Red Hat OpenShift uses identity providers (IdP) to validate the identity of users. An identity provider is a system that maintains user identities and offers authentication mechanisms for other services.

OpenShift supports several identity providers. The following lists includes the most common:

Red Hat OpenShift Service on AWS (ROSA) supports the same identity providers as any other OpenShift solution.

Administrators often configure their on-premise OpenShift clusters to authenticate against their organization IdP system, such as Red Hat Identity Management or Microsoft Active Directory. In a similar fashion you can configure your ROSA clusters to authenticate against an IdP system that you deploy in your cloud infrastructure.

Specifically, Red Hat provides the Red Hat Single Sign-On Operator, which enables you to deploy Red Hat Single Sign-On in one of your ROSA clusters. You can then use that deployment as the IdP for a fleet of managed clusters.

You can configure several identity providers for a cluster. Users can select the IdP from the login page of the OpenShift web console.

Figure 2.1: Select an IdP for authenticating

$ rosa create idp --cluster mycluster
I: Interactive mode enabled.
Any optional fields can be left empty and a default will be selected.
? Type of identity provider:  [Use arrows to move, type to filter]
> github
  gitlab
  google
  htpasswd
  ldap
  openid
? Identity provider name: GitHub-dev-org
...output omitted...

$ rosa grant user cluster-admin --user myuser --cluster mycluster

$ rosa revoke user cluster-admin --user myuser --cluster mycluster

$ rosa grant user dedicated-admin --user myuser --cluster mycluster

$ rosa revoke user dedicated-admin --user myuser --cluster mycluster

Some applications might need access to your OpenShift cluster. For example, external workflow managers, such as ServiceNow or a CI/CD pipeline, use the OpenShift API to deploy applications on behalf of developers. These applications need to authenticate with OpenShift to perform their operations.

To preserve the integrity of a regular user's credentials, service accounts are used instead. Service accounts enable you to control API access without the need to borrow a regular user's credentials.

As a cluster administrator, you can create a service account by using the oc create serviceaccount command:

$ oc create serviceaccount my-service-account

You can grant the service account some access to your cluster. The following command grants the self-provisioner cluster role to the service account. With that role, the service account can create projects and manage resources in these projects.

$ oc adm policy add-cluster-role-to-user self-provisioner -z my-service-account

The service account authenticates with the API by using an access token. You can generate a temporary token by using the oc create token command. By default, the token expires after one hour but you can provide the --duration option to specify a different expiration period.

$ oc create token my-service-account --duration 2h
eyJh...PVqM

If you need a token that does not expire, then use the token that OpenShift automatically creates when you create the service account. OpenShift stores this token in a secret object. Use the oc describe serviceaccount command to retrieve the name of the OpenShift secret.

$ oc describe serviceaccount my-service-account
Name:                my-service-account
Namespace:           default
Labels:              <none>
Annotations:         <none>
Image pull secrets:  my-service-account-dockercfg-7x4qp
Mountable secrets:   my-service-account-dockercfg-7x4qp
Tokens:              my-service-account-token-hfdks
Events:              <none>

Use the oc describe secret command to retrieve the token.

$ oc describe secret my-service-account-token-hfdks
...output omitted...
Data
====
token:           eyJh...IH4c
...output omitted...

You can use this token to configure the application that needs access to the OpenShift API.

To test the authentication, use the oc login command and provide the token by using the --token option:

$ oc login --token eyJh...IH4c
Logged into "https://api.mycluster.myawsdomain:6443" as "system:serviceaccount:default:my-service-account" using the token provided.

You don't have any projects. You can try to create a new project, by running

    oc new-project <projectname>