public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-29 06:29:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3938 from btat/keycloak

Browse Source 
Update process to get IDP metadata for Keycloak SAML
This commit is contained in:
Billy Tat
2022-03-16 15:11:23 -07:00
committed by GitHub
parent 941f319cf8 66cb74545f
commit 965ccb99a6
2 changed files with 152 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/rancher/v2.5/en/admin-settings/authentication/keycloak/_index.md
+72 -21
View File
@@ -33,28 +33,79 @@ If your organization uses Keycloak Identity Provider (IdP) for user authenticati
{{< img "/img/rancher/keycloak/keycloak-saml-client-builtin-mappers.png" "">}} {{< img "/img/rancher/keycloak/keycloak-saml-client-builtin-mappers.png" "">}}
- Create a new "Group list" mapper to map the member attribute to a user's groups - Create a new "Group list" mapper to map the member attribute to a user's groups
{{< img "/img/rancher/keycloak/keycloak-saml-client-group-mapper.png" "">}} {{< img "/img/rancher/keycloak/keycloak-saml-client-group-mapper.png" "">}}
- Export a `metadata.xml` file from your Keycloak client:
From the `Installation` tab, choose the `SAML Metadata IDPSSODescriptor` format option and download your file.
>**Note** ## Getting the IDP Metadata
> Keycloak versions 6.0.0 and up no longer provide the IDP metadata under the `Installation` tab.
> You can still get the XML from the following url: {{% tabs %}}
> {{% tab "Keycloak 5 and earlier" %}}
> `https://{KEYCLOAK-URL}/auth/realms/{REALM-NAME}/protocol/saml/descriptor` To get the IDP metadata, export a `metadata.xml` file from your Keycloak client.
> From the **Installation** tab, choose the **SAML Metadata IDPSSODescriptor** format option and download your file.
> The XML obtained from this URL contains `EntitiesDescriptor` as the root element. Rancher expects the root element to be `EntityDescriptor` rather than `EntitiesDescriptor`. So before passing this XML to Rancher, follow these steps to adjust it: {{% /tab %}}
> {{% tab "Keycloak 6-13" %}}
> * Copy all the attributes from `EntitiesDescriptor` to the `EntityDescriptor` that are not present.
> * Remove the `<EntitiesDescriptor>` tag from the beginning. 1. From the **Configure** section, click the **Realm Settings** tab.
> * Remove the `</EntitiesDescriptor>` from the end of the xml. 1. Click the **General** tab.
> 1. From the **Endpoints** field, click **SAML 2.0 Identity Provider Metadata**.
> You are left with something similar as the example below:
> Verify the IDP metadata contains the following attributes:
> ```
> <EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" entityID="https://{KEYCLOAK-URL}/auth/realms/{REALM-NAME}"> ```
> .... xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
> </EntityDescriptor> xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
> ``` xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
```
Some browsers, such as Firefox, may render/process the document such that the contents appear to have been modified, and some attributes appear to be missing. In this situation, use the raw response data that can be found using your browser.
The following is an example process for Firefox, but will vary slightly for other browsers:
1. Press **F12** to access the developer console.
1. Click the **Network** tab.
1. From the table, click the row containing `descriptor`.
1. From the details pane, click the **Response** tab.
1. Copy the raw response data.
The XML obtained contains `EntitiesDescriptor` as the root element. Rancher expects the root element to be `EntityDescriptor` rather than `EntitiesDescriptor`. So before passing this XML to Rancher, follow these steps to adjust it:
1. Copy all the attributes from `EntitiesDescriptor` to the `EntityDescriptor` that are not present.
1. Remove the `<EntitiesDescriptor>` tag from the beginning.
1. Remove the `</EntitiesDescriptor>` from the end of the xml.
You are left with something similar as the example below:
```
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" entityID="https://{KEYCLOAK-URL}/auth/realms/{REALM-NAME}">
....
</EntityDescriptor>
```
{{% /tab %}}
{{% tab "Keycloak 14+" %}}
1. From the **Configure** section, click the **Realm Settings** tab.
1. Click the **General** tab.
1. From the **Endpoints** field, click **SAML 2.0 Identity Provider Metadata**.
Verify the IDP metadata contains the following attributes:
```
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
```
Some browsers, such as Firefox, may render/process the document such that the contents appear to have been modified, and some attributes appear to be missing. In this situation, use the raw response data that can be found using your browser.
The following is an example process for Firefox, but will vary slightly for other browsers:
1. Press **F12** to access the developer console.
1. Click the **Network** tab.
1. From the table, click the row containing `descriptor`.
1. From the details pane, click the **Response** tab.
1. Copy the raw response data.
{{% /tab %}}
{{% /tabs %}}
## Configuring Keycloak in Rancher ## Configuring Keycloak in Rancher
content/rancher/v2.6/en/admin-settings/authentication/keycloak-saml/_index.md
+72 -21
View File
@@ -31,28 +31,79 @@ If your organization uses Keycloak Identity Provider (IdP) for user authenticati
{{< img "/img/rancher/keycloak/keycloak-saml-client-builtin-mappers.png" "">}} {{< img "/img/rancher/keycloak/keycloak-saml-client-builtin-mappers.png" "">}}
- Create a new "Group list" mapper to map the member attribute to a user's groups - Create a new "Group list" mapper to map the member attribute to a user's groups
{{< img "/img/rancher/keycloak/keycloak-saml-client-group-mapper.png" "">}} {{< img "/img/rancher/keycloak/keycloak-saml-client-group-mapper.png" "">}}
- Export a `metadata.xml` file from your Keycloak client:
From the `Installation` tab, choose the `SAML Metadata IDPSSODescriptor` format option and download your file.
>**Note** ## Getting the IDP Metadata
> Keycloak versions 6.0.0 and up no longer provide the IDP metadata under the `Installation` tab.
> You can still get the XML from the following url: {{% tabs %}}
> {{% tab "Keycloak 5 and earlier" %}}
> `https://{KEYCLOAK-URL}/auth/realms/{REALM-NAME}/protocol/saml/descriptor` To get the IDP metadata, export a `metadata.xml` file from your Keycloak client.
> From the **Installation** tab, choose the **SAML Metadata IDPSSODescriptor** format option and download your file.
> The XML obtained from this URL contains `EntitiesDescriptor` as the root element. Rancher expects the root element to be `EntityDescriptor` rather than `EntitiesDescriptor`. So before passing this XML to Rancher, follow these steps to adjust it: {{% /tab %}}
> {{% tab "Keycloak 6-13" %}}
> * Copy all the attributes from `EntitiesDescriptor` to the `EntityDescriptor` that are not present.
> * Remove the `<EntitiesDescriptor>` tag from the beginning. 1. From the **Configure** section, click the **Realm Settings** tab.
> * Remove the `</EntitiesDescriptor>` from the end of the xml. 1. Click the **General** tab.
> 1. From the **Endpoints** field, click **SAML 2.0 Identity Provider Metadata**.
> You are left with something similar as the example below:
> Verify the IDP metadata contains the following attributes:
> ```
> <EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" entityID="https://{KEYCLOAK-URL}/auth/realms/{REALM-NAME}"> ```
> .... xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
> </EntityDescriptor> xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
> ``` xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
```
Some browsers, such as Firefox, may render/process the document such that the contents appear to have been modified, and some attributes appear to be missing. In this situation, use the raw response data that can be found using your browser.
The following is an example process for Firefox, but will vary slightly for other browsers:
1. Press **F12** to access the developer console.
1. Click the **Network** tab.
1. From the table, click the row containing `descriptor`.
1. From the details pane, click the **Response** tab.
1. Copy the raw response data.
The XML obtained contains `EntitiesDescriptor` as the root element. Rancher expects the root element to be `EntityDescriptor` rather than `EntitiesDescriptor`. So before passing this XML to Rancher, follow these steps to adjust it:
1. Copy all the attributes from `EntitiesDescriptor` to the `EntityDescriptor` that are not present.
1. Remove the `<EntitiesDescriptor>` tag from the beginning.
1. Remove the `</EntitiesDescriptor>` from the end of the xml.
You are left with something similar as the example below:
```
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" entityID="https://{KEYCLOAK-URL}/auth/realms/{REALM-NAME}">
....
</EntityDescriptor>
```
{{% /tab %}}
{{% tab "Keycloak 14+" %}}
1. From the **Configure** section, click the **Realm Settings** tab.
1. Click the **General** tab.
1. From the **Endpoints** field, click **SAML 2.0 Identity Provider Metadata**.
Verify the IDP metadata contains the following attributes:
```
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
```
Some browsers, such as Firefox, may render/process the document such that the contents appear to have been modified, and some attributes appear to be missing. In this situation, use the raw response data that can be found using your browser.
The following is an example process for Firefox, but will vary slightly for other browsers:
1. Press **F12** to access the developer console.
1. Click the **Network** tab.
1. From the table, click the row containing `descriptor`.
1. From the details pane, click the **Response** tab.
1. Copy the raw response data.
{{% /tab %}}
{{% /tabs %}}
## Configuring Keycloak in Rancher ## Configuring Keycloak in Rancher