From 8664d43800c9b74c5d1f9d2ff010d62e49c54830 Mon Sep 17 00:00:00 2001 From: Max Sokolovsky Date: Fri, 24 Mar 2023 16:54:10 -0400 Subject: [PATCH] [2.6] Add to the note about Azure AD permission recommendations --- .../authentication-config/configure-azure-ad.md | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/versioned_docs/version-2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-azure-ad.md b/versioned_docs/version-2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-azure-ad.md index c1d93c8480f..274e1eb485e 100644 --- a/versioned_docs/version-2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-azure-ad.md +++ b/versioned_docs/version-2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-azure-ad.md @@ -122,7 +122,21 @@ In Rancher versions 2.6.7-2.6.10, you'll need to use `User.Read.All` and `Group. :::note -Rancher doesn't validate the permissions you grant to the app in Azure. We only support the use of the `Directory.Read.All` application permission. +Rancher doesn't validate the permissions you grant to the app in Azure. You're free to try any permissions you want, as long as they allow Rancher to work with AD users and groups. + + Specifically, Rancher needs permissions that allow the following actions: + - Get a user. + - List all users. + - List groups of which a given user is a member. + - Get a group. + - List all groups. + + Rancher performs these actions either to log in a user or to run a user/group search. Keep in mind that the permissions must be of type `Application`. + + Here are a few examples of permission combinations that satisfy Rancher's needs: + - `Directory.Read.All` + - `User.Read.All` and `GroupMember.Read.All` + - `User.Read.All` and `Group.Read.All` :::