From e5b0f05f239392de9c9f51002d0d52f9042e6ea3 Mon Sep 17 00:00:00 2001 From: Mark Bishop Date: Wed, 5 Sep 2018 16:02:23 -0700 Subject: [PATCH 1/5] editing new keycloak docs --- .../admin-settings/authentication/_index.md | 1 + .../authentication/keycloak/_index.md | 49 +++++++++++++++++++ 2 files changed, 50 insertions(+) create mode 100644 content/rancher/v2.x/en/admin-settings/authentication/keycloak/_index.md diff --git a/content/rancher/v2.x/en/admin-settings/authentication/_index.md b/content/rancher/v2.x/en/admin-settings/authentication/_index.md index 82bf6ef41f6..d1b75b3f3d9 100644 --- a/content/rancher/v2.x/en/admin-settings/authentication/_index.md +++ b/content/rancher/v2.x/en/admin-settings/authentication/_index.md @@ -20,6 +20,7 @@ The Rancher authentication proxy integrates with the following external authenti - Microsoft Azure AD - GitHub - PingIdentity +- Keycloak - Microsoft AD FS - FreeIPA - OpenLDAP diff --git a/content/rancher/v2.x/en/admin-settings/authentication/keycloak/_index.md b/content/rancher/v2.x/en/admin-settings/authentication/keycloak/_index.md new file mode 100644 index 00000000000..d97c1031fb2 --- /dev/null +++ b/content/rancher/v2.x/en/admin-settings/authentication/keycloak/_index.md @@ -0,0 +1,49 @@ +--- +title: Configuring KeyCloak (SAML) +weight: 1200 +draft: true +--- +_Available as of v2.0.X_ + +If your organization uses KeyCloak Identity Provider (IdP) for user authentication, you can configure Rancher to allow your users to log in using their IdP credentials. + +>**Prerequisites:** +> +>- You must have a [KeyCloak IdP Server](https://www.keycloak.org/docs/3.2/server_installation/index.html) configured. +>- Export a `metadata.xml` file from your IdP Server. For more information, see the [KeyCloak documentation](https://www.keycloak.org/docs/3.2/server_admin/topics/clients/client-saml.html) to create a SAML Client, under Installation tab, you can find your metadata. + +1. From the **Global** view, select **Security > Authentication** from the main menu. + +1. Select **KeyCloak**. + +1. Complete the **Configure KeyCloak Account** form. KeyCloak IdP lets you specify what data store you want to use. You can either add a database or use an existing LDAP server. For example, if you select your Active Directory (AD) server, the examples below describe how you can map AD attributes to fields within Rancher. + + + | Column A | Column B | + | ------------------------- | ----------------------------------------------------------------------------- | + | Display Name Field | The AD attribute that contains the display name of users. | + | User Name Field | The AD attribute that contains the user name/given name. | + | UID Field | An AD attribute that is unique to every user. | + | Groups Field | Make entries for managing group memberships. | + | Rancher API Host | The URL for your Rancher Server. | + | Private Key / Certificate | A key-certificate pair to create a secure shell between Rancher and your IdP. | + | IDP-metadata | The `metadata.xml` file that you exported from your IdP server. | + + >**Tip:** You can generate one using an openssl command. For example: + > + > openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout myservice.key -out myservice.cert + + +1. After you complete the **Configure KeyCloak Account** form, click **Authenticate with KeyCloak**, which is at the bottom of the page. + + Rancher redirects you to the IdP login page. Enter credentials that authenticate with KeyCloak IdP to validate your Rancher KeyCloak configuration. + + >**Note:** You may have to disable your popup blocker to see the IdP login page. + +**Result:** Rancher is configured to work with KeyCloak. Your users can now sign into Rancher using their KeyCloak logins. + +>**KeyCloak Identity Provider Caveats:** +> +>- IdP does not support search or lookup. When adding users to [clusters]({{< baseurl >}}/rancher/v2.x/en/k8s-in-rancher/editing-clusters/) or [projects]({{< baseurl >}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/editing-projects/), the exact IDs must be entered correctly. +>- When adding users to [clusters]({{< baseurl >}}/rancher/v2.x/en/k8s-in-rancher/editing-clusters/) or [projects]({{< baseurl >}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/editing-projects/), group IDs are not supported unless the admin who turned on access control is a member of the group. +>- When adding a group that includes an admin to clusters or projects, add it from the drop-down rather than the search bar. If you add the group using the search bar, the group will not get added. \ No newline at end of file From c192ff38143fa662e10977e6575a4b7959683882 Mon Sep 17 00:00:00 2001 From: Mark Bishop Date: Fri, 7 Sep 2018 12:26:39 -0700 Subject: [PATCH 2/5] fixed typo and updated release label --- .../v2.x/en/admin-settings/authentication/keycloak/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/admin-settings/authentication/keycloak/_index.md b/content/rancher/v2.x/en/admin-settings/authentication/keycloak/_index.md index d97c1031fb2..7f15e6da45f 100644 --- a/content/rancher/v2.x/en/admin-settings/authentication/keycloak/_index.md +++ b/content/rancher/v2.x/en/admin-settings/authentication/keycloak/_index.md @@ -19,7 +19,7 @@ If your organization uses KeyCloak Identity Provider (IdP) for user authenticati 1. Complete the **Configure KeyCloak Account** form. KeyCloak IdP lets you specify what data store you want to use. You can either add a database or use an existing LDAP server. For example, if you select your Active Directory (AD) server, the examples below describe how you can map AD attributes to fields within Rancher. - | Column A | Column B | + | Field | Description | | ------------------------- | ----------------------------------------------------------------------------- | | Display Name Field | The AD attribute that contains the display name of users. | | User Name Field | The AD attribute that contains the user name/given name. | From 72ca1130e66cfb80085c1a30499e99f5bb1ec03a Mon Sep 17 00:00:00 2001 From: Mark Bishop Date: Fri, 7 Sep 2018 15:43:55 -0700 Subject: [PATCH 3/5] fixed release label --- .../v2.x/en/admin-settings/authentication/keycloak/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/admin-settings/authentication/keycloak/_index.md b/content/rancher/v2.x/en/admin-settings/authentication/keycloak/_index.md index 7f15e6da45f..852fa103bf2 100644 --- a/content/rancher/v2.x/en/admin-settings/authentication/keycloak/_index.md +++ b/content/rancher/v2.x/en/admin-settings/authentication/keycloak/_index.md @@ -3,7 +3,7 @@ title: Configuring KeyCloak (SAML) weight: 1200 draft: true --- -_Available as of v2.0.X_ +_Available as of v2.0.1_ If your organization uses KeyCloak Identity Provider (IdP) for user authentication, you can configure Rancher to allow your users to log in using their IdP credentials. From c4ebeaf1af38bc9b331db2153dd4a6feaa72c22c Mon Sep 17 00:00:00 2001 From: Mark Bishop <37810556+MBishop17@users.noreply.github.com> Date: Sun, 9 Sep 2018 14:29:33 -0700 Subject: [PATCH 4/5] Update _index.md Commenting out keycloak since it's still in draft form in another doc. --- content/rancher/v2.x/en/admin-settings/authentication/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/admin-settings/authentication/_index.md b/content/rancher/v2.x/en/admin-settings/authentication/_index.md index d1b75b3f3d9..9de71d0c99c 100644 --- a/content/rancher/v2.x/en/admin-settings/authentication/_index.md +++ b/content/rancher/v2.x/en/admin-settings/authentication/_index.md @@ -20,7 +20,7 @@ The Rancher authentication proxy integrates with the following external authenti - Microsoft Azure AD - GitHub - PingIdentity -- Keycloak + - Microsoft AD FS - FreeIPA - OpenLDAP From e804091a844c7a424f0ed0050cb444cd540ffeed Mon Sep 17 00:00:00 2001 From: Mark Bishop Date: Mon, 10 Sep 2018 09:46:43 -0700 Subject: [PATCH 5/5] fixing sentence in note that didn't make sense. --- .../v2.x/en/admin-settings/authentication/keycloak/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.x/en/admin-settings/authentication/keycloak/_index.md b/content/rancher/v2.x/en/admin-settings/authentication/keycloak/_index.md index 852fa103bf2..4b5817939ae 100644 --- a/content/rancher/v2.x/en/admin-settings/authentication/keycloak/_index.md +++ b/content/rancher/v2.x/en/admin-settings/authentication/keycloak/_index.md @@ -26,10 +26,10 @@ If your organization uses KeyCloak Identity Provider (IdP) for user authenticati | UID Field | An AD attribute that is unique to every user. | | Groups Field | Make entries for managing group memberships. | | Rancher API Host | The URL for your Rancher Server. | - | Private Key / Certificate | A key-certificate pair to create a secure shell between Rancher and your IdP. | + | Private Key / Certificate | A key/certificate pair to create a secure shell between Rancher and your IdP. | | IDP-metadata | The `metadata.xml` file that you exported from your IdP server. | - >**Tip:** You can generate one using an openssl command. For example: + >**Tip:** You can generate a key/certificate pair using an openssl command. For example: > > openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout myservice.key -out myservice.cert