OpenID is writing sensitive client secret to log file

[myniva]

If your OpenShift installation has an OpenID Connect identity provider (see https://docs.openshift.org/3.6/install_config/configuring_authentication.html#OpenID) configured, the sensitive client_secret is written to the logs:

Feb 20 09:54:41 master-node origin-master[18966]: I0220 09:54:41.313861   18966 handler.go:66] Authentication needed for &{{oidc ... {<client_id> <!!!CLIENT_SECRET!!!> [openid] map[] https://idp.com/auth https://idp.com/token  [sub] [preferred_username] [email] [name] <nil>}} ... }

Sensitive information like passwords, secrets, keys should never be written in plain text to the log files of an application for security reasons.

Version

• openshift v3.6.1+008f2d5
• kubernetes v1.6.1+5115d708d7

Steps To Reproduce

1. Configure OpenID Connect
2. Try to authenticate with the newly configured identity provider

Current Result

Configured client secret is written in plain text to the logs of OpenShift.

Expected Result

The client secret must be

[jwforres]

@openshift/sig-security