From 50ca14309ab0c635e36c75a66d484e1e07a6a76f Mon Sep 17 00:00:00 2001 From: Max Sokolovsky Date: Thu, 2 Mar 2023 15:48:39 -0500 Subject: [PATCH] [2.6] Add notes about disabling an auth provider --- .../authentication-config.md | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/versioned_docs/version-2.6/pages-for-subheaders/authentication-config.md b/versioned_docs/version-2.6/pages-for-subheaders/authentication-config.md index c61ade4854d..a67bd206a64 100644 --- a/versioned_docs/version-2.6/pages-for-subheaders/authentication-config.md +++ b/versioned_docs/version-2.6/pages-for-subheaders/authentication-config.md @@ -109,3 +109,30 @@ If you need to reconfigure or disable then re-enable a provider that had been pr is logged in to Rancher as an external user, not the local admin. ::: + +## Disabling An Auth Provider + +When you disable an auth provider, Rancher deletes all resources associated with it, such as: +- Secrets +- Global role bindings +- Cluster role template bindings +- Project role template bindings +- External users associated with the provider, who never logged in as local users to Rancher + +As this operation may lead to a loss of many resources, you may want to add a safeguard on the provider. +To ensure this cleanup process doesn't run when the auth provider is disabled, add a special annoation to the corresponding auth config. + +For example, to add a safeguard to the Azure AD provider, annotate the `azuread` authconfig object: + +`kubectl annotate --overwrite authconfig azuread management.cattle.io/auth-provider-cleanup='user-locked'` + +Rancher won't perform cleanup until you set the annotation to `unlocked`. + +### Running Resource Cleanup Manually + +Rancher might retain resources from a disabled auth provider configuration in the local cluster, even after you configure another auth provider. +For example, if you used Provider A, then disabled it and started using Provider B, when you upgrade to a new version of Rancher, +you can manually trigger cleanup on resources configured by Provider A. + +To manually trigger cleanup for a disabled auth provider, add the `management.cattle.io/auth-provider-cleanup` annotation with the `unlocked` value +to its auth config.