diff --git a/content/rancher/v2.x/en/admin-settings/authentication/openldap/_index.md b/content/rancher/v2.x/en/admin-settings/authentication/openldap/_index.md index 4338bc3f86a..15cdf376100 100644 --- a/content/rancher/v2.x/en/admin-settings/authentication/openldap/_index.md +++ b/content/rancher/v2.x/en/admin-settings/authentication/openldap/_index.md @@ -8,17 +8,6 @@ aliases: _Available as of v2.0.5_ If your organization uses LDAP for user authentication, you can configure Rancher to communicate with an OpenLDAP server to authenticate users. This allows Rancher admins to control access to clusters and projects based on users and groups managed externally in the organisation's central user repository, while allowing end-users to authenticate with their LDAP credentials when logging in to the Rancher UI. - -## OpenLDAP Authentication Flow - -1. When a user attempts to login with his LDAP credentials, Rancher creates an initial bind to the LDAP server using a service account with permissions to search the directory and read user/group attributes. -2. Rancher then searches the directory for the user by using a search filter based on the provided username and configured attribute mappings. -3. Once the user has been found, he is authenticated with another LDAP bind request using the user's DN and provided password. -4. Once authentication succeeded, Rancher then resolves the group memberships both from the membership attribute in the user's object and by performing a group search based on the configured user mapping attribute. - -> **Note:** -> -> Before you proceed with the configuration, please familiarise yourself with the concepts of [External Authentication Configuration and Principal Users]({{}}/rancher/v2.x/en/admin-settings/authentication/#external-authentication-configuration-and-principal-users). ## Prerequisites @@ -28,7 +17,9 @@ Rancher must be configured with a LDAP bind account (aka service account) to sea > > If the certificate used by the OpenLDAP server is self-signed or not from a recognised certificate authority, make sure have at hand the CA certificate (concatenated with any intermediate certificates) in PEM format. You will have to paste in this certificate during the configuration so that Rancher is able to validate the certificate chain. -## Configuration Steps +## Configure OpenLDAP in Rancher + +> Before you proceed with the configuration, please familiarise yourself with the concepts of [External Authentication Configuration and Principal Users]({{}}/rancher/v2.x/en/admin-settings/authentication/#external-authentication-configuration-and-principal-users). 1. Log into the Rancher UI using the initial local `admin` account. 2. From the **Global** view, navigate to **Security** > **Authentication** diff --git a/content/rancher/v2.x/en/admin-settings/authentication/openldap/openldap-config/_index.md b/content/rancher/v2.x/en/admin-settings/authentication/openldap/openldap-config/_index.md index 047a20919e5..f60c8be2589 100644 --- a/content/rancher/v2.x/en/admin-settings/authentication/openldap/openldap-config/_index.md +++ b/content/rancher/v2.x/en/admin-settings/authentication/openldap/openldap-config/_index.md @@ -7,15 +7,29 @@ This section is intended to be used as a reference when setting up an OpenLDAP a For further details on configuring OpenLDAP, refer to the [official documentation.](https://www.openldap.org/doc/) +> Before you proceed with the configuration, please familiarise yourself with the concepts of [External Authentication Configuration and Principal Users]({{}}/rancher/v2.x/en/admin-settings/authentication/#external-authentication-configuration-and-principal-users). + +- [Background: OpenLDAP Authentication Flow](#background-openldap-authentication-flow) - [OpenLDAP server configuration](#openldap-server-configuration) - [User/group schema configuration](#user-group-schema-configuration) - [User schema configuration](#user-schema-configuration) - [Group schema configuration](#group-schema-configuration) +## Background: OpenLDAP Authentication Flow + +1. When a user attempts to login with his LDAP credentials, Rancher creates an initial bind to the LDAP server using a service account with permissions to search the directory and read user/group attributes. +2. Rancher then searches the directory for the user by using a search filter based on the provided username and configured attribute mappings. +3. Once the user has been found, he is authenticated with another LDAP bind request using the user's DN and provided password. +4. Once authentication succeeded, Rancher then resolves the group memberships both from the membership attribute in the user's object and by performing a group search based on the configured user mapping attribute. + # OpenLDAP Server Configuration You will need to enter the address, port, and protocol to connect to your OpenLDAP server. `389` is the standard port for insecure traffic, `636` for TLS traffic. +> **Using TLS?** +> +> If the certificate used by the OpenLDAP server is self-signed or not from a recognised certificate authority, make sure have at hand the CA certificate (concatenated with any intermediate certificates) in PEM format. You will have to paste in this certificate during the configuration so that Rancher is able to validate the certificate chain. + If you are in doubt about the correct values to enter in the user/group Search Base configuration fields, consult your LDAP administrator or refer to the section [Identify Search Base and Schema using ldapsearch]({{}}/rancher/v2.x/en/admin-settings/authentication/ad/#annex-identify-search-base-and-schema-using-ldapsearch) in the Active Directory authentication documentation.
OpenLDAP Server Parameters
diff --git a/content/rancher/v2.x/en/admin-settings/authentication/shibboleth/_index.md b/content/rancher/v2.x/en/admin-settings/authentication/shibboleth/_index.md index 5ca461f13c7..114726f2659 100644 --- a/content/rancher/v2.x/en/admin-settings/authentication/shibboleth/_index.md +++ b/content/rancher/v2.x/en/admin-settings/authentication/shibboleth/_index.md @@ -17,11 +17,11 @@ This section covers the following topics: - [Setting up Shibboleth in Rancher](#setting-up-shibboleth-in-rancher) - [Shibboleth Prerequisites](#shibboleth-prerequisites) - - [Configuring Shibboleth](#configuring-shibboleth) + - [Configure Shibboleth in Rancher](#configure-shibboleth-in-rancher) - [SAML Provider Caveats](#saml-provider-caveats) - [Setting up OpenLDAP in Rancher](#setting-up-openldap-in-rancher) - [OpenLDAP Prerequisites](#openldap-prerequisites) - - [Configuring OpenLDAP](#configuring-openldap) + - [Configure OpenLDAP in Rancher](#configure-openldap-in-rancher) - [Troubleshooting](#troubleshooting) # Setting up Shibboleth in Rancher @@ -34,7 +34,7 @@ Metadata URL: `https:///v1-saml/shibboleth/saml/metadata` Assertion Consumer Service (ACS) URL: `https:///v1-saml/shibboleth/saml/acs` >- Export a `metadata.xml` file from your IdP Server. For more information, see the [Shibboleth documentation.](https://wiki.shibboleth.net/confluence/display/SP3/Home) -### Configuring Shibboleth +### Configure Shibboleth in Rancher If your organization uses Shibboleth for user authentication, you can configure Rancher to allow your users to log in using their IdP credentials. 1. From the **Global** view, select **Security > Authentication** from the main menu. @@ -92,14 +92,16 @@ Rancher must be configured with a LDAP bind account (aka service account) to sea > > If the certificate used by the OpenLDAP server is self-signed or not from a recognised certificate authority, make sure have at hand the CA certificate (concatenated with any intermediate certificates) in PEM format. You will have to paste in this certificate during the configuration so that Rancher is able to validate the certificate chain. -### Configuring OpenLDAP +### Configure OpenLDAP in Rancher + +Configure the settings for the OpenLDAP server, groups and users. For help filling out each field, refer to the [configuration reference.](../openldap-config) + +> Before you proceed with the configuration, please familiarise yourself with the concepts of [External Authentication Configuration and Principal Users]({{}}/rancher/v2.x/en/admin-settings/authentication/#external-authentication-configuration-and-principal-users). 1. Log into the Rancher UI using the initial local `admin` account. 2. From the **Global** view, navigate to **Security** > **Authentication** 3. Select **OpenLDAP**. The **Configure an OpenLDAP server** form will be displayed. -Then configure the settings for the OpenLDAP server, groups and users. For help filling out each field, refer to the [configuration reference.]({{}}/rancher/v2.x/en/admin-settings/authentication/openldap/openldap-config) - # Troubleshooting If you are experiencing issues while testing the connection to the OpenLDAP server, first double-check the credentials entered for the service account as well as the search base configuration. You may also inspect the Rancher logs to help pinpointing the problem cause. Debug logs may contain more detailed information about the error. Please refer to [How can I enable debug logging]({{}}/rancher/v2.x/en/faq/technical/#how-can-i-enable-debug-logging) in this documentation. diff --git a/content/rancher/v2.x/en/admin-settings/authentication/shibboleth/about/_index.md b/content/rancher/v2.x/en/admin-settings/authentication/shibboleth/about/_index.md index 7af334d0c70..33e88250453 100644 --- a/content/rancher/v2.x/en/admin-settings/authentication/shibboleth/about/_index.md +++ b/content/rancher/v2.x/en/admin-settings/authentication/shibboleth/about/_index.md @@ -13,9 +13,6 @@ One solution to this problem is to configure an OpenLDAP identity provider. With This section covers the following topics: -- [Terminology] -- [OpenLDAP authentication flow] - ### Terminology - **Shibboleth** is a single sign-on log-in system for computer networks and the Internet. It allows people to sign in using just one identity to various systems. It validates user credentials, but does not, on its own, handle group memberships. @@ -36,14 +33,4 @@ When a member of the OpenLDAP group logs in to Rancher, she is redirected to Shi Shibboleth validates her credentials, and retrieves user attributes from OpenLDAP, including groups. Then Shibboleth sends a SAML assertion to Rancher including the user attributes. Rancher uses the group data so that she can access all of the resources and permissions that her groups has permissions for. ![Adding OpenLDAP Group Permissions to Rancher Resources]({{}}/img/rancher/shibboleth-with-openldap-groups.svg) - -### OpenLDAP Authentication Flow - -1. When a user attempts to log in with his or her LDAP credentials, Rancher creates an initial bind to the LDAP server using a service account with permissions to search the directory and read user/group attributes. -2. Rancher then searches the directory for the user by using a search filter based on the provided username and configured attribute mappings. -3. Once the user has been found, he is authenticated with another LDAP bind request using the user's DN and provided password. -4. Once authentication succeeded, Rancher then resolves the group memberships both from the membership attribute in the user's object and by performing a group search based on the configured user mapping attribute. - -> **Note:** -> -> Before you proceed with the configuration, please familiarize yourself with the concepts of [External Authentication Configuration and Principal Users]({{}}/rancher/v2.x/en/admin-settings/authentication/#external-authentication-configuration-and-principal-users). \ No newline at end of file + \ No newline at end of file