Plugin: OpenShift OAuth Auth (Shared)

[bobbyjohnstx]

Summary

Shared authentication plugin providing OpenShift OAuth for all Red Hat product plugins. Authenticate once, all RH plugins reuse the token.

Plugin Details

• Red Hat products: All OpenShift-hosted products (RHOAI, RHACS, Quay, RHDH, Tekton, ACM)
• Plugin hooks: auth
• Complexity: Low-Medium
• Priority: 6 (Foundational — build alongside or before other OCP plugins)

Auth flow

• OAuth2 authorization code flow against the OpenShift OAuth server
• Browser-based login (opens OpenShift console login page)
• Token stored per-cluster with automatic refresh
• Exposes getToken(clusterUrl) for other plugins

Prompts

1. "OpenShift cluster URL" (text, placeholder: https://api.mycluster.example.com:6443)
2. "Authentication method" (select: "Browser login (OAuth)" / "API token (oc login)")
   • If API token: "Paste your token" (validate: starts with sha256~)

Token lifecycle

• OAuth tokens: auto-refresh via refresh token
• API tokens: no refresh, prompt user when expired
• Multiple clusters supported: tokens keyed by cluster URL

Why separate

Without this, each RH plugin (OCP, RHACS, Quay, RHDH, Tekton) implements its own OAuth flow. With this, the user authenticates once and every RH plugin works.

---

From: Red Hat Product Integration Plugin Ideas