diff --git a/content/rancher/v2.x/en/concepts/global-configuration/authentication/_index.md b/content/rancher/v2.x/en/concepts/global-configuration/authentication/_index.md
index 06dbfa7591c..94840b7de1f 100644
--- a/content/rancher/v2.x/en/concepts/global-configuration/authentication/_index.md
+++ b/content/rancher/v2.x/en/concepts/global-configuration/authentication/_index.md
@@ -13,12 +13,17 @@ This centralized user authentication is accomplished using the Rancher authentic
The Rancher authentication proxy integrates with the following external authentication services.
- Microsoft Active Directory
+- Microsoft Azure AD
- GitHub
+- FreeIPA
+- OpenLDAP
However, Rancher also provides local authentication.
In most cases, you should use an external authentication service over local, as external authentication allows user management from a central location. However, you may want a few local authentication users for managing Rancher under rare circumstances, such as if Active Directory is down.
+For more information on how to configure external authentication or local authentication, see [Authentication](../../../tasks/global-configuration/authentication/).
+
### External Authentication Configuration and Principal Users
Configuration of external authentication requires:
diff --git a/content/rancher/v2.x/en/concepts/global-configuration/users-permissions-roles/_index.md b/content/rancher/v2.x/en/concepts/global-configuration/users-permissions-roles/_index.md
index 22847e402a1..c8dafa4605d 100644
--- a/content/rancher/v2.x/en/concepts/global-configuration/users-permissions-roles/_index.md
+++ b/content/rancher/v2.x/en/concepts/global-configuration/users-permissions-roles/_index.md
@@ -2,6 +2,28 @@
title: Users, Global Permissions, and Roles
weight: 15
---
+In This Document:
+
+
+
+- [Users and Roles](#users-and-roles)
+ - [Global Permissions](#global-permissions)
+ - [Global Permission Assignment](#global-permission-assignment)
+ - [Custom Global Permissions](#custom-global-permissions)
+ - [Global Permissions Reference](#global-permissions-reference)
+ - [Cluster and Project Roles](#cluster-and-project-roles)
+ - [Membership and Role Assignment](#membership-and-role-assignment)
+ - [Cluster Roles](#cluster-roles)
+ - [Custom Cluster Roles](#custom-cluster-roles)
+ - [Cluster Role Reference](#cluster-role-reference)
+ - [Project Roles](#project-roles)
+ - [Custom Project Roles](#custom-project-roles)
+ - [Project Role Reference](#project-role-reference)
+ - [Defining Custom Roles](#defining-custom-roles)
+ - [Locked Roles](#locked-roles)
+
+
+
Within Rancher, each user authenticates as a _user_, which is a login that grants you access to Rancher. As mentioned in [Authentication]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/authentication), users can either be local or external.
diff --git a/content/rancher/v2.x/en/tasks/clusters/adding-storage/_index.md b/content/rancher/v2.x/en/tasks/clusters/adding-storage/_index.md
index c539e017cb4..a119c68f354 100644
--- a/content/rancher/v2.x/en/tasks/clusters/adding-storage/_index.md
+++ b/content/rancher/v2.x/en/tasks/clusters/adding-storage/_index.md
@@ -44,7 +44,6 @@ Persistent volumes can either be a disk or file system that you host on premise,
- [Access Modes](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes):
This options sets how many nodes can access the volume, along with the node read/write permissions. The [Kubernetes Documentation](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes) includes a table that lists which access modes are supported by the plugins available.
-
- [Mount Options](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#mount-options):
Each volume plugin allows you to specify additional command line options during the mounting process. You can enter these options in the **Mount Option** fields. Consult each plugin's vendor documentation for the mount options available.
@@ -52,7 +51,6 @@ Persistent volumes can either be a disk or file system that you host on premise,
- **Assign to Storage Class:**
If you later want to automatically provision persistent volumes identical to the volume that you've specified here, assign it a storage class. Later, when you create a workload, you can assign it a persistent volume claim that references the storage class, which will provision a persistent volume identical to the volume you've specified here.
-
>**Note:** You must [add a storage class](#adding-storage-classes) before you can assign it to a persistent volume.
1. Click **Save**.
diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/_index.md
index 2d27198d556..cef5b6b381e 100644
--- a/content/rancher/v2.x/en/tasks/global-configuration/authentication/_index.md
+++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/_index.md
@@ -2,25 +2,29 @@
title: Authentication
weight: 50
---
-You have three options for user authentication in Rancher:
-- [Active Directory]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/)
-
- Enterprises can use Active Directory (AD) for authentication, allowing users to sign in using their corporate credentials.
+You have multiple options for user authentication in Rancher:
-- [GitHub]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/authentication/github/)
+- [Active Directory](./active-directory/)
- Open source projects or organizations that use GitHub for source control may prefer that users sign in using their GitHub accounts.
+ Enterprises can use Active Directory (AD) for authentication, allowing users to sign in using their corporate credentials.
-
+ If you have an instance of Active Directory (AD) hosted in Azure, you can configure Rancher to allow your users to log in using their AD accounts. Configuration of Azure AD external authentication requires you to make configurations in both Azure and Rancher.
+- [GitHub](./github/)
-- [Azure AD]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/authentication/azure-ad/)
+ Open source projects or organizations that use GitHub for source control may prefer that users sign in using their GitHub accounts.
- If you have an instance of Active Directory (AD) hosted in Azure, you can configure Rancher to allow your users to log in using their AD accounts. Configuration of Azure AD external authentication requires you to make configurations in both Azure and Rancher.
+- [FreeIPA](./freeipa/)
-- [Local Authentication]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/authentication/local-authentication/)
+ Organizations can use FreeIPA for authentication, allowing users to sign in using their corporate credentials.
- If you don't want to use external authentication, you can always add users directly to Rancher. We recommend using external authentication over local authentication.
+- [OpenLDAP](./openlap/)
+
+ Organizations can use OpenLDAP for authentication, allowing users to sign in using their corporate credentials.
+
+- [Local Authentication](./local-authentication/)
+
+ If you don't want to use external authentication, you can always add users directly to Rancher. We recommend using external authentication over local authentication.
diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/_index.md
index 9105b6fb27a..989cb067d98 100644
--- a/content/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/_index.md
+++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/_index.md
@@ -7,7 +7,8 @@ In environments using Microsoft Active Directory (AD), you can configure Rancher
>**Prerequisites:**
>
->- Create a service account in Active Directory with `read-only` access. {{< product >}} uses this account to verify group membership when a user makes a request using an API key.
+>- Have an Active Directory server configured.
+>- Create a service account in Active Directory with `read-only` access. Rancher uses this account to verify group membership when a user makes a request using an API key.
>- Read [External Authentication Configuration and Principal Users]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/authentication/#external-authentication-configuration-and-principal-users).
1. Sign into Rancher using a local user assigned `administrator` global permissions (i.e., the _local principal_).
diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/azure-ad/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/azure-ad/_index.md
index 587c9522b3d..ec2047f5b5e 100644
--- a/content/rancher/v2.x/en/tasks/global-configuration/authentication/azure-ad/_index.md
+++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/azure-ad/_index.md
@@ -5,6 +5,8 @@ weight: 3075
If you have an instance of Active Directory (AD) hosted in Azure, you can configure Rancher to allow your users to log in using their AD accounts. Configuration of Azure AD external authentication requires you to make configurations in both Azure and Rancher.
+>**Prerequisite:** Have an instance of Azure AD configured.
+
>**Note:** Most of this procedure, with the exception of [Configure Azure AD in Rancher](#configure-azure-ad-in-rancher), takes place from the [Microsoft Azure Portal](https://portal.azure.com/).
## Azure Active Directory Configuration Outline
diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/freeipa/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/freeipa/_index.md
new file mode 100644
index 00000000000..51e72d3aad5
--- /dev/null
+++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/freeipa/_index.md
@@ -0,0 +1,55 @@
+---
+title: Configuring FreeIPA
+weight: 5000
+---
+
+If your organization uses FreeIPA for user authentication, you can configure Rancher to allow your users to login using their FreeIPA credentials.
+
+>**Prerequisites:**
+>
+>- You must have a [FreeIPA Server](https://www.freeipa.org/) configured.
+>- Create a service account in FreeIPA with `read-only` access. Rancher uses this account to verify group membership when a user makes a request using an API key.
+>- Read [External Authentication Configuration and Principal Users]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/authentication/#external-authentication-configuration-and-principal-users).
+
+1. Sign into Rancher using a local user assigned the `administrator` role (i.e., the _local principal_).
+
+2. From the **Global** view, select **Security > Authentication** from the main menu.
+
+3. Select **FreeIPA**.
+
+4. Complete the **Configure an FreeIPA server** form.
+
+ You may need to log in to your domain controller to find the information requested in the form.
+
+ >**Using TLS?**
+ >Make sure you have an LDAP certificate installed.
+
+
+ >**User Search Base vs. Group Search Base**
+ >
+ >When configuring FreeIPA authentication, you must enter a search base for your users. This search base allows Rancher to search for users that are in your FreeIPA.
+
+
+ > **Note:** This field is only for search bases and not for search filters.
+ >
+ >- If your users and groups are in the search base, complete only the User Search Base.
+ >- If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required.
+
+5. If your FreeIPA deviates from the standard AD schema, complete the **Customize Schema** form to match it. Otherwise, skip this step.
+
+ >**Search Attribute** As of Rancher v2.0.1, the Search Attribute field defaults with three specific values by default: `sAMAccountName|sn|givenName`. After FreeIPA is configured, when a user enters text to add users or groups, Rancher automatically queries the FreeIPA server and attempts to match fields by sAMAccountName, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field.
+ >
+ >The default field value `sAMAccountName|sn|givenName`, but you can configure this field to a subset of these fields. The pipe (`|`) between the fields separates these fields.
+ >
+ > * `sAMAccountName`: Username
+ > * `sn`: Last Name
+ > * `givenName`: First Name
+ >
+ > With this search attribute, Rancher creates search filters for users and groups, but you *cannot* add your own search filters in this field.
+
+6. Enter your FreeIPA username and password in **Test and enable authentication** to confirm that Rancher is configured to use FreeIPA authentication.
+
+**Result:**
+
+- FreeIPA authentication is configured.
+- You are signed into Rancher with your FreeIPA account (i.e., the _external principal_).
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/openLDAP/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/openLDAP/_index.md
new file mode 100644
index 00000000000..eaad856c84e
--- /dev/null
+++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/openLDAP/_index.md
@@ -0,0 +1,55 @@
+---
+title: Configuring OpenLDAP
+weight: 5000
+---
+
+If your organization uses OpenLDAP for user authentication, you can configure Rancher to allow your users to login using their OpenLDAP credentials.
+
+>**Prerequisites:**
+>
+>- You must have an [OpenLDAP Server](https://www.openldap.org/) configured.
+>- Create a service account in OpenLDAP with `read-only` access. Rancher uses this account to verify group membership when a user makes a request using an API key.
+>- Read [External Authentication Configuration and Principal Users]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/authentication/#external-authentication-configuration-and-principal-users).
+
+1. Sign into Rancher using a local user assigned the `administrator` role (i.e., the _local principal_).
+
+2. From the **Global** view, select **Security > Authentication** from the main menu.
+
+3. Select **OpenLDAP**.
+
+4. Complete the **Configure an OpenLDAP server** form.
+
+ You may need to log in to your domain controller to find the information requested in the form.
+
+ >**Using TLS?**
+ >Make sure you have an LDAP certificate installed.
+
+
+ >**User Search Base vs. Group Search Base**
+ >
+ >When configuring OpenLDAP authentication, you must enter a search base for your users. This search base allows Rancher to search for users that are in your OpenLDAP.
+
+
+ > **Note:** This field is only for search bases and not for search filters.
+ >
+ >- If your users and groups are in the search base, complete only the User Search Base.
+ >- If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required.
+
+5. If your OpenLDAP deviates from the standard OpenLDAP schema, complete the **Customize Schema** form to match it. Otherwise, skip this step.
+
+ >**Search Attribute** As of Rancher v2.0.1, the Search Attribute field defaults with three specific values by default: `sAMAccountName|sn|givenName`. After OpenLDAP is configured, when a user enters text to add users or groups, Rancher automatically queries the OpenLDAP server and attempts to match fields by sAMAccountName, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field.
+ >
+ >The default field value `sAMAccountName|sn|givenName`, but you can configure this field to a subset of these fields. The pipe (`|`) between the fields separates these fields.
+ >
+ > * `sAMAccountName`: Username
+ > * `sn`: Last Name
+ > * `givenName`: First Name
+ >
+ > With this search attribute, Rancher creates search filters for users and groups, but you *cannot* add your own search filters in this field.
+
+6. Enter your OpenLDAP username and password in **Test and enable authentication** to confirm that Rancher is configured to use OpenLDAP authentication.
+
+**Result:**
+
+- OpenLDAP authentication is configured.
+- You are signed into Rancher with your OpenLDAP account (i.e., the _external principal_).
\ No newline at end of file