Adding OIDC Provider fails with "invalid provider url" error about infra

[olzemal]

I suspect this might be an issue with dex' oidc config. I tried adding the documented okta IDP and got the expected error message of an invalid id / secret:

$ infra providers add fail --url "infrahq.okta.com" --client-id infra --client-secret infra-secret --kind oidc --log-level debug
DEBUG call server: create provider named "fail"
Error: validation failed: clientID: invalid provider clientID

The output of my dex' /.wellknown/openid-configuration is:

{
  "issuer": "https://dex.10.10.110.96.nip.io",
  "authorization_endpoint": "https://dex.10.10.110.96.nip.io/auth",
  "token_endpoint": "https://dex.10.10.110.96.nip.io/token",
  "jwks_uri": "https://dex.10.10.110.96.nip.io/keys",
  "userinfo_endpoint": "https://dex.10.10.110.96.nip.io/userinfo",
  "device_authorization_endpoint": "https://dex.10.10.110.96.nip.io/device/code",
  "grant_types_supported": [
    "authorization_code",
    "refresh_token",
    "urn:ietf:params:oauth:grant-type:device_code"
  ],
  "response_types_supported": [
    "code"
  ],
  "subject_types_supported": [
    "public"
  ],
  "id_token_signing_alg_values_supported": [
    "RS256"
  ],
  "code_challenge_methods_supported": [
    "S256",
    "plain"
  ],
  "scopes_supported": [
    "openid",
    "email",
    "groups",
    "profile",
    "offline_access"
  ],
  "token_endpoint_auth_methods_supported": [
    "client_secret_basic",
    "client_secret_post"
  ],
  "claims_supported": [
    "iss",
    "sub",
    "aud",
    "iat",
    "exp",
    "email",
    "email_verified",
    "locale",
    "name",
    "preferred_username",
    "at_hash"
  ]
}

The OIDC Requirements from the docs are fulfilled by this as far as i can tell.

[olzemal]

Thanks to this comment i found the error gets generated here

After cranking the log level to debug i found that the error is indeed related to my dex (ssl) config.

{"level":"debug","time":1681461078356,"caller":"server/middleware.go:260","message":"Host: infra.10.10.110.96.nip.io"}
{"level":"debug","time":1681461078356,"caller":"server/middleware.go:269","message":"Host not found: infra.10.10.110.96.nip.io"}
{"level":"debug","time":1681461078389,"caller":"providers/oidc.go:99","message":"error validating oidc provider: get provider openid info: Get \"https://dex.10.10.110.96.nip.io/.well-known/openid-configuration\": x509: certificate signed by unknown authority"}
{"level":"debug","error":"validation failed: url: invalid provider url","method":"POST","path":"/api/providers","statusCode":400,"remoteAddr":"192.168.4.10:54778","time":1681461078390,"caller":"server/routes.go:208","message":"api request error"}

Is there any way of configuring a private certificate authority for oidc providers?

[olzemal]

...turns out you can just inject the ca into the server container.
I created a secret from the ca file like this:

$ kubectl create secret generic --from-file=ca.crt -n infra-server ca-crt

and added the following lines to my values.yaml:

server:
...
  volumes:
  - name: ca-crt
    secret:
      secretName: ca-crt
  volumeMounts:
  - name: ca-crt
    mountPath: /etc/ssl/certs/ca.crt
    subPath: ca.crt
    readOnly: true

After this i could successfully add my oidc provider.