Skip to content

bug: gateway add defaults to Cloudflare edge-auth for HTTPS endpoints — no fallback or guidance for non-CF deployments #2057

Description

@akram

Description

When registering a gateway with an https:// endpoint, the CLI defaults to the Cloudflare Access edge-auth flow — opening a browser to /auth/connect and waiting for a CF_Authorization cookie. Without Cloudflare Access in front of the gateway, this hangs indefinitely with an "Authenticating..." spinner and times out after 120 seconds with no actionable guidance.

The CLI supports OIDC authentication via --oidc-issuer, which works correctly, but:

  1. There is no indication that the edge-auth flow requires Cloudflare Access specifically
  2. When the flow fails (no CF cookie arrives), the timeout message doesn't suggest alternatives
  3. The user must already know about --oidc-issuer to use OIDC — it's not discoverable from the failure path

Steps to Reproduce

  1. Deploy the gateway on any Kubernetes cluster without Cloudflare Access (OpenShift, GKE, EKS, k3d...)
  2. Configure OIDC on the gateway (e.g., Keycloak)
  3. Run openshell gateway add https://<endpoint> --gateway-insecure

Expected: Either auto-detect the gateway's auth mode, or fail fast with a message like:

Edge authentication requires Cloudflare Access. If your gateway uses OIDC, re-run with:
  openshell gateway add <endpoint> --oidc-issuer <issuer-url>

Actual: Browser opens to /auth/connect, shows "Authenticating..." spinner for 120 seconds, then:

⚠ Authentication skipped: authentication timed out after 120 seconds.
Try again with: openshell gateway login

Re-running gateway login produces the same result.

Root Cause

The /auth/connect handler (crates/openshell-server/src/auth/http.rs:87-141) checks for a CF_Authorization cookie. Without Cloudflare, the cookie never arrives, and the page polls via <meta http-equiv="refresh"> indefinitely. The CLI has no way to distinguish "Cloudflare is slow" from "Cloudflare isn't there."

Working OIDC Flow

OIDC works correctly when the user knows to pass the flag:

openshell gateway add https://<endpoint> --gateway-insecure \
  --oidc-issuer https://keycloak.example.com/realms/openshell \
  --oidc-client-id openshell-cli

This opens the Keycloak login page, authenticates via PKCE, and stores the token. The issue is purely about discoverability and the default behavior for HTTPS endpoints.

Proposed Improvements

1. Auto-detect auth mode (ideal)

The gateway already exposes its OIDC config at startup. The CLI could query a metadata/health endpoint during gateway add to detect whether the gateway has OIDC configured, and automatically use the OIDC flow instead of the CF edge-auth flow.

2. Fail fast with guidance (minimal)

If the /auth/connect page doesn't receive a CF_Authorization cookie within ~10 seconds, the server could return an error page instead of polling forever:

Authentication requires an edge proxy (e.g., Cloudflare Access).
If your gateway uses OIDC, register with:
  openshell gateway add <endpoint> --oidc-issuer <url>

3. Documentation (immediate)

Update the Kubernetes/OpenShift deployment docs to show the OIDC flow as the primary auth method for direct deployments, and clarify that the default HTTPS browser flow is designed for Cloudflare Access only.

Environment

  • Tested on OpenShift 4.21.3 (ROSA HCP) with passthrough route + Keycloak OIDC
  • OpenShell gateway v0.0.70 chart, CLI v0.0.45
  • OIDC flow works correctly once --oidc-issuer is passed

Related

Metadata

Metadata

Assignees

No one assigned

    Labels

    state:triage-neededOpened without agent diagnostics and needs triage

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions