OCPBUGS-56892: Console can only show user name instead of full name as the display name #15522

Leo6Leo · 2025-09-22T17:50:06Z

Description

After logging in with Google OAuth OIDC, the Console can only show username instead of full name as the display name on the top right corner in the console.

Step to test out the changes

Have a cluster that configure the Google OIDC login. If you don't have one, you can follow the instructions I wrote in the Appendix which locates at the bottom of this PR description.
Choose Google-OpenID-Connect as your login option and login with your google account

After your success login, you will see on the right top corner is displaying your full name, instead of your email address.

Special Note

Thanks to @logonoff for the discussion on what would be the better way to resolve this issue.

Appendix: How to configure Google OAuth on your cluster for testing purpose

Prerequisites

Before you begin, you'll need:

Administrator access to your OpenShift cluster using the oc and kubectl CLI.
A Google Cloud project with an OAuth 2.0 Client ID and Client Secret created. If you need to create one, follow Google's official documentation.

Step 1: Create the Google Client Secret in OpenShift

First, create a k8s secret in the openshift-config namespace to securely store your Google OAuth client secret. This prevents storing sensitive values directly in the main cluster configuration.

Replace <your-google-client-secret> with the actual client secret from your Google Cloud project.

oc create secret generic google-secret \
  --from-literal=clientSecret=<your-google-client-secret> \
  -n openshift-config

Step 2: Configure the Cluster OAuth Identity Provider

Next, edit the cluster-wide OAuth configuration to add Google as an identity provider.

oc edit oauth cluster

Replace with the Client ID from your Google Cloud project.

spec:
  identityProviders:
  - name: Google                 # This is the name that will appear on the login page
    mappingMethod: claim
    type: OpenID
    openID:
      clientID: <your-google-client-id>
      clientSecret:
        name: google-secret      # The name of the secret you created in Step 1
      extraScopes:
      - email
      - profile
      issuer: https://accounts.google.com
      claims:
        preferredUsername:
        - email
        name:
        - name
        email:
        - email

Save and close the editor. Then wait until the authentication operator finish reconciling.

Step 3: Get the redirect_uri and Update Google Cloud

This is a crucial step. OpenShift generates a unique callback URL that Google needs to know about for security.

Open your OpenShift cluster's web console in a browser. You should now see the "Google" login option.
Click the Google login button. You will likely be redirected to a Google error page saying something like "Error 400: redirect_uri_mismatch". This is expected!
Copy the entire URL from your browser's address bar. Find the redirect_uri parameter within that URL. It will look something like this:
https://oauth-openshift.apps../oauth2callback/Google
Go to your project in the Google Cloud Console.
Navigate to your OAuth 2.0 Client ID.
Under the "Authorized redirect URIs" section, click "ADD URI" and paste the full redirect_uri you copied.
Click Save.
Login with your google account again and you will see it works!

…ation

…hook in telemetry and masthead components

… data retrieval and dispatch behavior

openshift-ci-robot · 2025-09-22T17:50:13Z

@Leo6Leo: This pull request references Jira Issue OCPBUGS-56892, which is invalid:

expected the bug to target the "4.21.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Description

After logging in with Google OAuth OIDC, the Console can only show username instead of full name as the display name on the top right corner in the console.

Step to test out the changes

Have a cluster that configure the Google OIDC login. If you don't have one, you can follow the instructions I wrote in the Appendix which locates at the bottom of this PR description.

Choose Google-OpenID-Connect as your login option and login with your google account

After your success login, you will see on the right top corner is displaying your full name, instead of your email address.

Special Note

Thanks to @logonoff for the discussion on what would be the better way to resolve this issue.

Appendix: How to configure Google OAuth on your cluster for testing purpose

Prerequisites

Before you begin, you'll need:

Administrator access to your OpenShift cluster using the oc and kubectl CLI.

A Google Cloud project with an OAuth 2.0 Client ID and Client Secret created. If you need to create one, follow Google's official documentation.

Step 1: Create the Google Client Secret in OpenShift

First, create a k8s secret in the openshift-config namespace to securely store your Google OAuth client secret. This prevents storing sensitive values directly in the main cluster configuration.

Replace <your-google-client-secret> with the actual client secret from your Google Cloud project.
oc create secret generic google-secret \
 --from-literal=clientSecret=<your-google-client-secret> \
 -n openshift-config
Step 2: Configure the Cluster OAuth Identity Provider

Next, edit the cluster-wide OAuth configuration to add Google as an identity provider.
oc edit oauth cluster
Replace with the Client ID from your Google Cloud project.
spec:
 identityProviders:
 - name: Google                 # This is the name that will appear on the login page
   mappingMethod: claim
   type: OpenID
   openID:
     clientID: <your-google-client-id>
     clientSecret:
       name: google-secret      # The name of the secret you created in Step 1
     extraScopes:
     - email
     - profile
     issuer: https://accounts.google.com
     claims:
       preferredUsername:
       - email
       name:
       - name
       email:
       - email
Save and close the editor. Then wait until the authentication operator finish reconciling.

Step 3: Get the redirect_uri and Update Google Cloud

This is a crucial step. OpenShift generates a unique callback URL that Google needs to know about for security.

Open your OpenShift cluster's web console in a browser. You should now see the "Google" login option.

Click the Google login button. You will likely be redirected to a Google error page saying something like "Error 400: redirect_uri_mismatch". This is expected!

Copy the entire URL from your browser's address bar. Find the redirect_uri parameter within that URL. It will look something like this:
https://oauth-openshift.apps../oauth2callback/Google

Go to your project in the Google Cloud Console.

Navigate to your OAuth 2.0 Client ID.

Under the "Authorized redirect URIs" section, click "ADD URI" and paste the full redirect_uri you copied.

Click Save.

Login with your google account again and you will see it works!

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Leo6Leo · 2025-09-22T17:53:20Z

/jira refresh
/label tide/merge-method-squash

openshift-ci-robot · 2025-09-22T17:53:28Z

@Leo6Leo: This pull request references Jira Issue OCPBUGS-56892, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.21.0) matches configured target version for branch (4.21.0)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @yanpzhan

In response to this:

/jira refresh
/label tide/merge-method-squash

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

…th fallbacks and add corresponding unit tests

openshift-ci-robot · 2025-09-22T18:14:36Z

@Leo6Leo: This pull request references Jira Issue OCPBUGS-56892, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.21.0) matches configured target version for branch (4.21.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @yanpzhan

In response to this:

Closes #13744

Description

After logging in with Google OAuth OIDC, the Console can only show username instead of full name as the display name on the top right corner in the console.

Step to test out the changes

Have a cluster that configure the Google OIDC login. If you don't have one, you can follow the instructions I wrote in the Appendix which locates at the bottom of this PR description.

Choose Google-OpenID-Connect as your login option and login with your google account

After your success login, you will see on the right top corner is displaying your full name, instead of your email address.

Special Note

Thanks to @logonoff for the discussion on what would be the better way to resolve this issue.

Appendix: How to configure Google OAuth on your cluster for testing purpose

Prerequisites

Before you begin, you'll need:

Administrator access to your OpenShift cluster using the oc and kubectl CLI.

A Google Cloud project with an OAuth 2.0 Client ID and Client Secret created. If you need to create one, follow Google's official documentation.

Step 1: Create the Google Client Secret in OpenShift

First, create a k8s secret in the openshift-config namespace to securely store your Google OAuth client secret. This prevents storing sensitive values directly in the main cluster configuration.

Replace <your-google-client-secret> with the actual client secret from your Google Cloud project.
oc create secret generic google-secret \
 --from-literal=clientSecret=<your-google-client-secret> \
 -n openshift-config
Step 2: Configure the Cluster OAuth Identity Provider

Next, edit the cluster-wide OAuth configuration to add Google as an identity provider.
oc edit oauth cluster
Replace with the Client ID from your Google Cloud project.
spec:
 identityProviders:
 - name: Google                 # This is the name that will appear on the login page
   mappingMethod: claim
   type: OpenID
   openID:
     clientID: <your-google-client-id>
     clientSecret:
       name: google-secret      # The name of the secret you created in Step 1
     extraScopes:
     - email
     - profile
     issuer: https://accounts.google.com
     claims:
       preferredUsername:
       - email
       name:
       - name
       email:
       - email
Save and close the editor. Then wait until the authentication operator finish reconciling.

Step 3: Get the redirect_uri and Update Google Cloud

This is a crucial step. OpenShift generates a unique callback URL that Google needs to know about for security.

Open your OpenShift cluster's web console in a browser. You should now see the "Google" login option.

Click the Google login button. You will likely be redirected to a Google error page saying something like "Error 400: redirect_uri_mismatch". This is expected!

Copy the entire URL from your browser's address bar. Find the redirect_uri parameter within that URL. It will look something like this:
https://oauth-openshift.apps../oauth2callback/Google

Go to your project in the Google Cloud Console.

Navigate to your OAuth 2.0 Client ID.

Under the "Authorized redirect URIs" section, click "ADD URI" and paste the full redirect_uri you copied.

Click Save.

Login with your google account again and you will see it works!

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Leo6Leo · 2025-09-22T18:21:56Z

/cc @logonoff @jhadvig

logonoff · 2025-09-22T18:23:15Z

frontend/public/components/masthead/masthead-toolbar.tsx

    const userToggle = (
      <span className="co-username" data-test="username">
-        {authEnabledFlag ? username : t('public~Auth disabled')}
+        {authEnabledFlag ? displayName || username || 'User' : t('public~Auth disabled')}


displayName will always return a value so i am not sure if we need the fallback values here

logonoff · 2025-09-22T18:23:24Z

frontend/packages/console-shared/src/hooks/useUser.ts

+      return currentUsername.trim();
+    }
+    // Final fallback for edge cases
+    return 'Unknown User';


should either add i18n or return null (to allow for fallback values to fallback)

frontend/packages/console-dynamic-plugin-sdk/src/app/redux-types.ts

frontend/packages/console-dynamic-plugin-sdk/src/app/core/reducers/coreSelectors.ts

Co-authored-by: logonoff <[email protected]>

Leo6Leo · 2025-09-23T19:28:32Z

/retest

logonoff

a comment regarding capitalization

frontend/packages/console-shared/src/hooks/useUser.ts

frontend/packages/console-shared/src/hooks/__tests__/useUser.spec.ts

Co-authored-by: logonoff <[email protected]>

frontend/public/locales/en/public.json

Co-authored-by: logonoff <[email protected]>

Leo6Leo · 2025-09-25T20:03:52Z

/retest

Leo6Leo · 2025-09-26T13:28:42Z

/retest

logonoff

/approve

Does this work / have to work with impersonation?

/cc @TheRealJon
I think you should also take a look as you're more familiar with the redux store

Leo6Leo · 2025-09-26T14:04:40Z

/approve

Does this work / have to work with impersonation?

/cc @TheRealJon I think you should also take a look as you're more familiar with the redux store

I don't think this will any impact with the impersonation, since the user will still be authenticated as the user they are logged in. Impersonation will show a banner at the top of the console, and it won't change the identify of the current logged in user.

Leo6Leo · 2025-09-29T13:52:19Z

/retest

frontend/packages/console-dynamic-plugin-sdk/src/app/core/actions/core.ts

…ons/core.ts Co-authored-by: logonoff <[email protected]>

logonoff · 2025-09-29T17:48:53Z

frontend/packages/console-dynamic-plugin-sdk/src/app/core/reducers/coreSelectors.ts


 type GetImpersonate = (state: SDKStoreState) => ImpersonateKind;
 type GetUser = (state: SDKStoreState) => UserInfo;
+type GetUserResource = (state: SDKStoreState) => any;


one more spot where we can remove the use of any

Updated, thanks for catching that @logonoff

…pe safety

logonoff

/lgtm

openshift-ci · 2025-09-29T17:56:26Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Leo6Leo, logonoff

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~frontend/OWNERS~~ [logonoff]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Leo6Leo · 2025-09-30T01:58:24Z

/retest

verify by
/assign @yapei

openshift-ci · 2025-09-30T14:28:32Z

@Leo6Leo: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/okd-scos-e2e-aws-ovn	`a8e3d23`	link	unknown	`/test okd-scos-e2e-aws-ovn`
ci/prow/frontend	`a8e3d23`	link	unknown	`/test frontend`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Leo6Leo added 5 commits September 22, 2025 12:17

fix: Update CoreState type to include userResource for k8s API integr…

0d84540

…ation

feat: Add userResource management to core actions and reducer

2c59766

feat: Introduce useUser hook for centralized user data management

e81d4fc

refactor: Replace direct user data fetching with centralized useUser …

308f1d7

…hook in telemetry and masthead components

test: auto generated the unit tests for useUser hook to validate user…

824bb98

… data retrieval and dispatch behavior

openshift-ci bot requested review from cajieh and TheRealJon September 22, 2025 17:51

openshift-ci bot added component/core Related to console core functionality component/sdk Related to console-plugin-sdk component/shared Related to console-shared labels Sep 22, 2025

openshift-ci bot added the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Sep 22, 2025

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Sep 22, 2025

openshift-ci bot requested a review from yanpzhan September 22, 2025 17:53

feat: Enhance useUser hook to provide robust display name handling wi…

2cbbed8

…th fallbacks and add corresponding unit tests

openshift-ci bot requested review from jhadvig and logonoff September 22, 2025 18:21

logonoff reviewed Sep 22, 2025

View reviewed changes

frontend/packages/console-dynamic-plugin-sdk/src/app/redux-types.ts Outdated Show resolved Hide resolved

frontend/packages/console-dynamic-plugin-sdk/src/app/core/reducers/coreSelectors.ts Outdated Show resolved Hide resolved

Leo6Leo and others added 2 commits September 22, 2025 14:34

fix: apply the review feedback

ccb1777

Apply suggestions from code review

aedb5b8

Co-authored-by: logonoff <[email protected]>

feat: run i18n

535a460

Leo6Leo requested a review from logonoff September 22, 2025 18:37

openshift-ci bot added the kind/i18n Indicates issue or PR relates to internationalization or has content that needs to be translated label Sep 22, 2025

feat: Add UserKind type import

009e7de

logonoff reviewed Sep 24, 2025

View reviewed changes

Apply suggestions from code review

acf30a3

Co-authored-by: logonoff <[email protected]>

Leo6Leo requested a review from logonoff September 25, 2025 18:52

logonoff reviewed Sep 25, 2025

View reviewed changes

frontend/public/locales/en/public.json Outdated Show resolved Hide resolved

Update frontend/public/locales/en/public.json

ad7479f

Co-authored-by: logonoff <[email protected]>

logonoff approved these changes Sep 26, 2025

View reviewed changes

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 26, 2025

logonoff reviewed Sep 29, 2025

View reviewed changes

frontend/packages/console-dynamic-plugin-sdk/src/app/core/actions/core.ts Outdated Show resolved Hide resolved

Leo6Leo and others added 2 commits September 29, 2025 09:57

Update frontend/packages/console-dynamic-plugin-sdk/src/app/core/acti…

b549dcc

…ons/core.ts Co-authored-by: logonoff <[email protected]>

feat: Import UserKind type in core actions

b004559

Leo6Leo requested a review from logonoff September 29, 2025 17:43

logonoff reviewed Sep 29, 2025

View reviewed changes

refactor: Update GetUserResource type to use UserKind for improved ty…

a8e3d23

…pe safety

Leo6Leo requested a review from logonoff September 29, 2025 17:52

logonoff approved these changes Sep 29, 2025

View reviewed changes

openshift-ci bot assigned logonoff Sep 29, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Sep 29, 2025

openshift-ci bot assigned yapei Sep 30, 2025

OCPBUGS-56892: Console can only show user name instead of full name as the display name #15522

Are you sure you want to change the base?

OCPBUGS-56892: Console can only show user name instead of full name as the display name #15522

Uh oh!

Conversation

Leo6Leo commented Sep 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Step to test out the changes

Special Note

Appendix: How to configure Google OAuth on your cluster for testing purpose

Prerequisites

Step 1: Create the Google Client Secret in OpenShift

Step 2: Configure the Cluster OAuth Identity Provider

Step 3: Get the redirect_uri and Update Google Cloud

Uh oh!

openshift-ci-robot commented Sep 22, 2025

Description

Step to test out the changes

Special Note

Appendix: How to configure Google OAuth on your cluster for testing purpose

Prerequisites

Step 1: Create the Google Client Secret in OpenShift

Step 2: Configure the Cluster OAuth Identity Provider

Step 3: Get the redirect_uri and Update Google Cloud

Uh oh!

Leo6Leo commented Sep 22, 2025

Uh oh!

openshift-ci-robot commented Sep 22, 2025

Uh oh!

openshift-ci-robot commented Sep 22, 2025

Description

Step to test out the changes

Special Note

Appendix: How to configure Google OAuth on your cluster for testing purpose

Prerequisites

Step 1: Create the Google Client Secret in OpenShift

Step 2: Configure the Cluster OAuth Identity Provider

Step 3: Get the redirect_uri and Update Google Cloud

Uh oh!

Leo6Leo commented Sep 22, 2025

Uh oh!

logonoff Sep 22, 2025

Choose a reason for hiding this comment

Uh oh!

logonoff Sep 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Leo6Leo commented Sep 23, 2025

Uh oh!

logonoff left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Leo6Leo commented Sep 25, 2025

Uh oh!

Leo6Leo commented Sep 26, 2025

Uh oh!

logonoff left a comment

Choose a reason for hiding this comment

Uh oh!

Leo6Leo commented Sep 26, 2025

Uh oh!

Leo6Leo commented Sep 29, 2025

Uh oh!

Uh oh!

logonoff Sep 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Leo6Leo Sep 29, 2025

Choose a reason for hiding this comment

Uh oh!

Leo6Leo commented Sep 22, 2025 •

edited

Loading

logonoff Sep 22, 2025 •

edited

Loading

logonoff Sep 29, 2025 •

edited

Loading