diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md index 1ee8f543015..43a38e8d5b7 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md @@ -195,15 +195,4 @@ Try configuring and saving keycloak as your SAML provider and then accessing the ## Configuring SAML Single Logout (SLO) -Rancher supports the ability to configure SAML SLO. Options include logging out of the Rancher application only, logging out of Rancher and registered applications tied to the external authentication provider, or a prompt asking the user to choose between the previous options. The steps below outline configuration from the application GUI: - -1. Sign in to Rancher using a [standard user or an administrator role](../manage-role-based-access-control-rbac/global-permissions.md) to configure SAML SLO. -1. In the top left corner, click **☰ > Users & Authentication**. -1. In the left navigation menu, click **Auth Provider**. -1. Under the section **Log Out behavior**, choose the appropriate SLO setting as described below: - - | Setting | Description | - | ------------------------- | ----------------------------------------------------------------------------- | - | Log out of Rancher and not authentication provider | Choosing this option will only logout the Rancher application and not external authentication providers. | - | Log out of Rancher and authentication provider (includes all other applications registered with authentication provider) | Choosing this option will logout Rancher and all external authentication providers along with any registered applications linked to the provider. | - | Allow the user to choose one of the above in an additional log out step | Choosing this option presents users with a choice of logout method as described above. | + diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md index 6755ce3ebb6..0496237f385 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md @@ -111,15 +111,4 @@ If you experience issues when you test the connection to the OpenLDAP server, en ## Configuring SAML Single Logout (SLO) -Rancher supports the ability to configure SAML SLO. Options include logging out of the Rancher application only, logging out of Rancher and registered applications tied to the external authentication provider, or a prompt asking the user to choose between the previous options. The steps below outline configuration from the application GUI: - -1. Sign in to Rancher using a [standard user or an administrator role](../manage-role-based-access-control-rbac/global-permissions.md) to configure SAML SLO. -1. In the top left corner, click **☰ > Users & Authentication**. -1. In the left navigation menu, click **Auth Provider**. -1. Under the section **Log Out behavior**, choose the appropriate SLO setting as described below: - - | Setting | Description | - | ------------------------- | ----------------------------------------------------------------------------- | - | Log out of Rancher and not authentication provider | Choosing this option will only logout the Rancher application and not external authentication providers. | - | Log out of Rancher and authentication provider (includes all other applications registered with authentication provider) | Choosing this option will logout Rancher and all external authentication providers along with any registered applications linked to the provider. | - | Allow the user to choose one of the above in an additional log out step | Choosing this option presents users with a choice of logout method as described above. | + diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md index c3561aefae7..6a40e9343f2 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md @@ -67,15 +67,4 @@ Note that these URLs will not return valid data until the authentication configu ## Configuring SAML Single Logout (SLO) -Rancher supports the ability to configure SAML SLO. Options include logging out of the Rancher application only, logging out of Rancher and registered applications tied to the external authentication provider, or a prompt asking the user to choose between the previous options. The steps below outline configuration from the application GUI: - -1. Sign in to Rancher using a [standard user or an administrator role](../manage-role-based-access-control-rbac/global-permissions.md) to configure SAML SLO. -1. In the top left corner, click **☰ > Users & Authentication**. -1. In the left navigation menu, click **Auth Provider**. -1. Under the section **Log Out behavior**, choose the appropriate SLO setting as described below: - - | Setting | Description | - | ------------------------- | ----------------------------------------------------------------------------- | - | Log out of Rancher and not authentication provider | Choosing this option will only logout the Rancher application and not external authentication providers. | - | Log out of Rancher and authentication provider (includes all other applications registered with authentication provider) | Choosing this option will logout Rancher and all external authentication providers along with any registered applications linked to the provider. | - | Allow the user to choose one of the above in an additional log out step | Choosing this option presents users with a choice of logout method as described above. | + diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md index 492737803f5..b2785bd83f0 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md @@ -51,3 +51,7 @@ You can generate a certificate using an openssl command. For example: ``` openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com" ``` + +## Configuring SAML Single Logout (SLO) + + diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/configure-shibboleth-saml.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/configure-shibboleth-saml.md index a57f4882050..1480b024af9 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/configure-shibboleth-saml.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/configure-shibboleth-saml.md @@ -77,6 +77,10 @@ If you configure Shibboleth without OpenLDAP, the following caveats apply due to To enable searching for groups when assigning permissions in Rancher, you will need to configure a back end for the SAML provider that supports groups, such as OpenLDAP. +### Configuring SAML Single Logout (SLO) + + + ## Setting up OpenLDAP in Rancher If you also configure OpenLDAP as the back end to Shibboleth, it will return a SAML assertion to Rancher with user attributes that include groups. Then authenticated users will be able to access resources in Rancher that their groups have permissions for. diff --git a/shared-files/_configure-slo.md b/shared-files/_configure-slo.md new file mode 100644 index 00000000000..769bfe4d543 --- /dev/null +++ b/shared-files/_configure-slo.md @@ -0,0 +1,12 @@ +Rancher supports the ability to configure SAML SLO. Options include logging out of the Rancher application only, logging out of Rancher and registered applications tied to the external authentication provider, or a prompt asking the user to choose between the previous options. The steps below outline configuration from the application GUI: + +1. Sign in to Rancher using a standard user or an administrator role to configure SAML SLO. +1. In the top left corner, click **☰ > Users & Authentication**. +1. In the left navigation menu, click **Auth Provider**. +1. Under the section **Log Out behavior**, choose the appropriate SLO setting as described below: + + | Setting | Description | + | ------------------------- | ----------------------------------------------------------------------------- | + | Log out of Rancher and not authentication provider | Choosing this option will only logout the Rancher application and not external authentication providers. | + | Log out of Rancher and authentication provider (includes all other applications registered with authentication provider) | Choosing this option will logout Rancher and all external authentication providers along with any registered applications linked to the provider. | + | Allow the user to choose one of the above in an additional log out step | Choosing this option presents users with a choice of logout method as described above. | diff --git a/src/theme/MDXComponents.js b/src/theme/MDXComponents.js index b5ef8bfde0f..96351a57170 100644 --- a/src/theme/MDXComponents.js +++ b/src/theme/MDXComponents.js @@ -11,6 +11,7 @@ import DeprecationOPAGatekeeper from '/shared-files/_deprecation-opa-gatekeeper. import DeprecationWeave from '/shared-files/_deprecation-weave.md'; import DeprecationHelm2 from '/shared-files/_deprecation-helm2.md'; import DockerSupportWarning from '/shared-files/_docker-support-warning.md'; +import ConfigureSLO from '/shared-files/_configure-slo.md'; export default { // Re-use the default mapping @@ -23,6 +24,7 @@ export default { Card, CNIPopularityTable, + ConfigureSLO, DeprecationOPAGatekeeper, DeprecationWeave, DeprecationHelm2, diff --git a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md index 1ee8f543015..43a38e8d5b7 100644 --- a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md +++ b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md @@ -195,15 +195,4 @@ Try configuring and saving keycloak as your SAML provider and then accessing the ## Configuring SAML Single Logout (SLO) -Rancher supports the ability to configure SAML SLO. Options include logging out of the Rancher application only, logging out of Rancher and registered applications tied to the external authentication provider, or a prompt asking the user to choose between the previous options. The steps below outline configuration from the application GUI: - -1. Sign in to Rancher using a [standard user or an administrator role](../manage-role-based-access-control-rbac/global-permissions.md) to configure SAML SLO. -1. In the top left corner, click **☰ > Users & Authentication**. -1. In the left navigation menu, click **Auth Provider**. -1. Under the section **Log Out behavior**, choose the appropriate SLO setting as described below: - - | Setting | Description | - | ------------------------- | ----------------------------------------------------------------------------- | - | Log out of Rancher and not authentication provider | Choosing this option will only logout the Rancher application and not external authentication providers. | - | Log out of Rancher and authentication provider (includes all other applications registered with authentication provider) | Choosing this option will logout Rancher and all external authentication providers along with any registered applications linked to the provider. | - | Allow the user to choose one of the above in an additional log out step | Choosing this option presents users with a choice of logout method as described above. | + diff --git a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md index 6755ce3ebb6..0496237f385 100644 --- a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md +++ b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md @@ -111,15 +111,4 @@ If you experience issues when you test the connection to the OpenLDAP server, en ## Configuring SAML Single Logout (SLO) -Rancher supports the ability to configure SAML SLO. Options include logging out of the Rancher application only, logging out of Rancher and registered applications tied to the external authentication provider, or a prompt asking the user to choose between the previous options. The steps below outline configuration from the application GUI: - -1. Sign in to Rancher using a [standard user or an administrator role](../manage-role-based-access-control-rbac/global-permissions.md) to configure SAML SLO. -1. In the top left corner, click **☰ > Users & Authentication**. -1. In the left navigation menu, click **Auth Provider**. -1. Under the section **Log Out behavior**, choose the appropriate SLO setting as described below: - - | Setting | Description | - | ------------------------- | ----------------------------------------------------------------------------- | - | Log out of Rancher and not authentication provider | Choosing this option will only logout the Rancher application and not external authentication providers. | - | Log out of Rancher and authentication provider (includes all other applications registered with authentication provider) | Choosing this option will logout Rancher and all external authentication providers along with any registered applications linked to the provider. | - | Allow the user to choose one of the above in an additional log out step | Choosing this option presents users with a choice of logout method as described above. | + diff --git a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md index c3561aefae7..6a40e9343f2 100644 --- a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md +++ b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md @@ -67,15 +67,4 @@ Note that these URLs will not return valid data until the authentication configu ## Configuring SAML Single Logout (SLO) -Rancher supports the ability to configure SAML SLO. Options include logging out of the Rancher application only, logging out of Rancher and registered applications tied to the external authentication provider, or a prompt asking the user to choose between the previous options. The steps below outline configuration from the application GUI: - -1. Sign in to Rancher using a [standard user or an administrator role](../manage-role-based-access-control-rbac/global-permissions.md) to configure SAML SLO. -1. In the top left corner, click **☰ > Users & Authentication**. -1. In the left navigation menu, click **Auth Provider**. -1. Under the section **Log Out behavior**, choose the appropriate SLO setting as described below: - - | Setting | Description | - | ------------------------- | ----------------------------------------------------------------------------- | - | Log out of Rancher and not authentication provider | Choosing this option will only logout the Rancher application and not external authentication providers. | - | Log out of Rancher and authentication provider (includes all other applications registered with authentication provider) | Choosing this option will logout Rancher and all external authentication providers along with any registered applications linked to the provider. | - | Allow the user to choose one of the above in an additional log out step | Choosing this option presents users with a choice of logout method as described above. | + diff --git a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md index 492737803f5..b2785bd83f0 100644 --- a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md +++ b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md @@ -51,3 +51,7 @@ You can generate a certificate using an openssl command. For example: ``` openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com" ``` + +## Configuring SAML Single Logout (SLO) + + diff --git a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/configure-shibboleth-saml.md b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/configure-shibboleth-saml.md index a57f4882050..1480b024af9 100644 --- a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/configure-shibboleth-saml.md +++ b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/configure-shibboleth-saml.md @@ -77,6 +77,10 @@ If you configure Shibboleth without OpenLDAP, the following caveats apply due to To enable searching for groups when assigning permissions in Rancher, you will need to configure a back end for the SAML provider that supports groups, such as OpenLDAP. +### Configuring SAML Single Logout (SLO) + + + ## Setting up OpenLDAP in Rancher If you also configure OpenLDAP as the back end to Shibboleth, it will return a SAML assertion to Rancher with user attributes that include groups. Then authenticated users will be able to access resources in Rancher that their groups have permissions for.