deploy: 3ae30045a0

pages-for-subheaders/authentication-config.html

@@ -16,7 +16,7 @@
 <script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" charset="UTF-8" data-domain-script="0f98beb0-fc4c-417d-a42e-564e2cae42d2" async></script>
 <script src="/scripts/optanonwrapper.js" async></script><link rel="stylesheet" href="/assets/css/styles.bc15fa9c.css">
 <link rel="preload" href="/assets/js/runtime~main.3bc0c29e.js" as="script">
-<link rel="preload" href="/assets/js/main.690c049a.js" as="script">
+<link rel="preload" href="/assets/js/main.d52c101c.js" as="script">
 </head>
 <body class="navigation-with-keyboard">
 <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-57KS2MW" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
@@ -26,6 +26,6 @@
 <div role="region" aria-label="Skip to main content"><a class="skipToContent_fXgn" href="#__docusaurus_skipToContent_fallback">Skip to main content</a></div><nav aria-label="Main" class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Toggle navigation bar" aria-expanded="false" class="navbar__toggle clean-btn" type="button"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/"><div class="navbar__logo"><img src="/img/rancher-logo-horiz-color.svg" alt="logo" class="themedImage_ToTc themedImage--light_HNdA"><img src="/img/rancher-logo-horiz-color.svg" alt="logo" class="themedImage_ToTc themedImage--dark_i4oU"></div><b class="navbar__title text--truncate"></b></a><div class="navbar__item dropdown dropdown--hoverable"><a aria-current="page" class="navbar__link active" aria-haspopup="true" aria-expanded="false" role="button" href="/">Latest</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/pages-for-subheaders/authentication-config">Latest</a></li><li><a class="dropdown__link" href="/v2.8/pages-for-subheaders/authentication-config">v2.8 (Preview)</a></li><li><a class="dropdown__link" href="/v2.7/pages-for-subheaders/authentication-config">v2.7</a></li><li><a class="dropdown__link" href="/v2.6/pages-for-subheaders/authentication-config">v2.6</a></li><li><a class="dropdown__link" href="/v2.5/pages-for-subheaders/authentication-config">v2.5</a></li><li><a class="dropdown__link" href="/v2.0-v2.4/pages-for-subheaders/authentication-config">v2.0-v2.4</a></li><li><a class="dropdown__link" href="/versions">All versions</a></li></ul></div></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a href="#" aria-haspopup="true" aria-expanded="false" role="button" class="navbar__link"><svg viewBox="0 0 24 24" width="20" height="20" aria-hidden="true" class="iconLanguage_nlXk"><path fill="currentColor" d="M12.87 15.07l-2.54-2.51.03-.03c1.74-1.94 2.98-4.17 3.71-6.53H17V4h-7V2H8v2H1v1.99h11.17C11.5 7.92 10.44 9.75 9 11.35 8.07 10.32 7.3 9.19 6.69 8h-2c.73 1.63 1.73 3.17 2.98 4.56l-5.09 5.02L4 19l5-5 3.11 3.11.76-2.04zM18.5 10h-2L12 22h2l1.12-3h4.75L21 22h2l-4.5-12zm-2.62 7l1.62-4.33L19.12 17h-3.24z"></path></svg>English</a><ul class="dropdown__menu"><li><a href="/pages-for-subheaders/authentication-config" target="_self" rel="noopener noreferrer" class="dropdown__link dropdown__link--active" lang="en">English</a></li><li><a href="/zh/pages-for-subheaders/authentication-config" target="_self" rel="noopener noreferrer" class="dropdown__link" lang="zh">简体中文</a></li></ul></div><a href="https://github.com/rancher/rancher-docs" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link navbar__github">GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a><a href="https://www.rancher.com" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">Rancher Home<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a><div class="searchBox_ZlJk"><button type="button" class="DocSearch DocSearch-Button" aria-label="Search"><span class="DocSearch-Button-Container"><svg width="20" height="20" class="DocSearch-Search-Icon" viewBox="0 0 20 20"><path d="M14.386 14.386l4.0877 4.0877-4.0877-4.0877c-2.9418 2.9419-7.7115 2.9419-10.6533 0-2.9419-2.9418-2.9419-7.7115 0-10.6533 2.9418-2.9419 7.7115-2.9419 10.6533 0 2.9419 2.9418 2.9419 7.7115 0 10.6533z" stroke="currentColor" fill="none" fill-rule="evenodd" stroke-linecap="round" stroke-linejoin="round"></path></svg><span class="DocSearch-Button-Placeholder">Search</span></span><span class="DocSearch-Button-Keys"></span></button></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div id="__docusaurus_skipToContent_fallback" class="main-wrapper mainWrapper_z2l0 docsWrapper_BCFX"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_sjWU" type="button"></button><div class="docPage__5DB"><aside class="theme-doc-sidebar-container docSidebarContainer_b6E3"><div class="sidebarViewport_Xe31"><div class="sidebar_njMd"><nav aria-label="Docs sidebar" class="menu thin-scrollbar menu_SIkG"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"Line truncated
 is logged in to Rancher as an external user, not the local admin.</p></div></div><h2 class="anchor anchorWithStickyNavbar_LWe7" id="disabling-an-auth-provider">Disabling An Auth Provider<a href="#disabling-an-auth-provider" class="hash-link" aria-label="Direct link to Disabling An Auth Provider" title="Direct link to Disabling An Auth Provider">​</a></h2><p>When you disable an auth provider, Rancher deletes all resources associated with it, such as:</p><ul><li>Secrets.</li><li>Global role bindings.</li><li>Cluster role template bindings.</li><li>Project role template bindings.</li><li>External users associated with the provider, but who never logged in as local users to Rancher.</li></ul><p>As this operation may lead to a loss of many resources, you may want to add a safeguard on the provider. To ensure that this cleanup process doesn&#x27;t run when the auth provider is disabled, add a special annotation to the corresponding auth config.</p><p>For example, to add a safeguard to the Azure AD provider, annotate the <code>azuread</code> authconfig object:</p><p><code>kubectl annotate --overwrite authconfig azuread management.cattle.io/auth-provider-cleanup=&#x27;user-locked&#x27;</code></p><p>Rancher won&#x27;t perform cleanup until you set the annotation to <code>unlocked</code>.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="running-resource-cleanup-manually">Running Resource Cleanup Manually<a href="#running-resource-cleanup-manually" class="hash-link" aria-label="Direct link to Running Resource Cleanup Manually" title="Direct link to Running Resource Cleanup Manually">​</a></h3><p>Rancher might retain resources from a previously disabled auth provider configuration in the local cluster, even after you configure another auth provider. For example, if you used Provider A, then disabled it and started using Provider B, when you upgrade to a new version of Rancher, you can manually trigger cleanup on resources configured by Provider A.</p><p>To manually trigger cleanup for a disabled auth provider, add the <code>management.cattle.io/auth-provider-cleanup</code> annotation with the <code>unlocked</code> value to its auth config.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/rancher/rancher-docs/edit/main/docs/pages-for-subheaders/authentication-config.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_Z9Sw" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_vwxv"><span class="theme-last-updated">Last updated<!-- --> on <b><time datetime="2023-08-15T19:24:51.000Z">Aug 15, 2023</time></b></span></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages"><a class="pagination-nav__link pagination-nav__link--prev" href="/pages-for-subheaders/authentication-permissions-and-global-configuration"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Authentication, Permissions and Global Settings</div></a><a class="pagination-nav__link pagination-nav__link--next" href="/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/manage-users-and-groups"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Users and Groups</div></a></nav></div></div><div class="col col--3"><div class="tableOfContents_bqdL thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#external-vs-local-authentication" class="table-of-contents__link toc-highlight">External vs. Local Authentication</a></li><li><a href="#users-and-groups" class="table-of-contents__link toc-highlight">Users and Groups</a></li><li><a href="#scope-of-rancher-authorization" class="table-of-contents__link toc-highlight">Scope of Rancher Authorization</a></li><li><a href="#external-authentication-configuration-and-principal-users" class="table-of-contents__link toc-highlight">External Authentication Configuration and Principal Users</a></li><li><a href="#disabling-an-auth-provider" class="table-of-contents__link toc-highlight">Disabling An Auth Provider</a><ul><li><a href="#running-resource-cleanup-manually" class="table-of-contents__link toc-highlight">Running Resource Cleanup Manually</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2023 SUSE Rancher. All Rights Reserved.</div></div></div></footer></div>
 <script src="/assets/js/runtime~main.3bc0c29e.js"></script>
-<script src="/assets/js/main.690c049a.js"></script>
+<script src="/assets/js/main.d52c101c.js"></script>
 </body>
 </html>