# \#authn **URL:** https://discuss.kubernetes.io/tag/authn/17.md [Latest](https://discuss.kubernetes.io/latest.md) · [Categories](https://discuss.kubernetes.io/categories.md) · [Tags](https://discuss.kubernetes.io/tags.md) --- ## [OIDC in airgapped env](https://discuss.kubernetes.io/t/oidc-in-airgapped-env/29888)
**Author:** [@kotyara85](https://discuss.kubernetes.io/u/kotyara85)\ **Replies:** 0\ **Last updated:** [September 25, 2024, 2:56pm UTC](https://discuss.kubernetes.io/t/oidc-in-airgapped-env/29888 "2024-09-25T14:56:35Z")
Good morning, I do have a super tight airgapped env, where I have to use external OIDC provider. There’s a https proxy which runs on each hosts which can router the traffic to pull jwks keys. Is there any way to tell … --- ## [What is the proper way to allow impersonating a single service account in k8s via RBAC?](https://discuss.kubernetes.io/t/what-is-the-proper-way-to-allow-impersonating-a-single-service-account-in-k8s-via-rbac/24168)
**Author:** [@L1ghtman2k](https://discuss.kubernetes.io/u/L1ghtman2k)\ **Replies:** 1\ **Last updated:** [February 7, 2024, 9:18am UTC](https://discuss.kubernetes.io/t/what-is-the-proper-way-to-allow-impersonating-a-single-service-account-in-k8s-via-rbac/24168 "2024-02-07T09:18:12Z")
I would like a cluster role or a service role to be able to impersonate a role in a different. I have tried both apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: creationTimestamp: "2023-05-10T23:… --- ## [User Authentication](https://discuss.kubernetes.io/t/user-authentication/26821)
**Author:** [@Pravas\_Giri](https://discuss.kubernetes.io/u/Pravas_Giri)\ **Replies:** 5\ **Last updated:** [January 25, 2024, 12:28pm UTC](https://discuss.kubernetes.io/t/user-authentication/26821 "2024-01-25T12:28:58Z")
How can I use two different user authentication methods in a yaml file? I searched for some examples but couldn’t find any in the official documentation or other resources. --- ## [Is k8s x509 certificates approved can canceled by api?](https://discuss.kubernetes.io/t/is-k8s-x509-certificates-approved-can-canceled-by-api/23424)
**Author:** [@GuiSong01](https://discuss.kubernetes.io/u/GuiSong01)\ **Replies:** 0\ **Last updated:** [March 11, 2023, 2:47am UTC](https://discuss.kubernetes.io/t/is-k8s-x509-certificates-approved-can-canceled-by-api/23424 "2023-03-11T02:47:47Z")
I have obtained the k8s x509 certificate through API. I want to cancel it after using it, so as to avoid security problems caused by certificate leakage.Is there API or other support？ Cluster information: Kubernetes ver… --- ## [How to configure OIDC with mulitple ClientId & Secret?](https://discuss.kubernetes.io/t/how-to-configure-oidc-with-mulitple-clientid-secret/22043)
**Author:** [@Jeven\_Wang](https://discuss.kubernetes.io/u/Jeven_Wang)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 1:26am UTC](https://discuss.kubernetes.io/t/how-to-configure-oidc-with-mulitple-clientid-secret/22043 "2022-11-23T01:26:46Z")
In this case we deployed a keycloak and created multiple realms and each realm has one client confiugred, we need to configure the OIDC for kubernetes in order to ensure the request sent from different clients can be aut… --- ## [Add custom claims into bound service account JWT token?](https://discuss.kubernetes.io/t/add-custom-claims-into-bound-service-account-jwt-token/21733)
**Author:** [@awn](https://discuss.kubernetes.io/u/awn)\ **Replies:** 0\ **Last updated:** [October 24, 2022, 4:31pm UTC](https://discuss.kubernetes.io/t/add-custom-claims-into-bound-service-account-jwt-token/21733 "2022-10-24T16:31:22Z")
I have a k8s cluster in EKS where pods are assigned bound service account tokens like so: volumeMounts: - mountPath: /test name: test readOnly: true ... volumes: - name: test projected: … --- ## [Kubernetes OIDC and Issuer URL Validation](https://discuss.kubernetes.io/t/kubernetes-oidc-and-issuer-url-validation/15736)
**Author:** [@cniehoff](https://discuss.kubernetes.io/u/cniehoff)\ **Replies:** 0\ **Last updated:** [April 30, 2021, 11:38am UTC](https://discuss.kubernetes.io/t/kubernetes-oidc-and-issuer-url-validation/15736 "2021-04-30T11:38:53Z")
Hi all! i want to run OIDC authentication with Keycloak on my Kubernetes 1.19 Cluster on AWS EKS. My problem is that it seems that the API Server makes an issuer url validation and verifies that both issuer url matches… --- ## [Why did kubernetes did not implement authentication mechanism?](https://discuss.kubernetes.io/t/why-did-kubernetes-did-not-implement-authentication-mechanism/14236)
**Author:** [@Omer\_Dayan](https://discuss.kubernetes.io/u/Omer_Dayan)\ **Replies:** 0\ **Last updated:** [December 24, 2020, 4:14pm UTC](https://discuss.kubernetes.io/t/why-did-kubernetes-did-not-implement-authentication-mechanism/14236 "2020-12-24T16:14:10Z")
Kubernetes does have authorization policy. And furthermore, they have authentication module of OIDC. That means the API Server does have the ability to read requests with id\_tokens as described in OpenIDConnect protocol… --- ## [K8s Identity Lab - OpenID Connect, RBAC and PodSecurityPolicies](https://discuss.kubernetes.io/t/k8s-identity-lab-openid-connect-rbac-and-podsecuritypolicies/8907)
**Author:** [@marc.boorshtein](https://discuss.kubernetes.io/u/marc.boorshtein)\ **Replies:** 0\ **Last updated:** [December 3, 2019, 2:15pm UTC](https://discuss.kubernetes.io/t/k8s-identity-lab-openid-connect-rbac-and-podsecuritypolicies/8907 "2019-12-03T14:15:32Z")
We recently hosted a training course on kubernetes identity management for the BSidesDC conference. Part of that course was a lab that walked students through the process of setting up OpenID Connect, enabling RBAC and a… --- ## [Using GitHub to Manage Access for Kubernetes](https://discuss.kubernetes.io/t/using-github-to-manage-access-for-kubernetes/7231)
**Author:** [@marc.boorshtein](https://discuss.kubernetes.io/u/marc.boorshtein)\ **Replies:** 0\ **Last updated:** [July 22, 2019, 10:15am UTC](https://discuss.kubernetes.io/t/using-github-to-manage-access-for-kubernetes/7231 "2019-07-22T10:15:48Z")
In our latest blog post I walk through our new Orchestra Login Portal with GitHub to use your GitHub organizations to authenticate access to your cluster and use GitHub teams to manage access via RBAC. https://www.tremo… --- ## [Add multi-factor authentication to Kubernetes with DUO and OpenUnison](https://discuss.kubernetes.io/t/add-multi-factor-authentication-to-kubernetes-with-duo-and-openunison/7145)
**Author:** [@marc.boorshtein](https://discuss.kubernetes.io/u/marc.boorshtein)\ **Replies:** 0\ **Last updated:** [July 15, 2019, 10:02am UTC](https://discuss.kubernetes.io/t/add-multi-factor-authentication-to-kubernetes-with-duo-and-openunison/7145 "2019-07-15T10:02:32Z")
I put together a POC integration of Kuberentes with DUO’s multi-factor solution using OpenUnison - https://www.tremolosecurity.com/multi-factor-authentication-for-kubernetes-with-duo-security/ and a video - https://vimeo… --- ## [Kubernetes Security Myths Debunked](https://discuss.kubernetes.io/t/kubernetes-security-myths-debunked/6909)
**Author:** [@marc.boorshtein](https://discuss.kubernetes.io/u/marc.boorshtein)\ **Replies:** 0\ **Last updated:** [June 24, 2019, 12:58pm UTC](https://discuss.kubernetes.io/t/kubernetes-security-myths-debunked/6909 "2019-06-24T12:58:47Z")
I have lots of discussions with folks about different aspects of k8s security. I took some time to talk about several of the myths I hear - https://www.tremolosecurity.com/kubernetes-security-myths-debunked/ . Would be … --- ## [Limit GitHub authentication](https://discuss.kubernetes.io/t/limit-github-authentication/6294)
**Author:** [@marc.boorshtein](https://discuss.kubernetes.io/u/marc.boorshtein)\ **Replies:** 0\ **Last updated:** [May 12, 2019, 12:43pm UTC](https://discuss.kubernetes.io/t/limit-github-authentication/6294 "2019-05-12T12:43:17Z")
If you’re using GitHub for authentication to your clusters, how are you limiting access to you GitHub organization? --- ## [Integrate Canonical Kubernetes (CDK) with Active Directory using OpenUnison](https://discuss.kubernetes.io/t/integrate-canonical-kubernetes-cdk-with-active-directory-using-openunison/3669)
**Author:** [@marc.boorshtein](https://discuss.kubernetes.io/u/marc.boorshtein)\ **Replies:** 1\ **Last updated:** [December 3, 2018, 5:11pm UTC](https://discuss.kubernetes.io/t/integrate-canonical-kubernetes-cdk-with-active-directory-using-openunison/3669 "2018-12-03T17:11:21Z")
We just published a blog on integrating the CDK with Active Directory using our open source project OpenUnison - https://www.tremolosecurity.com/kubernetes-and-active-directory-with-canonical/. We talk you through step-… --- ## [New Open Source Login Portal for Kubernetes](https://discuss.kubernetes.io/t/new-open-source-login-portal-for-kubernetes/3292)
**Author:** [@marc.boorshtein](https://discuss.kubernetes.io/u/marc.boorshtein)\ **Replies:** 0\ **Last updated:** [October 29, 2018, 1:17pm UTC](https://discuss.kubernetes.io/t/new-open-source-login-portal-for-kubernetes/3292 "2018-10-29T13:17:32Z")
Tremolo Security has “pre” launched a new login portal for Kubernetes using Active Directory - https://github.com/OpenUnison/openunison-k8s-login-activedirectory. This portal lets users login to both the dashboard and k… --- ## [Kubernetes and OIDC](https://discuss.kubernetes.io/t/kubernetes-and-oidc/978)
**Author:** [@mrbobbytables](https://discuss.kubernetes.io/u/mrbobbytables)\ **Replies:** 2\ **Last updated:** [June 27, 2018, 8:51am UTC](https://discuss.kubernetes.io/t/kubernetes-and-oidc/978 "2018-06-27T08:51:26Z")
OIDC has been a bit of a topic lately and I figured it’d be worth it to start a discussion on the subject. :slight\_smile: It was featured on this week’s TGIK – Going over OIDC/OAuth2 in general along with hooking Kubern…