public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-25 12:38:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

documenting user account behavior during external auth setup

Browse Source
This commit is contained in:
Mark Bishop
2018-06-07 15:54:21 -07:00
committed by Mark Bishop
parent 80f3da055b
commit a638d4d04a
2 changed files with 56 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/rancher/v2.x/en/concepts/global-configuration/_index.md
+10
View File
@@ -22,9 +22,19 @@ However, Rancher also provides local authentication.
In most cases, you should use an external authentication service over local, as external authentication allows user management from a central location. However, you may want a few local authentication accounts for managing Rancher under rare circumstances, such as if Active Directory is down.
<<<<<<< HEAD
## Users, Global Permissions, and Roles
Within Rancher, each user authenticates as a _user_, which is a login that grants you access to Rancher. As mentioned previously, users can either be local or external.
=======
You should know a few things about external authentication:
- When you configure AD or GitHub authentication, Rancher binds your current user account to the AD or GitHub account you're using to authenticate with Rancher. In other words, if you want to log into Rancher using the AD or GitHub account that you used to configure external authentication, you must use the local user account that's bound to your AD/GitHub account.
- If you are signed into Rancher with a local user account, AD/GitHub accounts are not listed on the **Users** page. You must be assigned with an AD/GitHub account to view AD/GitHub users in Rancher. Additionally, The AD/GitHub account
## Users and Roles
>>>>>>> documenting user account behavior during external auth setup
Once the user logs in to Rancher, their _authorization_, or their access rights within the system, is determined by _global permissions_, and _cluster and project roles_.
content/rancher/v2.x/en/tasks/global-configuration/authentication/_index.md
+46 -15
View File
@@ -12,19 +12,29 @@ You have three options for user authentication in {{< product >}}:
- **OpenLDAP**:
<<<<<<< HEAD
- **Azure AD**: -->
- **Basic Authentication**: If you don't want to use external authentication, you can always add users directly to {{< product >}}. We recommend using external authentication over basic authentication.
### Configuring Active Directory
### Configuring Active Directory Authentication
In environments using Microsoft Active Directory (AD), you can configure Rancher to allow sign on using AD credentials.
>>>>>>> documenting user account behavior during external auth setup
>**Prerequisites:** Create a service account in Active Directory with **read-only** access. {{< product >}} uses this account to verify group membership when a user makes a request using an API key.
1. From the **Global** view, select **Security > Authentication** from the main menu.
>**Tip**: This procedure binds the logged-in user [local administrative user account](#to-configrue-local-authentication) to an Active Directory account. Therefore, we recommend creating both a new local administrative user account and a new Active Directory account that mirror each other. Use these accounts solely to integrate Active Directory authetication with Rancher.
2. Select **Active Directory**.
1. Sign into Rancher using a local administrative account (i.e. `Default Admin` or another administrative account that you create).
3. Complete the **Configure an Active Directory server** form.
In upcoming steps, you'll bind this local account to an Active Directory account.
2. From the **Global** view, select **Security > Authentication** from the main menu.
3. Select **Active Directory**.
4. Complete the **Configure an Active Directory server** form.
You may need to log in to your domain controller to find the information requested in the form.
@@ -38,17 +48,36 @@ You have three options for user authentication in {{< product >}}:
- If your users and groups are in the search base, complete only the User Search Base.
- If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required.
4. If your Active Directory deviates from the standard AD schema, complete the **Customize Schema** form to match it. Otherwise, skip this step.
5. If your Active Directory deviates from the standard AD schema, complete the **Customize Schema** form to match it. Otherwise, skip this step.
5. Enter your AD username and password in **Test and enable authentication** to confirm that Rancher is configured to use AD authentication.
6. Enter your AD username and password in **Test and enable authentication** to confirm that Rancher is configured to use AD authentication.
### Configuring GitHub
**Result:**
1. From the **Global** view, select **Security > Authentication** from the main menu.
- Active Directory authentication is configured.
- You are signed into Rancher with your Active Directory account.
- Your Active Directory account is associated with the local administrator that you used to configure external autentication. Note that your Active Directory account _is not_ listed on the **Users** page. Edit the local user that the Active Directory user is bound to instead.
2. Select **GitHub**.
>**Note:** After successfully configuring Active Directory authentication, Active Directory accounts only display on the **Users** page if you are signed in using an Active Directory account or the local account you used to configure Active Directory authentication. If you are signed in with any other local user account, Active Directory accounts do not display.
3. Follow the directions displayed to **Setup a GitHub Application**. Rancher redirects you to GitHub to complete registration.
### Configuring GitHub Authentication
In environments using GitHub, you can configure Rancher to allow sign on using GitHub credentials.
>**Tip**: This procedure binds a [local administrative user account](#to-configrue-local-authentication) to a GitHub account. Therefore, we recommend creating both a new local administrative user account and a new GitHub account that mirror each other. Use these accounts solely to integrate GitHub authetication with Rancher.
1. Sign into GitHub using an account you want use to authenticate with Rancher.
2. Sign into Rancher using a local administrative account (i.e. `Default Admin` or another administrative account that you create).
In upcoming steps, you'll bind this local account to the GitHub account from the previous step.
3. From the **Global** view, select **Security > Authentication** from the main menu.
4. Select **GitHub**.
5. Follow the directions displayed to **Setup a GitHub Application**. Rancher redirects you to GitHub to complete registration.
>**What's an Authorization Callback URL?**
>
@@ -56,15 +85,15 @@ You have three options for user authentication in {{< product >}}:
>When you use external authentication, sign on authentication does not actually take place in your application. Instead, authentication takes place externally (in this case, GitHub). After this external authorization completes successfully, the Authorization Callback URL is the location that the user reenters your application.
4. From GitHub, copy the **Client ID** and **Client Secret**. Paste them into {{< product >}}.
6. From GitHub, copy the **Client ID** and **Client Secret**. Paste them into {{< product >}}.
>**Where do I find the Client ID and Client Secret?**
>
>From GitHub, select Settings > Developer Settings > OAuth Apps. The Client ID and Client Secret are displayed prominently.
5. Click **Authenticate with GitHub**.
7. Click **Authenticate with GitHub**.
6. Use the **Site Access** options to configure the scope of user authorization.
8. Use the **Site Access** options to configure the scope of user authorization.
- **Allow any valid Users**
@@ -78,13 +107,15 @@ You have three options for user authentication in {{< product >}}:
Only GitHub users or groups added to the Authorized Users and Organizations can log in to Rancher.
<br/>
7. Click **Save**.
9. Click **Save**.
**Result:**
- GitHub authentication is configured.
- You are signed into Rancher with your GitHub account.
- Your GitHub account is added to Rancher as an administrator.
- Your GitHub account is associated with the local administrator that you used. Note that your GitHub account _is not_ listed on the **Users** page. Edit the local user that the GitHub account is bound to instead.
>**Note:** After successfully configuring GitHub authentication, GitHub accounts only display on the **Users** page if you are signed in using a GitHub account or the local account you used to configure GitHub authentication. If you are signed in with any other local user account, GitHub accounts do not display.
<!-- ### Configuring SAML