From ea4b542e49775f6f1601968f79f47b26df5e0296 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Mon, 12 Jan 2026 15:02:56 -0800 Subject: [PATCH 1/5] Bump copyright year --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index f0eba103494..76e24480b81 100644 --- a/README.md +++ b/README.md @@ -93,7 +93,7 @@ Subsequent executions will check for updated dependencies, if there are none, it License ======= -Copyright (c) 2014-2025 [SUSE, LLC.](https://www.suse.com/) +Copyright (c) 2014-2026 [SUSE, LLC.](https://www.suse.com/) Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. From c13e9c7023efc9a8a96c7c32caf9fd026852ab6c Mon Sep 17 00:00:00 2001 From: Alex Seymour Date: Tue, 2 Dec 2025 14:01:41 +0100 Subject: [PATCH 2/5] Clarify JSON array format for OIDC groups and full_group_path claims Clarify JSON array format for OIDC groups and full_group_path claims, after a recent case where an issue occurred as a result of the groups claim formatted as a comma-separated string --- .../authentication-config/configure-generic-oidc.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md index ed3b5ed0b39..4b9685729d0 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md @@ -35,6 +35,12 @@ In your IdP, create a new client with the settings below: In the new OIDC client, create mappers to expose the user's fields. +:::note + +The `groups` and `full_group_path` claims generated by the Groups and Group Path mappers, which you create within the OIDC client in your Identity Provider, should be JSON arrays, e.g. `"groups":["admins","devs","qa"]` and `"full_group_path":["/admins","/devs","/qa"]`. + +::: + 1. Create a new `Groups Mapper` with the settings below: Setting | Value @@ -153,4 +159,4 @@ In some cases, the "Invalid grant_type" error message may be misleading and is a ## Configuring OIDC Single Logout (SLO) - \ No newline at end of file + From 50a89fceeaf95ffb66e02079c1b08da41dd88ba8 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Tue, 13 Jan 2026 15:22:44 -0800 Subject: [PATCH 3/5] Apply to other versions --- .../authentication-config/configure-generic-oidc.md | 9 ++++++++- .../authentication-config/configure-generic-oidc.md | 9 ++++++++- .../authentication-config/configure-generic-oidc.md | 9 ++++++++- .../authentication-config/configure-generic-oidc.md | 6 ++++++ .../authentication-config/configure-generic-oidc.md | 9 ++++++++- 5 files changed, 38 insertions(+), 4 deletions(-) diff --git a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md index e0d2577e5ff..6273008d03a 100644 --- a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md +++ b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md @@ -29,7 +29,14 @@ Consult the documentation for your specific IdP to complete the listed prerequis `Access Type` | `confidential` `Valid Redirect URI` | `https://yourRancherHostURL/verify-auth` - - In the new OIDC client, create mappers to expose the users fields. + - In the new OIDC client, create mappers to expose the user's fields. + + :::note + + The `groups` and `full_group_path` claims generated by the Groups and Group Path mappers, which you create within the OIDC client in your Identity Provider, should be JSON arrays, e.g. `"groups":["admins","devs","qa"]` and `"full_group_path":["/admins","/devs","/qa"]`. + + ::: + - Create a new Groups Mapper with the settings below: Setting | Value diff --git a/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md b/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md index e0d2577e5ff..6273008d03a 100644 --- a/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md +++ b/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md @@ -29,7 +29,14 @@ Consult the documentation for your specific IdP to complete the listed prerequis `Access Type` | `confidential` `Valid Redirect URI` | `https://yourRancherHostURL/verify-auth` - - In the new OIDC client, create mappers to expose the users fields. + - In the new OIDC client, create mappers to expose the user's fields. + + :::note + + The `groups` and `full_group_path` claims generated by the Groups and Group Path mappers, which you create within the OIDC client in your Identity Provider, should be JSON arrays, e.g. `"groups":["admins","devs","qa"]` and `"full_group_path":["/admins","/devs","/qa"]`. + + ::: + - Create a new Groups Mapper with the settings below: Setting | Value diff --git a/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md b/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md index e0d2577e5ff..6273008d03a 100644 --- a/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md +++ b/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md @@ -29,7 +29,14 @@ Consult the documentation for your specific IdP to complete the listed prerequis `Access Type` | `confidential` `Valid Redirect URI` | `https://yourRancherHostURL/verify-auth` - - In the new OIDC client, create mappers to expose the users fields. + - In the new OIDC client, create mappers to expose the user's fields. + + :::note + + The `groups` and `full_group_path` claims generated by the Groups and Group Path mappers, which you create within the OIDC client in your Identity Provider, should be JSON arrays, e.g. `"groups":["admins","devs","qa"]` and `"full_group_path":["/admins","/devs","/qa"]`. + + ::: + - Create a new Groups Mapper with the settings below: Setting | Value diff --git a/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md b/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md index d8b8d0ab79a..4b9685729d0 100644 --- a/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md +++ b/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md @@ -35,6 +35,12 @@ In your IdP, create a new client with the settings below: In the new OIDC client, create mappers to expose the user's fields. +:::note + +The `groups` and `full_group_path` claims generated by the Groups and Group Path mappers, which you create within the OIDC client in your Identity Provider, should be JSON arrays, e.g. `"groups":["admins","devs","qa"]` and `"full_group_path":["/admins","/devs","/qa"]`. + +::: + 1. Create a new `Groups Mapper` with the settings below: Setting | Value diff --git a/versioned_docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md b/versioned_docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md index e0d2577e5ff..6273008d03a 100644 --- a/versioned_docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md +++ b/versioned_docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md @@ -29,7 +29,14 @@ Consult the documentation for your specific IdP to complete the listed prerequis `Access Type` | `confidential` `Valid Redirect URI` | `https://yourRancherHostURL/verify-auth` - - In the new OIDC client, create mappers to expose the users fields. + - In the new OIDC client, create mappers to expose the user's fields. + + :::note + + The `groups` and `full_group_path` claims generated by the Groups and Group Path mappers, which you create within the OIDC client in your Identity Provider, should be JSON arrays, e.g. `"groups":["admins","devs","qa"]` and `"full_group_path":["/admins","/devs","/qa"]`. + + ::: + - Create a new Groups Mapper with the settings below: Setting | Value From 493918ef4b0cfc5773f00e03c77a0c98cb6b0ed4 Mon Sep 17 00:00:00 2001 From: Guilherme Macedo Date: Tue, 13 Jan 2026 23:08:44 -0300 Subject: [PATCH 4/5] Add FOSSA scanning workflow Signed-off-by: Guilherme Macedo --- .github/workflows/fossa.yml | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 .github/workflows/fossa.yml diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml new file mode 100644 index 00000000000..a56851826c8 --- /dev/null +++ b/.github/workflows/fossa.yml @@ -0,0 +1,34 @@ +name: FOSSA Scanning + +on: + push: + branches: ["main", "master", "release/**"] + workflow_dispatch: + +permissions: + contents: read + id-token: write + +jobs: + fossa-scanning: + runs-on: ubuntu-latest + timeout-minutes: 30 + steps: + - name: Checkout + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6 + + # The FOSSA token is shared between all repos in Rancher's GH org. It can be + # used directly and there is no need to request specific access to EIO. + - name: Read FOSSA token + uses: rancher-eio/read-vault-secrets@main + with: + secrets: | + secret/data/github/org/rancher/fossa/push token | FOSSA_API_KEY_PUSH_ONLY + + - name: FOSSA scan + uses: fossas/fossa-action@main + with: + api-key: ${{ env.FOSSA_API_KEY_PUSH_ONLY }} + # Only runs the scan and do not provide/returns any results back to the + # pipeline. + run-tests: false From c5aac3c2eac4e8bd6f703fddddb7c945c17ba656 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Fri, 16 Jan 2026 13:10:12 -0800 Subject: [PATCH 5/5] Revert "Add FOSSA scanning workflow" --- .github/workflows/fossa.yml | 34 ---------------------------------- 1 file changed, 34 deletions(-) delete mode 100644 .github/workflows/fossa.yml diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml deleted file mode 100644 index a56851826c8..00000000000 --- a/.github/workflows/fossa.yml +++ /dev/null @@ -1,34 +0,0 @@ -name: FOSSA Scanning - -on: - push: - branches: ["main", "master", "release/**"] - workflow_dispatch: - -permissions: - contents: read - id-token: write - -jobs: - fossa-scanning: - runs-on: ubuntu-latest - timeout-minutes: 30 - steps: - - name: Checkout - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6 - - # The FOSSA token is shared between all repos in Rancher's GH org. It can be - # used directly and there is no need to request specific access to EIO. - - name: Read FOSSA token - uses: rancher-eio/read-vault-secrets@main - with: - secrets: | - secret/data/github/org/rancher/fossa/push token | FOSSA_API_KEY_PUSH_ONLY - - - name: FOSSA scan - uses: fossas/fossa-action@main - with: - api-key: ${{ env.FOSSA_API_KEY_PUSH_ONLY }} - # Only runs the scan and do not provide/returns any results back to the - # pipeline. - run-tests: false