fix(keycloak): allow the polaris-console redirect URI on any project

[abir-oumghar]

Description

The polaris-console OIDC client hardcodes the project namespace default in its redirect URI, so the console login fails with Invalid parameter: redirect_uri on every project named otherwise. The console is deployed per project, so its host carries the project namespace.

This replaces the hardcoded host with https://polaris-console-*, which matches the console of any project. Keycloak only supports a trailing wildcard, so the domain scoped pattern https://polaris-console-*.<suffix>/auth/callback is not usable: it is rejected for every URL, legitimate ones included. The chosen pattern is still narrower than the https://* already used by the seven other per-project clients in this file.

Related Issue

Fixes OKDP/okdp-sandbox#82

Type of Change

• Bug fix
• New feature
• Documentation update
• Refactor / chore
• Breaking change

How to Test

Deploy Polaris in a project namespace other than default, then open https://polaris-console-<project>.<suffix> and log in.

Verified on an OKDP sandbox (kind, Keycloak 26.1.3) with the project examples:

• the authorization endpoint accepts https://polaris-console-examples.<suffix>/auth/callback and serves the login form
• the full authorization code flow completes with a real user and the code is returned to the callback
• CORS preflight returns the expected Access-Control-Allow-Origin for the console origin, on several project names
• unrelated hosts such as https://evil.example.com and https://superset-<project>.<suffix> are still rejected

Impact is limited to the console UI login. The Polaris REST API is unaffected: Trino queries on the Polaris backed catalogs keep working with the hardcoded value in place.

Note: any static wildcard stays permissive, a host like polaris-console-<something>.example.com would also match. Registering the client per project at deploy time, where the exact host is known, remains the proper fix.

Checklist

• I have tested my changes
• Documentation updated if needed
• If breaking change: migration path described above
• I hereby declare this contribution to be licensed under the Apache License Version 2.0.
• I hereby agree to grant TOSIT a copyright license to use my contributions.

[jpmewenemesse]

there is conflict issue here. can you make sure you switched to the main branch and then fetched and merged the upstream main and then rebase your feature branch on top of main one ? I think that will solve the issue

[SteBaum]

This PR should be displaced to okdp-sandbox

[SteBaum]

Isn't this better:

"https://polaris-console-{{ .Release.namespace }}.{{ .Context.ingress.suffix }}"
"https://polaris-console-{{ .Release.namespace }}.{{ .Context.ingress.suffix }}/auth/callback"

Instead of :

"https://polaris-console-*"

[jpmewenemesse]

As discussed and aggreed in the friday contributors meeting, keycloak is part of sandbox-dependencies repo. That is why this PR 43 is about removing it here to avoid duplication. So please make sure all contributions to keycloak is done on sandbox-dependencies repo instead of here.

[SteBaum]

As discussed and aggreed in the friday contributors meeting, keycloak is part of sandbox-dependencies repo. That is why this PR 43 is about removing it here to avoid duplication. So please make sure all contributions to keycloak is done on sandbox-dependencies repo instead of here.

Here it does not touch the Keycloak kubocd package but the default context 99-examples-context.yamlused by Keycloak in the okdp-sanbox environment.

[jpmewenemesse]

As discussed and aggreed in the friday contributors meeting, keycloak is part of sandbox-dependencies repo. That is why this PR 43 is about removing it here to avoid duplication. So please make sure all contributions to keycloak is done on sandbox-dependencies repo instead of here.

Here it does not touch the Keycloak kubocd package but the default context 99-examples-context.yamlused by Keycloak in the okdp-sanbox environment.

Oh ok got it

[abir-oumghar]

Tried that first, it does not work.

The Keycloak realm is rendered once by the keycloak release, which does not know the project namespaces created later. And in practice the keycloak package only substitutes {{ .Context.ingress.suffix }} in redirectUris (packages/system/keycloak/keycloak.yaml, line 206), never the namespace placeholder.

Rendering the package with your value gives:

https://polaris-console-.okdp.sandbox/auth/callback
The namespace placeholder resolves to an empty string, so no project would match at all, not even default.

The trailing wildcard is the only form Keycloak accepts here: a scoped pattern like https://polaris-console-*.{{ .Context.ingress.suffix }}/auth/callback is rejected for every URL, legitimate ones included, since Keycloak only supports the wildcard at the end of the URI.

Isn't this better:

"https://polaris-console-{{ .Release.namespace }}.{{ .Context.ingress.suffix }}"
"https://polaris-console-{{ .Release.namespace }}.{{ .Context.ingress.suffix }}/auth/callback"

Instead of :

"https://polaris-console-*"

[abir-oumghar]

Agreed on moving this to okdp-sandbox, the same file carries the same value there. I will open it against that repo and close this one.