OIDC with Google WorkSpace

[imacq]

I'm trying to configure OAuth2 to use authentication with users from Google Workspace, but I got this error:

I just configured a Project from Google Workspace. But I have this problem.

What did I do wrong?

[dosubot[bot]]

¡Hola @imacq!

Soy un bot que puede ayudarte a solucionar errores, responder preguntas y convertirte en un colaborador. Estoy aquí para ayudarte mientras esperas a un mantenedor humano.

The "Error 401: invalid_client" typically indicates that there is an issue with the client ID or client secret configuration in your Google Cloud Console or in your Headlamp setup. Here are some steps to troubleshoot and resolve this issue:

1. Verify Client ID and Client Secret: Ensure that the client ID and client secret you have configured in Headlamp match exactly with those provided in the Google Cloud Console for your OAuth2 credentials.

2. Check OAuth2 Credentials: In the Google Cloud Console, navigate to the "APIs & Services" > "Credentials" section. Verify that the OAuth2 credentials are correctly set up and that you are using the correct client ID and client secret.

3. Authorized Redirect URIs: Make sure that the redirect URI configured in the Google Cloud Console matches the callback URL used by Headlamp. The callback URL should be your Headlamp URL followed by /oidc-callback, e.g., https://YOUR_URL/oidc-callback.

4. Enable APIs: Ensure that the necessary APIs, such as the "Google+ API" or "People API," are enabled in the Google Cloud Console.

5. Check for Typos: Double-check for any typos or incorrect entries in both the Google Cloud Console and your Headlamp configuration.

6. Configuration in Headlamp: Ensure that the OIDC settings in Headlamp are correctly defined. You can configure these settings in the config section under the oidc property or use command-line arguments or environment variables ^[1][2].

By following these steps, you should be able to identify and resolve the issue causing the "Error 401: invalid_client" error.

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}

[imacq]

I get it but now I got this problem:

• nodes.metrics.k8s.io is forbidden: User "system:anonymous" cannot list resource "nodes" in API group "metrics.k8s.io" at the cluster scope

--

events is forbidden: User "system:anonymous" cannot list resource "events" in API group "" at the cluster scope

I just created the user and clusterRole with the clusterRoleBinding. But this error still happening.

@dosu