UPSTREAM: <carry>: only patch authenticators when there's no webhook authenticators
@@ -189,13 +189,14 @@ func (config Config) New() (authenticator.Request, *spec.SecurityDefinitions, er
}
tokenAuthenticators = append(tokenAuthenticators, webhookTokenAuth)
- }
-
+ } else {
// openshift gets injected here as a separate token authenticator because we also add a special group to our oauth authorized
// tokens that allows us to recognize human users differently than machine users. The openAPI is always correct because we always
// configuration service account tokens, so we just have to create and add another authenticator.
// TODO make this a webhook authenticator and remove this patch.
+ // TODO - remove in 4.7, kept here not to disrupt authentication during 4.5->4.6 upgrade
tokenAuthenticators = AddOAuthServerAuthenticatorIfNeeded(tokenAuthenticators, config.APIAudiences)
+ }
if len(tokenAuthenticators) > 0 {
// Union the token authenticators
