Red Hat SSO - OpenShift Admin access is not working

[rbo]

The admin password provided by demo.redhat.com won't work:

OpenShift Console: https://console-openshift-console.apps.cluster-cb9ct.cb9ct.sandbox2542.opentlc.com/
OpenShift API for command line 'oc' client: https://api.cluster-cb9ct.cb9ct.sandbox2542.opentlc.com:6443/
Download oc client from https://mirror.openshift.com/pub/openshift-v4/multi/clients/ocp/4.19.1/amd64/openshift-client-linux.tar.gz
Authentication via RHSSO is enabled on this cluster. RHSSO admin console: https://keycloak-rhsso.apps.cluster-cb9ct.cb9ct.sandbox2542.opentlc.com/ RHSSO admin user: admin RHSSO admin password: hEEoMD3kkBCAOA==
User admin with password LQ6kp7b3pq is cluster admin.
Users team-1 .. team-40 created with password openshift

Tried login via admin/LQ6kp7b3pq -> Login failed.

Work-a-round

• Log in to KeyCloak: https://keycloak-rhsso.apps... (via RHSSO admin user and RHSSO admin password

• Switch to Openshift realm

• Go to Manage Users

• Click on *View all users`

• Select admin

• Select Credentials tab

• Fill out Reset Password form
  

• Try to log in with the new admin password to OpenShift Web UI

[rbo]

Another work-a-round:

ssh lab-user@bastion...... oc get keycloakusers.keycloak.org -n rhsso admin -o jsonpath="{.spec.user.credentials[0].value}" ; echo
Warning: Permanently added 'bastion.djsg4.sandbox703.opentlc.com' (ED25519) to the list of known hosts.
lab-user@bastion..... password:
VQJiE8QZ9o

It looks like the password in the keycloakusers object is different from what's provided to the user at demo.redhat.com.

[rbo]

The problem is in the Ansible role ocp4_workload_rhsso_authentication: defaults/main

ocp4_workload_rhsso_authentication_admin_password: "{{
  common_password | default(lookup('password', '/dev/null chars=ascii_letters,digits '~ 'length=' ~ 10)) }}"

After a quick cursor session:

Key Takeaways

• Always use set_fact to capture lookup results
• Use a file path (not /dev/null) for persistence across runs
• Never put lookup() directly in defaults/main.yml or vars/main.yml
• Once cached with set_fact, the variable will be consistent throughout the playbook

This ensures your password is generated once and remains the same every time you reference it!

[rbo]

Temp. fix applied in test env. Let's test it...