Skip to content

Conversation

@Leo6Leo
Copy link
Contributor

@Leo6Leo Leo6Leo commented Sep 22, 2025

Closes #13744

Description

After logging in with Google OAuth OIDC, the Console can only show username instead of full name as the display name on the top right corner in the console.

Step to test out the changes

  1. Have a cluster that configure the Google OIDC login. If you don't have one, you can follow the instructions I wrote in the Appendix which locates at the bottom of this PR description.

  2. Choose Google-OpenID-Connect as your login option and login with your google account

Screenshot 2025-09-22 at 1 43 35 PM
  1. After your success login, you will see on the right top corner is displaying your full name, instead of your email address.

Special Note

Thanks to @logonoff for the discussion on what would be the better way to resolve this issue.

Appendix: How to configure Google OAuth on your cluster for testing purpose

Prerequisites

Before you begin, you'll need:

  • Administrator access to your OpenShift cluster using the oc and kubectl CLI.
  • A Google Cloud project with an OAuth 2.0 Client ID and Client Secret created. If you need to create one, follow Google's official documentation.

Step 1: Create the Google Client Secret in OpenShift

First, create a k8s secret in the openshift-config namespace to securely store your Google OAuth client secret. This prevents storing sensitive values directly in the main cluster configuration.

Replace <your-google-client-secret> with the actual client secret from your Google Cloud project.

oc create secret generic google-secret \
  --from-literal=clientSecret=<your-google-client-secret> \
  -n openshift-config

Step 2: Configure the Cluster OAuth Identity Provider

Next, edit the cluster-wide OAuth configuration to add Google as an identity provider.

oc edit oauth cluster

Replace with the Client ID from your Google Cloud project.

spec:
  identityProviders:
  - name: Google                 # This is the name that will appear on the login page
    mappingMethod: claim
    type: OpenID
    openID:
      clientID: <your-google-client-id>
      clientSecret:
        name: google-secret      # The name of the secret you created in Step 1
      extraScopes:
      - email
      - profile
      issuer: https://accounts.google.com
      claims:
        preferredUsername:
        - email
        name:
        - name
        email:
        - email

Save and close the editor. Then wait until the authentication operator finish reconciling.

Step 3: Get the redirect_uri and Update Google Cloud

This is a crucial step. OpenShift generates a unique callback URL that Google needs to know about for security.

  1. Open your OpenShift cluster's web console in a browser. You should now see the "Google" login option.

  2. Click the Google login button. You will likely be redirected to a Google error page saying something like "Error 400: redirect_uri_mismatch". This is expected!

  3. Copy the entire URL from your browser's address bar. Find the redirect_uri parameter within that URL. It will look something like this:
    https://oauth-openshift.apps../oauth2callback/Google

  4. Go to your project in the Google Cloud Console.

  5. Navigate to your OAuth 2.0 Client ID.

  6. Under the "Authorized redirect URIs" section, click "ADD URI" and paste the full redirect_uri you copied.

  7. Click Save.

  8. Login with your google account again and you will see it works!

@openshift-ci-robot openshift-ci-robot added jira/severity-moderate Referenced Jira bug's severity is moderate for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Sep 22, 2025
@openshift-ci-robot
Copy link
Contributor

@Leo6Leo: This pull request references Jira Issue OCPBUGS-56892, which is invalid:

  • expected the bug to target the "4.21.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Description

After logging in with Google OAuth OIDC, the Console can only show username instead of full name as the display name on the top right corner in the console.

Step to test out the changes

  1. Have a cluster that configure the Google OIDC login. If you don't have one, you can follow the instructions I wrote in the Appendix which locates at the bottom of this PR description.

  2. Choose Google-OpenID-Connect as your login option and login with your google account

Screenshot 2025-09-22 at 1 43 35 PM
  1. After your success login, you will see on the right top corner is displaying your full name, instead of your email address.

Special Note

Thanks to @logonoff for the discussion on what would be the better way to resolve this issue.

Appendix: How to configure Google OAuth on your cluster for testing purpose

Prerequisites

Before you begin, you'll need:

  • Administrator access to your OpenShift cluster using the oc and kubectl CLI.
  • A Google Cloud project with an OAuth 2.0 Client ID and Client Secret created. If you need to create one, follow Google's official documentation.

Step 1: Create the Google Client Secret in OpenShift

First, create a k8s secret in the openshift-config namespace to securely store your Google OAuth client secret. This prevents storing sensitive values directly in the main cluster configuration.

Replace <your-google-client-secret> with the actual client secret from your Google Cloud project.

oc create secret generic google-secret \
 --from-literal=clientSecret=<your-google-client-secret> \
 -n openshift-config

Step 2: Configure the Cluster OAuth Identity Provider

Next, edit the cluster-wide OAuth configuration to add Google as an identity provider.

oc edit oauth cluster

Replace with the Client ID from your Google Cloud project.

spec:
 identityProviders:
 - name: Google                 # This is the name that will appear on the login page
   mappingMethod: claim
   type: OpenID
   openID:
     clientID: <your-google-client-id>
     clientSecret:
       name: google-secret      # The name of the secret you created in Step 1
     extraScopes:
     - email
     - profile
     issuer: https://accounts.google.com
     claims:
       preferredUsername:
       - email
       name:
       - name
       email:
       - email

Save and close the editor. Then wait until the authentication operator finish reconciling.

Step 3: Get the redirect_uri and Update Google Cloud

This is a crucial step. OpenShift generates a unique callback URL that Google needs to know about for security.

  1. Open your OpenShift cluster's web console in a browser. You should now see the "Google" login option.

  2. Click the Google login button. You will likely be redirected to a Google error page saying something like "Error 400: redirect_uri_mismatch". This is expected!

  3. Copy the entire URL from your browser's address bar. Find the redirect_uri parameter within that URL. It will look something like this:
    https://oauth-openshift.apps../oauth2callback/Google

  4. Go to your project in the Google Cloud Console.

  5. Navigate to your OAuth 2.0 Client ID.

  6. Under the "Authorized redirect URIs" section, click "ADD URI" and paste the full redirect_uri you copied.

  7. Click Save.

  8. Login with your google account again and you will see it works!

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci bot requested review from TheRealJon and cajieh September 22, 2025 17:51
@openshift-ci openshift-ci bot added component/core Related to console core functionality component/sdk Related to console-plugin-sdk component/shared Related to console-shared labels Sep 22, 2025
@Leo6Leo
Copy link
Contributor Author

Leo6Leo commented Sep 22, 2025

/jira refresh
/label tide/merge-method-squash

@openshift-ci openshift-ci bot added the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Sep 22, 2025
@openshift-ci-robot openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Sep 22, 2025
@openshift-ci-robot
Copy link
Contributor

@Leo6Leo: This pull request references Jira Issue OCPBUGS-56892, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.21.0) matches configured target version for branch (4.21.0)
  • bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @yanpzhan

Details

In response to this:

/jira refresh
/label tide/merge-method-squash

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci bot requested a review from yanpzhan September 22, 2025 17:53
…th fallbacks and add corresponding unit tests
@openshift-ci-robot
Copy link
Contributor

@Leo6Leo: This pull request references Jira Issue OCPBUGS-56892, which is valid.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.21.0) matches configured target version for branch (4.21.0)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @yanpzhan

Details

In response to this:

Closes #13744

Description

After logging in with Google OAuth OIDC, the Console can only show username instead of full name as the display name on the top right corner in the console.

Step to test out the changes

  1. Have a cluster that configure the Google OIDC login. If you don't have one, you can follow the instructions I wrote in the Appendix which locates at the bottom of this PR description.

  2. Choose Google-OpenID-Connect as your login option and login with your google account

Screenshot 2025-09-22 at 1 43 35 PM
  1. After your success login, you will see on the right top corner is displaying your full name, instead of your email address.

Special Note

Thanks to @logonoff for the discussion on what would be the better way to resolve this issue.

Appendix: How to configure Google OAuth on your cluster for testing purpose

Prerequisites

Before you begin, you'll need:

  • Administrator access to your OpenShift cluster using the oc and kubectl CLI.
  • A Google Cloud project with an OAuth 2.0 Client ID and Client Secret created. If you need to create one, follow Google's official documentation.

Step 1: Create the Google Client Secret in OpenShift

First, create a k8s secret in the openshift-config namespace to securely store your Google OAuth client secret. This prevents storing sensitive values directly in the main cluster configuration.

Replace <your-google-client-secret> with the actual client secret from your Google Cloud project.

oc create secret generic google-secret \
 --from-literal=clientSecret=<your-google-client-secret> \
 -n openshift-config

Step 2: Configure the Cluster OAuth Identity Provider

Next, edit the cluster-wide OAuth configuration to add Google as an identity provider.

oc edit oauth cluster

Replace with the Client ID from your Google Cloud project.

spec:
 identityProviders:
 - name: Google                 # This is the name that will appear on the login page
   mappingMethod: claim
   type: OpenID
   openID:
     clientID: <your-google-client-id>
     clientSecret:
       name: google-secret      # The name of the secret you created in Step 1
     extraScopes:
     - email
     - profile
     issuer: https://accounts.google.com
     claims:
       preferredUsername:
       - email
       name:
       - name
       email:
       - email

Save and close the editor. Then wait until the authentication operator finish reconciling.

Step 3: Get the redirect_uri and Update Google Cloud

This is a crucial step. OpenShift generates a unique callback URL that Google needs to know about for security.

  1. Open your OpenShift cluster's web console in a browser. You should now see the "Google" login option.

  2. Click the Google login button. You will likely be redirected to a Google error page saying something like "Error 400: redirect_uri_mismatch". This is expected!

  3. Copy the entire URL from your browser's address bar. Find the redirect_uri parameter within that URL. It will look something like this:
    https://oauth-openshift.apps../oauth2callback/Google

  4. Go to your project in the Google Cloud Console.

  5. Navigate to your OAuth 2.0 Client ID.

  6. Under the "Authorized redirect URIs" section, click "ADD URI" and paste the full redirect_uri you copied.

  7. Click Save.

  8. Login with your google account again and you will see it works!

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@Leo6Leo
Copy link
Contributor Author

Leo6Leo commented Sep 22, 2025

/cc @logonoff @jhadvig

@openshift-ci openshift-ci bot requested review from jhadvig and logonoff September 22, 2025 18:21
const userToggle = (
<span className="co-username" data-test="username">
{authEnabledFlag ? username : t('public~Auth disabled')}
{authEnabledFlag ? displayName || username || 'User' : t('public~Auth disabled')}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

displayName will always return a value so i am not sure if we need the fallback values here

return currentUsername.trim();
}
// Final fallback for edge cases
return 'Unknown User';
Copy link
Member

@logonoff logonoff Sep 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should either add i18n or return null (to allow for fallback values to fallback)

Leo6Leo and others added 2 commits September 22, 2025 14:34
@Leo6Leo
Copy link
Contributor Author

Leo6Leo commented Oct 30, 2025

/retest-required
Permission Denied issue, flaky

@Leo6Leo
Copy link
Contributor Author

Leo6Leo commented Nov 3, 2025

/retest

@Leo6Leo
Copy link
Contributor Author

Leo6Leo commented Nov 4, 2025

/retest-required

@jhadvig
Copy link
Member

jhadvig commented Nov 5, 2025

/retest

@Leo6Leo
Copy link
Contributor Author

Leo6Leo commented Nov 6, 2025

/retest-required

@Leo6Leo
Copy link
Contributor Author

Leo6Leo commented Nov 10, 2025

/assign @yapei @yanpzhan
All the tests are now passing, thanks for re-verifying it

@yanpzhan
Copy link
Contributor

@Leo6Leo there is conflict for the pr code, cluster-bot could not launch cluster with the pr, could you please rebase the code?

@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 11, 2025
@openshift-merge-robot openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 12, 2025
@openshift-ci openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Nov 12, 2025
@logonoff
Copy link
Member

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Nov 12, 2025
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Nov 12, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Leo6Leo, logonoff

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@Leo6Leo
Copy link
Contributor Author

Leo6Leo commented Nov 13, 2025

@yanpzhan The PR has been successfully rebased, please let me know if any further action is needed, thanks!

@yanpzhan
Copy link
Contributor

Checked on cluster launched against the pr, the full name is shown as expected.
/verified by @yanpzhan

@openshift-ci-robot openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Nov 14, 2025
@openshift-ci-robot
Copy link
Contributor

@yanpzhan: This PR has been marked as verified by @yanpzhan.

Details

In response to this:

Checked on cluster launched against the pr, the full name is shown as expected.
/verified by @yanpzhan

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Nov 14, 2025

@Leo6Leo: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/okd-scos-e2e-aws-ovn cbecd50 link false /test okd-scos-e2e-aws-ovn

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-ci-robot
Copy link
Contributor

/retest-required

Remaining retests: 0 against base HEAD d673d10 and 2 for PR HEAD cbecd50 in total

@openshift-merge-bot openshift-merge-bot bot merged commit efd72db into openshift:main Nov 15, 2025
7 of 8 checks passed
@openshift-ci-robot
Copy link
Contributor

@Leo6Leo: Jira Issue OCPBUGS-56892 is in an unrecognized state (ON_QA) and will not be moved to the MODIFIED state.

Details

In response to this:

Closes #13744

Description

After logging in with Google OAuth OIDC, the Console can only show username instead of full name as the display name on the top right corner in the console.

Step to test out the changes

  1. Have a cluster that configure the Google OIDC login. If you don't have one, you can follow the instructions I wrote in the Appendix which locates at the bottom of this PR description.

  2. Choose Google-OpenID-Connect as your login option and login with your google account

Screenshot 2025-09-22 at 1 43 35 PM
  1. After your success login, you will see on the right top corner is displaying your full name, instead of your email address.

Special Note

Thanks to @logonoff for the discussion on what would be the better way to resolve this issue.

Appendix: How to configure Google OAuth on your cluster for testing purpose

Prerequisites

Before you begin, you'll need:

  • Administrator access to your OpenShift cluster using the oc and kubectl CLI.
  • A Google Cloud project with an OAuth 2.0 Client ID and Client Secret created. If you need to create one, follow Google's official documentation.

Step 1: Create the Google Client Secret in OpenShift

First, create a k8s secret in the openshift-config namespace to securely store your Google OAuth client secret. This prevents storing sensitive values directly in the main cluster configuration.

Replace <your-google-client-secret> with the actual client secret from your Google Cloud project.

oc create secret generic google-secret \
 --from-literal=clientSecret=<your-google-client-secret> \
 -n openshift-config

Step 2: Configure the Cluster OAuth Identity Provider

Next, edit the cluster-wide OAuth configuration to add Google as an identity provider.

oc edit oauth cluster

Replace with the Client ID from your Google Cloud project.

spec:
 identityProviders:
 - name: Google                 # This is the name that will appear on the login page
   mappingMethod: claim
   type: OpenID
   openID:
     clientID: <your-google-client-id>
     clientSecret:
       name: google-secret      # The name of the secret you created in Step 1
     extraScopes:
     - email
     - profile
     issuer: https://accounts.google.com
     claims:
       preferredUsername:
       - email
       name:
       - name
       email:
       - email

Save and close the editor. Then wait until the authentication operator finish reconciling.

Step 3: Get the redirect_uri and Update Google Cloud

This is a crucial step. OpenShift generates a unique callback URL that Google needs to know about for security.

  1. Open your OpenShift cluster's web console in a browser. You should now see the "Google" login option.

  2. Click the Google login button. You will likely be redirected to a Google error page saying something like "Error 400: redirect_uri_mismatch". This is expected!

  3. Copy the entire URL from your browser's address bar. Find the redirect_uri parameter within that URL. It will look something like this:
    https://oauth-openshift.apps../oauth2callback/Google

  4. Go to your project in the Google Cloud Console.

  5. Navigate to your OAuth 2.0 Client ID.

  6. Under the "Authorized redirect URIs" section, click "ADD URI" and paste the full redirect_uri you copied.

  7. Click Save.

  8. Login with your google account again and you will see it works!

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@Leo6Leo
Copy link
Contributor Author

Leo6Leo commented Nov 17, 2025

/cherry-pick release-4.20

@openshift-cherrypick-robot

@Leo6Leo: #15522 failed to apply on top of branch "release-4.20":

Applying: fix: Update CoreState type to include userResource for k8s API integration
Applying: feat: Add userResource management to core actions and reducer
Applying: feat: Introduce useUser hook for centralized user data management
Applying: refactor: Replace direct user data fetching with centralized useUser hook in telemetry and masthead components
Using index info to reconstruct a base tree...
A	frontend/public/components/masthead/masthead-toolbar.tsx
Falling back to patching base and 3-way merge...
Auto-merging frontend/public/components/masthead-toolbar.jsx
CONFLICT (content): Merge conflict in frontend/public/components/masthead-toolbar.jsx
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"
Patch failed at 0004 refactor: Replace direct user data fetching with centralized useUser hook in telemetry and masthead components

Details

In response to this:

/cherry-pick release-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Leo6Leo added a commit to Leo6Leo/console that referenced this pull request Nov 19, 2025
…s the display name (openshift#15522)

* fix: Update CoreState type to include userResource for k8s API integration

* feat: Add userResource management to core actions and reducer

* feat: Introduce useUser hook for centralized user data management

* refactor: Replace direct user data fetching with centralized useUser hook in telemetry and masthead components

* test: auto generated the unit tests for useUser hook to validate user data retrieval and dispatch behavior

* feat: Enhance useUser hook to provide robust display name handling with fallbacks and add corresponding unit tests

* fix: apply the review feedback

* Apply suggestions from code review

Co-authored-by: logonoff <git@logonoff.co>

* feat: run i18n

* feat: Add UserKind type import

* Apply suggestions from code review

Co-authored-by: logonoff <git@logonoff.co>

* Update frontend/public/locales/en/public.json

Co-authored-by: logonoff <git@logonoff.co>

* Update frontend/packages/console-dynamic-plugin-sdk/src/app/core/actions/core.ts

Co-authored-by: logonoff <git@logonoff.co>

* feat: Import UserKind type in core actions

* refactor: Update GetUserResource type to use UserKind for improved type safety

* test: Update useUser.spec.ts to mock setUserResource and correct displayName expectation

* test: fixing the failing CI issue

---------

Co-authored-by: logonoff <git@logonoff.co>
Leo6Leo added a commit to Leo6Leo/console that referenced this pull request Jan 5, 2026
…s the display name (openshift#15522)

Cherry-picked from efd72db with conflict resolution adapted for 4.19 branch.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. component/core Related to console core functionality component/sdk Related to console-plugin-sdk component/shared Related to console-shared component/topology Related to topology jira/severity-moderate Referenced Jira bug's severity is moderate for the branch this PR is targeting. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. kind/i18n Indicates issue or PR relates to internationalization or has content that needs to be translated lgtm Indicates that a PR is ready to be merged. tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. verified Signifies that the PR passed pre-merge verification criteria

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Masthead username toggle does not uses fullName

8 participants