mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-26 13:08:11 +00:00
Remove unneeded intermediate folders
This commit is contained in:
Billy Tat
+82
@@ -0,0 +1,82 @@
|
||||
---
|
||||
title: 1. Configuring Microsoft AD FS for Rancher
|
||||
weight: 1205
|
||||
---
|
||||
|
||||
Before configuring Rancher to support AD FS users, you must add Rancher as a [relying party trust](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/technical-reference/understanding-key-ad-fs-concepts) in AD FS.
|
||||
|
||||
1. Log into your AD server as an administrative user.
|
||||
|
||||
1. Open the **AD FS Management** console. Select **Add Relying Party Trust...** from the **Actions** menu and click **Start**.
|
||||
|
||||
{{< img "/img/rancher/adfs/adfs-overview.png" "">}}
|
||||
|
||||
1. Select **Enter data about the relying party manually** as the option for obtaining data about the relying party.
|
||||
|
||||
{{< img "/img/rancher/adfs/adfs-add-rpt-2.png" "">}}
|
||||
|
||||
1. Enter your desired **Display name** for your Relying Party Trust. For example, `Rancher`.
|
||||
|
||||
{{< img "/img/rancher/adfs/adfs-add-rpt-3.png" "">}}
|
||||
|
||||
1. Select **AD FS profile** as the configuration profile for your relying party trust.
|
||||
|
||||
{{< img "/img/rancher/adfs/adfs-add-rpt-4.png" "">}}
|
||||
|
||||
1. Leave the **optional token encryption certificate** empty, as Rancher AD FS will not be using one.
|
||||
|
||||
{{< img "/img/rancher/adfs/adfs-add-rpt-5.png" "">}}
|
||||
|
||||
1. Select **Enable support for the SAML 2.0 WebSSO protocol**
|
||||
and enter `https://<rancher-server>/v1-saml/adfs/saml/acs` for the service URL.
|
||||
|
||||
{{< img "/img/rancher/adfs/adfs-add-rpt-6.png" "">}}
|
||||
|
||||
1. Add `https://<rancher-server>/v1-saml/adfs/saml/metadata` as the **Relying party trust identifier**.
|
||||
|
||||
{{< img "/img/rancher/adfs/adfs-add-rpt-7.png" "">}}
|
||||
|
||||
1. This tutorial will not cover multi-factor authentication; please refer to the [Microsoft documentation](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs) if you would like to configure multi-factor authentication.
|
||||
|
||||
{{< img "/img/rancher/adfs/adfs-add-rpt-8.png" "">}}
|
||||
|
||||
1. From **Choose Issuance Authorization RUles**, you may select either of the options available according to use case. However, for the purposes of this guide, select **Permit all users to access this relying party**.
|
||||
|
||||
{{< img "/img/rancher/adfs/adfs-add-rpt-9.png" "">}}
|
||||
|
||||
1. After reviewing your settings, select **Next** to add the relying party trust.
|
||||
|
||||
{{< img "/img/rancher/adfs/adfs-add-rpt-10.png" "">}}
|
||||
|
||||
|
||||
1. Select **Open the Edit Claim Rules...** and click **Close**.
|
||||
|
||||
{{< img "/img/rancher/adfs/adfs-add-rpt-11.png" "">}}
|
||||
|
||||
1. On the **Issuance Transform Rules** tab, click **Add Rule...**.
|
||||
|
||||
{{< img "/img/rancher/adfs/adfs-edit-cr.png" "">}}
|
||||
|
||||
1. Select **Send LDAP Attributes as Claims** as the **Claim rule template**.
|
||||
|
||||
{{< img "/img/rancher/adfs/adfs-add-tcr-1.png" "">}}
|
||||
|
||||
1. Set the **Claim rule name** to your desired name (for example, `Rancher Attributes`) and select **Active Directory** as the **Attribute store**. Create the following mapping to reflect the table below:
|
||||
|
||||
| LDAP Attribute | Outgoing Claim Type |
|
||||
| -------------------------------------------- | ------------------- |
|
||||
| Given-Name | Given Name |
|
||||
| User-Principal-Name | UPN |
|
||||
| Token-Groups - Qualified by Long Domain Name | Group |
|
||||
| SAM-Account-Name | Name |
|
||||
<br/>
|
||||
{{< img "/img/rancher/adfs/adfs-add-tcr-2.png" "">}}
|
||||
|
||||
1. Download the `federationmetadata.xml` from your AD server at:
|
||||
```
|
||||
https://<AD_SERVER>/federationmetadata/2007-06/federationmetadata.xml
|
||||
```
|
||||
|
||||
**Result:** You've added Rancher as a relying trust party. Now you can configure Rancher to leverage AD.
|
||||
|
||||
### [Next: Configuring Rancher for Microsoft AD FS]({{<baseurl>}}/rancher/v2.0-v2.4/en/admin-settings/authentication/microsoft-adfs/rancher-adfs-setup/)
|
||||
+31
@@ -0,0 +1,31 @@
|
||||
---
|
||||
title: Configuring Microsoft Active Directory Federation Service (SAML)
|
||||
weight: 1205
|
||||
---
|
||||
_Available as of v2.0.7_
|
||||
|
||||
If your organization uses Microsoft Active Directory Federation Services (AD FS) for user authentication, you can configure Rancher to allow your users to log in using their AD FS credentials.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
You must have Rancher installed.
|
||||
|
||||
- Obtain your Rancher Server URL. During AD FS configuration, substitute this URL for the `<RANCHER_SERVER>` placeholder.
|
||||
- You must have a global administrator account on your Rancher installation.
|
||||
|
||||
You must have a [Microsoft AD FS Server](https://docs.microsoft.com/en-us/windows-server/identity/active-directory-federation-services) configured.
|
||||
|
||||
- Obtain your AD FS Server IP/DNS name. During AD FS configuration, substitute this IP/DNS name for the `<AD_SERVER>` placeholder.
|
||||
- You must have access to add [Relying Party Trusts](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/create-a-relying-party-trust) on your AD FS Server.
|
||||
|
||||
## Setup Outline
|
||||
|
||||
Setting up Microsoft AD FS with Rancher Server requires configuring AD FS on your Active Directory server, and configuring Rancher to utilize your AD FS server. The following pages serve as guides for setting up Microsoft AD FS authentication on your Rancher installation.
|
||||
|
||||
- [1. Configuring Microsoft AD FS for Rancher]({{<baseurl>}}/rancher/v2.0-v2.4/en/admin-settings/authentication/microsoft-adfs/microsoft-adfs-setup)
|
||||
- [2. Configuring Rancher for Microsoft AD FS]({{<baseurl>}}/rancher/v2.0-v2.4/en/admin-settings/authentication/microsoft-adfs/rancher-adfs-setup)
|
||||
|
||||
{{< saml_caveats >}}
|
||||
|
||||
|
||||
### [Next: Configuring Microsoft AD FS for Rancher]({{<baseurl>}}/rancher/v2.0-v2.4/en/admin-settings/authentication/microsoft-adfs/microsoft-adfs-setup)
|
||||
+56
@@ -0,0 +1,56 @@
|
||||
---
|
||||
title: 2. Configuring Rancher for Microsoft AD FS
|
||||
weight: 1205
|
||||
---
|
||||
_Available as of v2.0.7_
|
||||
|
||||
After you complete [Configuring Microsoft AD FS for Rancher]({{<baseurl>}}/rancher/v2.0-v2.4/en/admin-settings/authentication/microsoft-adfs/microsoft-adfs-setup/), enter your AD FS information into Rancher to allow AD FS users to authenticate with Rancher.
|
||||
|
||||
>**Important Notes For Configuring Your AD FS Server:**
|
||||
>
|
||||
>- The SAML 2.0 WebSSO Protocol Service URL is: `https://<RANCHER_SERVER>/v1-saml/adfs/saml/acs`
|
||||
>- The Relying Party Trust identifier URL is: `https://<RANCHER_SERVER>/v1-saml/adfs/saml/metadata`
|
||||
>- You must export the `federationmetadata.xml` file from your AD FS server. This can be found at: `https://<AD_SERVER>/federationmetadata/2007-06/federationmetadata.xml`
|
||||
|
||||
|
||||
1. From the **Global** view, select **Security > Authentication** from the main menu.
|
||||
|
||||
1. Select **Microsoft Active Directory Federation Services**.
|
||||
|
||||
1. Complete the **Configure AD FS Account** form. Microsoft AD FS lets you specify an existing Active Directory (AD) server. The [configuration section below](#configuration) describe how you can map AD attributes to fields within Rancher.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
1. After you complete the **Configure AD FS Account** form, click **Authenticate with AD FS**, which is at the bottom of the page.
|
||||
|
||||
Rancher redirects you to the AD FS login page. Enter credentials that authenticate with Microsoft AD FS to validate your Rancher AD FS configuration.
|
||||
|
||||
>**Note:** You may have to disable your popup blocker to see the AD FS login page.
|
||||
|
||||
**Result:** Rancher is configured to work with MS FS. Your users can now sign into Rancher using their MS FS logins.
|
||||
|
||||
# Configuration
|
||||
|
||||
| Field | Description |
|
||||
|---------------------------|-----------------|
|
||||
| Display Name Field | The AD attribute that contains the display name of users. <br/><br/>Example: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name` |
|
||||
| User Name Field | The AD attribute that contains the user name/given name. <br/><br/>Example: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname` |
|
||||
| UID Field | An AD attribute that is unique to every user. <br/><br/>Example: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn` |
|
||||
| Groups Field | Make entries for managing group memberships. <br/><br/>Example: `http://schemas.xmlsoap.org/claims/Group` |
|
||||
| Rancher API Host | The URL for your Rancher Server. |
|
||||
| Private Key / Certificate | This is a key-certificate pair to create a secure shell between Rancher and your AD FS. Ensure you set the Common Name (CN) to your Rancher Server URL.<br/><br/>[Certificate creation command](#cert-command) |
|
||||
| Metadata XML | The `federationmetadata.xml` file exported from your AD FS server. <br/><br/>You can find this file at `https://<AD_SERVER>/federationmetadata/2007-06/federationmetadata.xml`. |
|
||||
|
||||
|
||||
<a id="cert-command"></a>
|
||||
|
||||
**Tip:** You can generate a certificate using an openssl command. For example:
|
||||
|
||||
```
|
||||
openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
|
||||
```
|
||||
Reference in New Issue
Block a user