# Configure authentication with OpenID

# Introduction

For this page, I will setup OKD dashboard for OpenID flow with keycloak (keycloak is not covered in this wiki page)

# Admin dashboard

Right after the installation, you are logged in with kubeadmin account and you popped here:

 ![](https://s3.legodard.fr/outline/uploads/5654a7de-923d-4b76-b273-970424111d36/68fc6273-167b-475b-a2d0-540fd5ab7de5/image.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=GKba57e91c95509edeeb33447e%2F20260909%2Feu-west-1%2Fs3%2Faws4_request&X-Amz-Date=20260909T061500Z&X-Amz-Expires=86400&X-Amz-Signature=e8144d4b2f718e29a23cff91c045b2b618b3230bc02b3b2891a5eb676172283b&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject)

You have two ways to configure OAuth:

 ![](https://s3.legodard.fr/outline/uploads/5654a7de-923d-4b76-b273-970424111d36/0e209307-346c-40fc-9e58-615ad064376a/image.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=GKba57e91c95509edeeb33447e%2F20260909%2Feu-west-1%2Fs3%2Faws4_request&X-Amz-Date=20260909T061500Z&X-Amz-Expires=86400&X-Amz-Signature=486ca4aa8e7c4d099cb9dcfc3e13edf62a3832ddab9c30dda0dc1ebbdd079f07&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject)

# OAuth configuration

You are on this page:

 ![](https://s3.legodard.fr/outline/uploads/5654a7de-923d-4b76-b273-970424111d36/60e062eb-b839-450d-87e0-ab795bcaca43/image.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=GKba57e91c95509edeeb33447e%2F20260909%2Feu-west-1%2Fs3%2Faws4_request&X-Amz-Date=20260909T061500Z&X-Amz-Expires=86400&X-Amz-Signature=17dcbd84ef7eb07f382d6bc74f4de45f8218ac7d4093d05c8d020c9d23a5f265&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject)

Scroll down to see: ![](https://s3.legodard.fr/outline/uploads/5654a7de-923d-4b76-b273-970424111d36/d8e32b6e-8eb7-4a0a-958e-5ccd76097196/image.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=GKba57e91c95509edeeb33447e%2F20260909%2Feu-west-1%2Fs3%2Faws4_request&X-Amz-Date=20260909T061500Z&X-Amz-Expires=86400&X-Amz-Signature=f324b7ac33a8bb2f2f6d8210fd1dd32c22ce969e0644fd8fabbaa96b5feffbaa&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject)

Click on “Add” and chose “OpenID Connect”:

 ![](https://s3.legodard.fr/outline/uploads/5654a7de-923d-4b76-b273-970424111d36/31873fbb-8d28-472e-9ca7-bb908f714c00/image.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=GKba57e91c95509edeeb33447e%2F20260909%2Feu-west-1%2Fs3%2Faws4_request&X-Amz-Date=20260909T061500Z&X-Amz-Expires=86400&X-Amz-Signature=975aa730bf48eafbc2d86f1996ee235a492593b7020e1f614bd3929c7135b140&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject " =147x349")You are redirect to this page, you need to fill the form with your data.

 ![](https://s3.legodard.fr/outline/uploads/5654a7de-923d-4b76-b273-970424111d36/0c8bd8fa-fb54-4edc-8f86-1a30ccb6d30d/image.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=GKba57e91c95509edeeb33447e%2F20260909%2Feu-west-1%2Fs3%2Faws4_request&X-Amz-Date=20260909T061500Z&X-Amz-Expires=86400&X-Amz-Signature=a04cd376b50286a2f8375b05906eb112533781832603b1e6d62e3d65f7c70d17&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject " =442x405")

Like this (for my case):

 ![](https://s3.legodard.fr/outline/uploads/5654a7de-923d-4b76-b273-970424111d36/663c8ac1-7585-43a8-b684-f758aaed377d/image.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=GKba57e91c95509edeeb33447e%2F20260909%2Feu-west-1%2Fs3%2Faws4_request&X-Amz-Date=20260909T061500Z&X-Amz-Expires=86400&X-Amz-Signature=152d1d0dbfb1af1d4ffade42ad4351945204573c9130add56e53fcb7b93d175b&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject " =442x337")And I don’t touch to “Claims” section.

Then click on “Add” when it’s done.


:::info
It take a few minutes (<2min) to OKD to detect change and restart authentication pod.

:::

After the pod restart, on the login page, you have now two options to login:

 ![](https://s3.legodard.fr/outline/uploads/5654a7de-923d-4b76-b273-970424111d36/dd33caff-f605-4b17-a913-86f4eae64a5b/image.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=GKba57e91c95509edeeb33447e%2F20260909%2Feu-west-1%2Fs3%2Faws4_request&X-Amz-Date=20260909T061500Z&X-Amz-Expires=86400&X-Amz-Signature=937b720e4fc899843ccc18bb64bcca3af88e436f7077b5228c4ae89bafe987ca&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject)

# Remove kube:admin domain

## Create a ClusterRoleBinding

```bash
oc create clusterrolebinding user-cluster-admin --clusterrole=cluster-admin --user=<your username>
```

## Remove unwanted domain

```bash
oc delete secrets kubeadmin -n kube-system
```


:::warning
Caution: Verify that you have access to administrative dashboard with your regular account before deleting kube:admin domain.

:::

# Conclusion

Now, when you going to your cluster login page, it redirects you to your SSO portal.

---

**Documents**

- [AS205126](https://docs.legodard.fr/s/bc661677-ac7d-4fe7-984e-e1f43ddf6287/doc/as205126-UD37o91h51)
- [Kubernetes](https://docs.legodard.fr/s/bc661677-ac7d-4fe7-984e-e1f43ddf6287/doc/kubernetes-AYsNjQV7SW)
- [Proxmox](https://docs.legodard.fr/s/bc661677-ac7d-4fe7-984e-e1f43ddf6287/doc/proxmox-TnNEgoRFwj)
- [DN42](https://docs.legodard.fr/s/bc661677-ac7d-4fe7-984e-e1f43ddf6287/doc/dn42-oTEE68Qn7n)
- [Openshift](https://docs.legodard.fr/s/bc661677-ac7d-4fe7-984e-e1f43ddf6287/doc/openshift-428FG3kMtg)
- [Openstack](https://docs.legodard.fr/s/bc661677-ac7d-4fe7-984e-e1f43ddf6287/doc/openstack-KJmz0J0klm)