Merge pull request #1335 from sunilarjun/2.9.0-SLO-auth-update

[2.10.0] - Update SAML Pages with SLO Feature
2026-09-10 03:05:48 +00:00 · 2024-11-05 16:34:13 -08:00
parent ddaef63077 6a47218c15
commit da8d7eb95a
22 changed files with 96 additions and 2 deletions
@@ -192,3 +192,7 @@ Try configuring and saving keycloak as your SAML provider and then accessing the

  * Check your Keycloak log.
  * If the log displays `request validation failed: org.keycloak.common.VerificationException: SigAlg was null`, set `Client Signature Required` to `OFF` in your Keycloak client.
+
+## Configuring SAML Single Logout (SLO)
+
+<ConfigureSLO />
@@ -107,4 +107,8 @@ The OpenLDAP service account is used for all searches. Rancher users will see us
 1. Click **Okta** or, if SAML is already configured, **Edit Config**
 1. Under **User and Group Search**, check **Configure an OpenLDAP server**

-If you experience issues when you test the connection to the OpenLDAP server, ensure that you entered the credentials for the service account and configured the search base correctly. Inspecting the Rancher logs can help pinpoint the root cause. Debug logs may contain more detailed information about the error. Please refer to [How can I enable debug logging](../../../../faq/technical-items.md#how-can-i-enable-debug-logging) for more information.
+If you experience issues when you test the connection to the OpenLDAP server, ensure that you entered the credentials for the service account and configured the search base correctly. Inspecting the Rancher logs can help pinpoint the root cause. Debug logs may contain more detailed information about the error. Please refer to [How can I enable debug logging](../../../../faq/technical-items.md#how-can-i-enable-debug-logging) for more information.
+
+## Configuring SAML Single Logout (SLO)
+
+<ConfigureSLO />
@@ -64,3 +64,7 @@ Note that these URLs will not return valid data until the authentication configu
 - The group drop-down shows only the groups that you are a member of. You will not be able to add groups that you are not a member of.

 :::
+
+## Configuring SAML Single Logout (SLO)
+
+<ConfigureSLO />
@@ -51,3 +51,7 @@ You can generate a certificate using an openssl command. For example:
 ```
 openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
 ```
+
+## Configuring SAML Single Logout (SLO)
+
+<ConfigureSLO />
@@ -77,6 +77,10 @@ If you configure Shibboleth without OpenLDAP, the following caveats apply due to

 To enable searching for groups when assigning permissions in Rancher, you will need to configure a back end for the SAML provider that supports groups, such as OpenLDAP.

+### Configuring SAML Single Logout (SLO)
+
+<ConfigureSLO />
+
 ## Setting up OpenLDAP in Rancher

 If you also configure OpenLDAP as the back end to Shibboleth, it will return a SAML assertion to Rancher with user attributes that include groups. Then authenticated users will be able to access resources in Rancher that their groups have permissions for.
@@ -188,3 +188,7 @@ openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout myservice.ke

 * 检查你的 Keycloak 日志。
 * 如果日志显示 `request validation failed: org.keycloak.common.VerificationException: SigAlg was null`，请在 Keycloak 客户端中将 `Client Signature Required` 设为 `OFF`。
+
+## Configuring SAML Single Logout (SLO)
+
+<ConfigureSLO />
@@ -105,3 +105,7 @@ OpenLDAP ServiceAccount 用于所有搜索。无论用户个人的 SAML 权限
 1. 在**用户和组搜索**下，选中**配置 OpenLDAP Server**。

 如果你在测试与 OpenLDAP Server 的连接时遇到问题，请确保你输入了ServiceAccount 的凭证并正确配置了搜索库。你可以检查 Rancher 日志来查明根本原因。调试日志可能包含有关错误的更详细信息。请参阅[如何启用调试日志](../../../../faq/technical-items.md#如何启用调试日志记录)了解更多信息。
+
+## Configuring SAML Single Logout (SLO)
+
+<ConfigureSLO />
@@ -60,3 +60,7 @@ title: 配置 PingIdentity (SAML)
 - 用户组下拉列表仅显示你所属的用户组。如果你不是某个组的成员，你将无法添加该组。

 :::
+
+## Configuring SAML Single Logout (SLO)
+
+<ConfigureSLO />
@@ -51,3 +51,7 @@ title: 2. 在 Rancher 中配置 Microsoft AD FS
 ```
 openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
 ```
+
+## Configuring SAML Single Logout (SLO)
+
+<ConfigureSLO />
@@ -76,6 +76,10 @@ SAML 协议不支持用户或用户组的搜索或查找。因此，如果你没

 要在 Rancher 中分配权限时启用搜索组，你需要为 SAML 身份认证服务配置支持组的后端（例如 OpenLDAP）。

+### Configuring SAML Single Logout (SLO)
+
+<ConfigureSLO />
+
 # 在 Rancher 中设置 OpenLDAP

 如果你将 OpenLDAP 配置为 Shibboleth 的后端，SAML 断言会返回到 Rancher，其中包括用于引用组的用户属性。然后，通过认证的用户将能够访问其所在的组有权访问的 Rancher 资源。
@@ -188,3 +188,7 @@ openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout myservice.ke

 * 检查你的 Keycloak 日志。
 * 如果日志显示 `request validation failed: org.keycloak.common.VerificationException: SigAlg was null`，请在 Keycloak 客户端中将 `Client Signature Required` 设为 `OFF`。
+
+## Configuring SAML Single Logout (SLO)
+
+<ConfigureSLO />
@@ -105,3 +105,7 @@ OpenLDAP ServiceAccount 用于所有搜索。无论用户个人的 SAML 权限
 1. 在**用户和组搜索**下，选中**配置 OpenLDAP Server**。

 如果你在测试与 OpenLDAP Server 的连接时遇到问题，请确保你输入了ServiceAccount 的凭证并正确配置了搜索库。你可以检查 Rancher 日志来查明根本原因。调试日志可能包含有关错误的更详细信息。请参阅[如何启用调试日志](../../../../faq/technical-items.md#如何启用调试日志记录)了解更多信息。
+
+## Configuring SAML Single Logout (SLO)
+
+<ConfigureSLO />
@@ -60,3 +60,7 @@ title: 配置 PingIdentity (SAML)
 - 用户组下拉列表仅显示你所属的用户组。如果你不是某个组的成员，你将无法添加该组。

 :::
+
+## Configuring SAML Single Logout (SLO)
+
+<ConfigureSLO />
@@ -51,3 +51,7 @@ title: 2. 在 Rancher 中配置 Microsoft AD FS
 ```
 openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
 ```
+
+## Configuring SAML Single Logout (SLO)
+
+<ConfigureSLO />
@@ -76,6 +76,10 @@ SAML 协议不支持用户或用户组的搜索或查找。因此，如果你没

 要在 Rancher 中分配权限时启用搜索组，你需要为 SAML 身份认证服务配置支持组的后端（例如 OpenLDAP）。

+### Configuring SAML Single Logout (SLO)
+
+<ConfigureSLO />
+
 # 在 Rancher 中设置 OpenLDAP

 如果你将 OpenLDAP 配置为 Shibboleth 的后端，SAML 断言会返回到 Rancher，其中包括用于引用组的用户属性。然后，通过认证的用户将能够访问其所在的组有权访问的 Rancher 资源。
@@ -0,0 +1,12 @@
+Rancher supports the ability to configure SAML SLO. Options include logging out of the Rancher application only, logging out of Rancher and registered applications tied to the external authentication provider, or a prompt asking the user to choose between the previous options. The steps below outline configuration from the application GUI:
+
+1. Sign in to Rancher using a standard user or an administrator role to configure SAML SLO.
+1. In the top left corner, click **☰ > Users & Authentication**.
+1. In the left navigation menu, click **Auth Provider**.
+1. Under the section **Log Out behavior**, choose the appropriate SLO setting as described below:
+
+    | Setting                   | Description                                                                   |
+    | ------------------------- | ----------------------------------------------------------------------------- |
+    | Log out of Rancher and not authentication provider | Choosing this option will only logout the Rancher application and not external authentication providers. |
+    | Log out of Rancher and authentication provider (includes all other applications registered with authentication provider) | Choosing this option will logout Rancher and all external authentication providers along with any registered applications linked to the provider. |
+    | Allow the user to choose one of the above in an additional log out step | Choosing this option presents users with a choice of logout method as described above. |
@@ -11,6 +11,7 @@ import DeprecationOPAGatekeeper from '/shared-files/_deprecation-opa-gatekeeper.
 import DeprecationWeave from '/shared-files/_deprecation-weave.md';
 import DeprecationHelm2 from '/shared-files/_deprecation-helm2.md';
 import DockerSupportWarning from '/shared-files/_docker-support-warning.md';
+import ConfigureSLO from '/shared-files/_configure-slo.md';

 export default {
  // Re-use the default mapping
@@ -23,6 +24,7 @@ export default {
  Card,

  CNIPopularityTable,
+  ConfigureSLO,
  DeprecationOPAGatekeeper,
  DeprecationWeave,
  DeprecationHelm2,
@@ -192,3 +192,7 @@ Try configuring and saving keycloak as your SAML provider and then accessing the

  * Check your Keycloak log.
  * If the log displays `request validation failed: org.keycloak.common.VerificationException: SigAlg was null`, set `Client Signature Required` to `OFF` in your Keycloak client.
+
+## Configuring SAML Single Logout (SLO)
+
+<ConfigureSLO />
@@ -107,4 +107,8 @@ The OpenLDAP service account is used for all searches. Rancher users will see us
 1. Click **Okta** or, if SAML is already configured, **Edit Config**
 1. Under **User and Group Search**, check **Configure an OpenLDAP server**

-If you experience issues when you test the connection to the OpenLDAP server, ensure that you entered the credentials for the service account and configured the search base correctly. Inspecting the Rancher logs can help pinpoint the root cause. Debug logs may contain more detailed information about the error. Please refer to [How can I enable debug logging](../../../../faq/technical-items.md#how-can-i-enable-debug-logging) for more information.
+If you experience issues when you test the connection to the OpenLDAP server, ensure that you entered the credentials for the service account and configured the search base correctly. Inspecting the Rancher logs can help pinpoint the root cause. Debug logs may contain more detailed information about the error. Please refer to [How can I enable debug logging](../../../../faq/technical-items.md#how-can-i-enable-debug-logging) for more information.
+
+## Configuring SAML Single Logout (SLO)
+
+<ConfigureSLO />
@@ -64,3 +64,7 @@ Note that these URLs will not return valid data until the authentication configu
 - The group drop-down shows only the groups that you are a member of. You will not be able to add groups that you are not a member of.

 :::
+
+## Configuring SAML Single Logout (SLO)
+
+<ConfigureSLO />
@@ -51,3 +51,7 @@ You can generate a certificate using an openssl command. For example:
 ```
 openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
 ```
+
+## Configuring SAML Single Logout (SLO)
+
+<ConfigureSLO />
@@ -77,6 +77,10 @@ If you configure Shibboleth without OpenLDAP, the following caveats apply due to

 To enable searching for groups when assigning permissions in Rancher, you will need to configure a back end for the SAML provider that supports groups, such as OpenLDAP.

+### Configuring SAML Single Logout (SLO)
+
+<ConfigureSLO />
+
 ## Setting up OpenLDAP in Rancher

 If you also configure OpenLDAP as the back end to Shibboleth, it will return a SAML assertion to Rancher with user attributes that include groups. Then authenticated users will be able to access resources in Rancher that their groups have permissions for.