From 76b5000730c70c79e17eafb40bdc9c2da890113d Mon Sep 17 00:00:00 2001 From: raul Date: Wed, 25 Jun 2025 11:31:06 +0200 Subject: [PATCH 1/3] Add amazon cognito --- .../configure-amazon-cognito.md | 55 +++++++++++++++++++ sidebars.js | 1 + 2 files changed, 56 insertions(+) create mode 100644 docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-amazon-cognito.md diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-amazon-cognito.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-amazon-cognito.md new file mode 100644 index 00000000000..032ff2308bb --- /dev/null +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-amazon-cognito.md @@ -0,0 +1,55 @@ +--- +title: Configure Amazon Cognito +description: Create an Amazon Cognito user pool and configure Rancher to work with Amazon Cognito. Your users can then sign into Rancher using their login from Amazon Cognito. +--- + + + + + +If your organization uses Amazon Cognito for user authentication, you can configure Rancher to allow login using Amazon Cognito credentials. The following instructions describe how to configure Rancher to work with Amazon Cognito: + +## Prerequisites + +- In Rancher: + - Amazon Cognito is disabled. + +:::note +Consult the Amazon Cognito [documentation](https://aws.amazon.com/cognito/getting-started/) to configure the user pool. +::: + +- In Amazon Cognito: + - Create a new user pool or use an existing one. + - In the `App client` settings, set the redirect URL to `https://yourRancherHostURL/verify-auth`. Replace `yourRancherHostURL` with the actual hostname of your Rancher instance (e.g., https://rancher.example.com/verify-auth). + +## Configuring Amazon Cognito in Rancher + +1. In the upper left corner of the Rancher UI, click **☰ > Users & Authentication**. +1. In the left navigation bar, click **Auth Provider**. +1. Select **Amazon Cognito**. +1. Complete the **Configure an Amazon Cognito account** form. For help with filling the form, see the [configuration reference](#configuration-reference). +1. Click **Enable**. + + Rancher will redirect you to the Amazon Cognito login page. Enter your Amazon Cognito credentials to validate your Rancher configuration. + + :::note + + You may need to disable your popup blocker to see the Amazon Cognito login page. + + ::: + +**Result:** Rancher is configured to work with your Amazon Cognito using the OIDC protocol. Your users can now sign into Rancher using their Amazon Cognito logins. + +## Configuration Reference + +| Field | Description | +| ------------------------- |-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Client ID | The Client ID of your Amazon Cognito App Client. | +| Client Secret | The generated Secret of your Amazon Cognito App Client. | +| Issuer | The Issuer URL of your Amazon Cognito App Client. It follows the format `https://cognito-idp.{region}.amazonaws.com/{userPoolId}`, and can be found in the App Client settings page. Rancher uses the Issuer URL to fetch all of the required URLs. | + +## Troubleshooting + +### You are not redirected to your authentication provider + +If you fill out the **Configure an Amazon Cognito account** form and click on **Enable**, and you are not redirected to Amazon Cognito, verify your Amazon Cognito configuration. diff --git a/sidebars.js b/sidebars.js index 992fe3f5d7e..ac9165098c1 100644 --- a/sidebars.js +++ b/sidebars.js @@ -237,6 +237,7 @@ const sidebars = { "how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity", "how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml", "how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc", + "how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-amazon-cognito", ] }, { From 8d900fd43c45c06f4f6647eb170278d4ec824764 Mon Sep 17 00:00:00 2001 From: raul Date: Wed, 16 Jul 2025 15:55:56 +0200 Subject: [PATCH 2/3] add userID note for cognito --- .../authentication-config/configure-amazon-cognito.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-amazon-cognito.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-amazon-cognito.md index 032ff2308bb..58a82dfc38d 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-amazon-cognito.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-amazon-cognito.md @@ -40,6 +40,11 @@ Consult the Amazon Cognito [documentation](https://aws.amazon.com/cognito/gettin **Result:** Rancher is configured to work with your Amazon Cognito using the OIDC protocol. Your users can now sign into Rancher using their Amazon Cognito logins. +:::note +User and group search is not supported for Amazon Cognito. When assigning permissions to a Project or Cluster, you must manually enter the UserID generated by Cognito +if the user has not yet logged in to Rancher. However, if the user has previously logged in, you can assign permissions using their username or email address. +::: + ## Configuration Reference | Field | Description | From 7805021d8f95209ec9b77208fbd8f905c2706842 Mon Sep 17 00:00:00 2001 From: raul Date: Mon, 21 Jul 2025 16:31:02 +0200 Subject: [PATCH 3/3] add cognito to version 2.12 --- .../configure-amazon-cognito.md | 60 +++++++++++++++++++ versioned_sidebars/version-2.12-sidebars.json | 3 +- 2 files changed, 62 insertions(+), 1 deletion(-) create mode 100644 versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-amazon-cognito.md diff --git a/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-amazon-cognito.md b/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-amazon-cognito.md new file mode 100644 index 00000000000..58a82dfc38d --- /dev/null +++ b/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-amazon-cognito.md @@ -0,0 +1,60 @@ +--- +title: Configure Amazon Cognito +description: Create an Amazon Cognito user pool and configure Rancher to work with Amazon Cognito. Your users can then sign into Rancher using their login from Amazon Cognito. +--- + + + + + +If your organization uses Amazon Cognito for user authentication, you can configure Rancher to allow login using Amazon Cognito credentials. The following instructions describe how to configure Rancher to work with Amazon Cognito: + +## Prerequisites + +- In Rancher: + - Amazon Cognito is disabled. + +:::note +Consult the Amazon Cognito [documentation](https://aws.amazon.com/cognito/getting-started/) to configure the user pool. +::: + +- In Amazon Cognito: + - Create a new user pool or use an existing one. + - In the `App client` settings, set the redirect URL to `https://yourRancherHostURL/verify-auth`. Replace `yourRancherHostURL` with the actual hostname of your Rancher instance (e.g., https://rancher.example.com/verify-auth). + +## Configuring Amazon Cognito in Rancher + +1. In the upper left corner of the Rancher UI, click **☰ > Users & Authentication**. +1. In the left navigation bar, click **Auth Provider**. +1. Select **Amazon Cognito**. +1. Complete the **Configure an Amazon Cognito account** form. For help with filling the form, see the [configuration reference](#configuration-reference). +1. Click **Enable**. + + Rancher will redirect you to the Amazon Cognito login page. Enter your Amazon Cognito credentials to validate your Rancher configuration. + + :::note + + You may need to disable your popup blocker to see the Amazon Cognito login page. + + ::: + +**Result:** Rancher is configured to work with your Amazon Cognito using the OIDC protocol. Your users can now sign into Rancher using their Amazon Cognito logins. + +:::note +User and group search is not supported for Amazon Cognito. When assigning permissions to a Project or Cluster, you must manually enter the UserID generated by Cognito +if the user has not yet logged in to Rancher. However, if the user has previously logged in, you can assign permissions using their username or email address. +::: + +## Configuration Reference + +| Field | Description | +| ------------------------- |-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Client ID | The Client ID of your Amazon Cognito App Client. | +| Client Secret | The generated Secret of your Amazon Cognito App Client. | +| Issuer | The Issuer URL of your Amazon Cognito App Client. It follows the format `https://cognito-idp.{region}.amazonaws.com/{userPoolId}`, and can be found in the App Client settings page. Rancher uses the Issuer URL to fetch all of the required URLs. | + +## Troubleshooting + +### You are not redirected to your authentication provider + +If you fill out the **Configure an Amazon Cognito account** form and click on **Enable**, and you are not redirected to Amazon Cognito, verify your Amazon Cognito configuration. diff --git a/versioned_sidebars/version-2.12-sidebars.json b/versioned_sidebars/version-2.12-sidebars.json index 155f9b566e0..ed76abce50b 100644 --- a/versioned_sidebars/version-2.12-sidebars.json +++ b/versioned_sidebars/version-2.12-sidebars.json @@ -215,7 +215,8 @@ "how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml", "how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity", "how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml", - "how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc" + "how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc", + "how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-amazon-cognito" ] }, {