Updating notes in docu format

2026-09-26 13:08:11 +00:00 · 2022-07-11 10:12:18 -04:00
parent b39bb84a64
commit 67499d800b
56 changed files with 457 additions and 146 deletions
@@ -35,7 +35,11 @@ In most cases, you should use an external authentication service over local auth

 Rancher relies on users and groups to determine who is allowed to log in to Rancher and which resources they can access. When authenticating with an external provider, groups are provided from the external provider based on the user. These users and groups are given specific roles to resources like clusters, projects, multi-cluster apps, and global DNS providers and entries. When you give access to a group, all users who are a member of that group in the authentication provider will be able to access the resource with the permissions that you've specified. For more information on roles and permissions, see [Role Based Access Control]({{<baseurl>}}/rancher/v2.6/en/admin-settings/rbac/).

-> **Note:** Local authentication does not support creating or managing groups.
+:::note
+
+Local authentication does not support creating or managing groups.
+
+:::

 For more information, see [Users and Groups]({{<baseurl>}}/rancher/v2.6/en/admin-settings/authentication/user-groups/)

@@ -44,8 +44,12 @@ After you complete [Configuring Microsoft AD FS for Rancher]({{<baseurl>}}/ranch

 <a id="cert-command"></a> 

-**Tip:** You can generate a certificate using an openssl command. For example:
+:::tip
+
+You can generate a certificate using an openssl command. For example:

 ```
 openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
 ```
+
+:::
@@ -5,8 +5,11 @@ weight: 1210

 If your organization uses Okta Identity Provider (IdP) for user authentication, you can configure Rancher to allow your users to log in using their IdP credentials.

->**Note:** Okta integration only supports Service Provider initiated logins.
+:::note

+Okta integration only supports Service Provider initiated logins.
+
+:::
 ## Prerequisites

 In Okta, create a SAML Application with the settings below. See the [Okta documentation](https://developer.okta.com/standards/SAML/setting_up_a_saml_application_in_okta) for help.
@@ -33,18 +36,27 @@ Setting | Value
    | Private Key / Certificate | A key/certificate pair used for Assertion Encryption.                         |
    | Metadata XML              | The `Identity Provider metadata` file that you find in the application `Sign On` section.  |

-    >**Tip:** You can generate a key/certificate pair using an openssl command. For example:
-    >    
-    >        openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout myservice.key -out myservice.crt
+    :::tip
+    
+    You can generate a key/certificate pair using an openssl command. For example:
+    
+    ```
+    openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout myservice.key -out myservice.crt
+    ```

+    :::


 1. After you complete the **Configure Okta Account** form, click **Enable**.

    Rancher redirects you to the IdP login page. Enter credentials that authenticate with Okta IdP to validate your Rancher Okta configuration.

-    >**Note:** If nothing seems to happen, it's likely because your browser blocked the pop-up. Make sure you disable the pop-up blocker for your rancher domain and whitelist it in any other extensions you might utilize.
+    :::note
+    
+    If nothing seems to happen, it's likely because your browser blocked the pop-up. Make sure you disable the pop-up blocker for your rancher domain and whitelist it in any other extensions you might utilize.

+    :::
+    
 **Result:** Rancher is configured to work with Okta. Your users can now sign into Rancher using their Okta logins.

 {{< saml_caveats >}}
@@ -28,9 +28,11 @@ Configure the settings for the OpenLDAP server, groups and users. For help filli

 Once you have completed the configuration, proceed by testing  the connection to the OpenLDAP server. Authentication with OpenLDAP will be enabled implicitly if the test is successful.

-> **Note:**
->
-> The OpenLDAP user pertaining to the credentials entered in this step will be mapped to the local principal account and assigned administrator privileges in Rancher. You should therefore make a conscious decision on which LDAP account you use to perform this step.
+:::note
+
+The OpenLDAP user pertaining to the credentials entered in this step will be mapped to the local principal account and assigned administrator privileges in Rancher. You should therefore make a conscious decision on which LDAP account you use to perform this step.
+
+:::

 1. Enter the **username** and **password** for the OpenLDAP account that should be mapped to the local principal account.
 2. Click **Authenticate With OpenLDAP** to test the OpenLDAP connection and finalise the setup.
@@ -40,9 +42,11 @@ Once you have completed the configuration, proceed by testing  the connection to
 - OpenLDAP authentication is configured.
 - The LDAP user pertaining to the entered credentials is mapped to the local principal (administrative) account.

-> **Note:**
->
-> You will still be able to login using the locally configured `admin` account and password in case of a disruption of LDAP services.
+:::note
+
+You will still be able to login using the locally configured `admin` account and password in case of a disruption of LDAP services.
+
+:::

 ## Annex: Troubleshooting

@@ -45,8 +45,12 @@ Note that these URLs will not return valid data until the authentication configu

    Rancher redirects you to the IdP login page. Enter credentials that authenticate with Ping IdP to validate your Rancher PingIdentity configuration.

-    >**Note:** You may have to disable your popup blocker to see the IdP login page.
+    :::note
+    
+    You may have to disable your popup blocker to see the IdP login page.

+    :::
+    
 **Result:** Rancher is configured to work with PingIdentity. Your users can now sign into Rancher using their PingIdentity logins.

 {{< saml_caveats >}}
@@ -65,8 +65,12 @@ If your organization uses Shibboleth for user authentication, you can configure

    Rancher redirects you to the IdP login page. Enter credentials that authenticate with Shibboleth IdP to validate your Rancher Shibboleth configuration.

-    >**Note:** You may have to disable your popup blocker to see the IdP login page.
+    :::note
+    
+    You may have to disable your popup blocker to see the IdP login page.

+    :::
+    
 **Result:** Rancher is configured to work with Shibboleth. Your users can now sign into Rancher using their Shibboleth logins.

 ### SAML Provider Caveats
@@ -40,8 +40,11 @@ To change these settings,
 1. In the upper left corner, click **☰ > Global Settings**.
 1. Go to the setting you want to configure and click **⋮ > Edit Setting**.

-> **Note:** Since SAML does not support user lookup, SAML-based authentication providers do not support periodically refreshing user information. User information will only be refreshed when the user logs into the Rancher UI.
+:::note

+Since SAML does not support user lookup, SAML-based authentication providers do not support periodically refreshing user information. User information will only be refreshed when the user logs into the Rancher UI.
+
+:::
 ### Manually Refreshing User Information

 If you are not sure the last time Rancher performed an automatic refresh of user information, you can perform a manual refresh of all users.
@@ -51,8 +54,11 @@ If you are not sure the last time Rancher performed an automatic refresh of user

 **Results:** Rancher refreshes the user information for all users. Requesting this refresh will update which users can access Rancher as well as all the groups that each user belongs to.

->**Note:** Since SAML does not support user lookup, SAML-based authentication providers do not support the ability to manually refresh user information. User information will only be refreshed when the user logs into the Rancher UI.
+:::note

+Since SAML does not support user lookup, SAML-based authentication providers do not support the ability to manually refresh user information. User information will only be refreshed when the user logs into the Rancher UI.
+
+:::

 ## Session Length