` returns an error saying the port is explicitly required.\r\n* `--public-master=myproxy.example.com:443` returns an error saying the scheme is explicitly required.\r\n* `--public-master=https://myproxy.example.com:443` works\r\n\r\nAdmins new to openshift will not understand how to clear out the autogenerated oauth clients.  Perhaps if we improved the stale detection this configuration wouldn't be a problematic.  I think today the master only checks if they exist, not if they are pointing to the correct redirect URIs.\r\n\r\nIf we're concerned about backwards compatibility then we could technically return warnings.  In any case, @sosiouxme, stale oauth clients in etcd will be a case the diagnostic tooling will eventually need to check for.\r\n\r\n@liggitt, thoughts?"},"comment":{"url":"https://api.github.com/repos/openshift/origin/issues/comments/86973814","html_url":"https://github.com/openshift/origin/issues/1482#issuecomment-86973814","issue_url":"https://api.github.com/repos/openshift/origin/issues/1482","id":86973814,"user":{"login":"brenton","id":832,"avatar_url":"https://avatars.githubusercontent.com/u/832?v=3","gravatar_id":"","url":"https://api.github.com/users/brenton","html_url":"https://github.com/brenton","followers_url":"https://api.github.com/users/brenton/followers","following_url":"https://api.github.com/users/brenton/following{/other_user}","gists_url":"https://api.github.com/users/brenton/gists{/gist_id}","starred_url":"https://api.github.com/users/brenton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brenton/subscriptions","organizations_url":"https://api.github.com/users/brenton/orgs","repos_url":"https://api.github.com/users/brenton/repos","events_url":"https://api.github.com/users/brenton/events{/privacy}","received_events_url":"https://api.github.com/users/brenton/received_events","type":"User","site_admin":false},"created_at":"2015-03-27T15:25:11Z","updated_at":"2015-03-27T15:25:11Z","body":"I still think we'll need the diagnostics check for the oauth clients though.  If two masters had different values that could get confusing depending on how things are restarted."}}