OIDC client secret is invalid error when deploying a VirtualServer on Nginx Plus on Kubernetes

[billb-asg]

Hi, I am getting the following when I try to deploy a virtual server in kubernetes using Nginx Plus in EKS:

Warning AddedOrUpdatedWithWarning 38s nginx-ingress-controller Configuration for mynmespace/my-virtual-server was added or updated ; with warning(s): OIDC policy mynamespave/kycloak-oidc-policy references an invalid secret mynamespace/oidc-secret: OIDC client secret is invalid: It must contain valid ASCII characters, must have all '"' escaped and must not contin any '$' or whitespaces ('\n', '\t' etc.) or end with an unescaped ''

I am using similar to the following:

Secret:
apiVersion: v1
kind: Secret
metadata:
name: oidc-secret
type: nginx.org/oidc
data:
client-secret: dzRiMzJjNGIwLWY0YjMtNDFkOS1hMzQ1LTJiYzBmYmZjYWFiYQo=

Policy:
apiVersion: k8s.nginx.org/v1
kind: Policy
metadata:
name: keycloak-oidc-policy
spec:
ingressClassName: nginx-plus
oidc:
clientID: OIDCProxyNGINXPlus
clientSecret: oidc-secret
authEndpoint: /TestOIDC/protocol/openid-connect/auth
tokenEndpoint: /auth/realms/TestOIDC/protocol/openid-connect/token
jwksURI: /auth/realms/TestOIDC/protocol/openid-connect/certs

Virtual Server:

apiVersion: k8s.nginx.org/v1
kind: VirtualServer
metadata:
name: my-virtual-server
spec:
ingressClassName: nginx-plus
host:
upstreams:

• name: mybackend
  service: mybasckend-service
  port: 80
  routes:
• path: /mybackend
  policies:
  • name: keycloak-oidc-policy
    action:
    proxy:
    upstream: mybackend

Any thoughts on why I keep getting this error?

Thanks.

[jasonwilliams14]

@billb-asg Hello there.
From the error, it looks like your secret was not created correctly.

It must contain valid ASCII characters, must have all '"' escaped and must not contin any '$' or whitespaces ('\n', '\t' etc.) or end with an unescaped ''

How did you create your secret?
Are you able to decode your secret successfully?

[billb-asg]

The client secret was created by keycloak when OIDC Client Access Type is set to confidential. I can base64 decode the encoded string to the same client secret that is defined in keycloak. I also took the client secret direct from Keycloak and ran it through an ASCII validator where is passed.

[Joren-Thijs-KasparSolutions]

For anyone else struggeling with the same problem. You have to Base64 encode the clientsecret you get from keycloak.

so say your client secret from keycloak is 5wGrhr9UWFYmdSwGjkdCkVfNU2XbaWop then you base 64 encode it. So it becomes NXdHcmhyOVVXRlltZFN3R2prZENrVmZOVTJYYmFXb3A=

Then your finished yaml looks like this

apiVersion: v1
kind: Secret
metadata:
  name: oidc-secret
type: nginx.org/oidc
data:
  client-secret: M3dHd2hyOVVXRlltclN3Smpjc0NrVmZHVTBYZHFCT3Y= #replace with secret variable from a pipeline

[jasonwilliams14]

@Joren-Thijs-KasparSolutions absolutely. 100% correct. Very important item.

[jjngx]

Answered, closing.