diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-azure-ad.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-azure-ad.md index 7882e6d9be4..b17daeabbcd 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-azure-ad.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-azure-ad.md @@ -133,7 +133,17 @@ Here are a few examples of permission combinations that satisfy Rancher's needs: ::: -#### 4. Copy Azure Application Data +#### 4. Allow Public Client Flows + +To login from Rancher CLI you must allow public client flows: + +1. From the left navigation menu, select **Authentication**. + +1. Under **Advanced Settings**, select **Yes** on the toggle next to **Allow public client flows**. + + ![Allow Public Client Flows](/img/azure-public-client-flows.png) + +#### 5. Copy Azure Application Data ![Application ID](/img/app-configuration.png) @@ -176,7 +186,7 @@ You'll also need to manually enter the Graph, Token, and Auth Endpoints. - **OAuth 2.0 token endpoint (v1)** (Token Endpoint) - **OAuth 2.0 authorization endpoint (v1)** (Auth Endpoint) -#### 5. Configure Azure AD in Rancher +#### 6. Configure Azure AD in Rancher To complete configuration, enter information about your AD instance in the Rancher UI. @@ -188,7 +198,7 @@ To complete configuration, enter information about your AD instance in the Ranch 1. Click **AzureAD**. -1. Complete the **Configure Azure AD Account** form using the information you copied while completing [Copy Azure Application Data](#4-copy-azure-application-data). +1. Complete the **Configure Azure AD Account** form using the information you copied while completing [Copy Azure Application Data](#5-copy-azure-application-data). :::caution @@ -353,4 +363,3 @@ Since the filter prevents Rancher from seeing that the user belongs to an exclud >- If you don't wish to upgrade to v2.7.0+ after the Azure AD Graph API is retired, you'll need to either: - Use the built-in Rancher auth or - Use another third-party auth system and set that up in Rancher. Please see the [authentication docs](authentication-config.md) to learn how to configure other open authentication providers. - diff --git a/docs/reference-guides/cli-with-rancher/kubectl-utility.md b/docs/reference-guides/cli-with-rancher/kubectl-utility.md index b3f49191ede..5b863d2e4be 100644 --- a/docs/reference-guides/cli-with-rancher/kubectl-utility.md +++ b/docs/reference-guides/cli-with-rancher/kubectl-utility.md @@ -32,5 +32,6 @@ This feature enables kubectl to authenticate with the Rancher server and get a n 3. FreeIPA 4. OpenLDAP 5. SAML providers: Ping, Okta, ADFS, Keycloak, Shibboleth +6. Azure AD When you first run kubectl, for example, `kubectl get pods`, you are prompted to pick an auth provider and log in with the Rancher server. The kubeconfig token is cached in the path where you run kubectl under `./.cache/token`. This token is valid until [it expires](../../api/api-tokens.md#disable-tokens-in-generated-kubeconfigs), or [gets deleted from the Rancher server](../../api/api-tokens.md#deleting-tokens). Upon expiration, you must log in with the Rancher server again to run the `kubectl get pods` command. diff --git a/static/img/azure-public-client-flows.png b/static/img/azure-public-client-flows.png new file mode 100644 index 00000000000..ba3e6b00af3 Binary files /dev/null and b/static/img/azure-public-client-flows.png differ diff --git a/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-azure-ad.md b/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-azure-ad.md index 817a490ecda..3c8319f8ff4 100644 --- a/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-azure-ad.md +++ b/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-azure-ad.md @@ -133,7 +133,17 @@ Here are a few examples of permission combinations that satisfy Rancher's needs: ::: -#### 4. Copy Azure Application Data +#### 4. Allow Public Client Flows + +To login from Rancher CLI you must allow public client flows: + +1. From the left navigation menu, select **Authentication**. + +1. Under **Advanced Settings**, select **Yes** on the toggle next to **Allow public client flows**. + + ![Allow Public Client Flows](/img/azure-public-client-flows.png) + +#### 5. Copy Azure Application Data ![Application ID](/img/app-configuration.png) @@ -176,7 +186,7 @@ You'll also need to manually enter the Graph, Token, and Auth Endpoints. - **OAuth 2.0 token endpoint (v1)** (Token Endpoint) - **OAuth 2.0 authorization endpoint (v1)** (Auth Endpoint) -#### 5. Configure Azure AD in Rancher +#### 6. Configure Azure AD in Rancher To complete configuration, enter information about your AD instance in the Rancher UI. @@ -188,7 +198,7 @@ To complete configuration, enter information about your AD instance in the Ranch 1. Click **AzureAD**. -1. Complete the **Configure Azure AD Account** form using the information you copied while completing [Copy Azure Application Data](#4-copy-azure-application-data). +1. Complete the **Configure Azure AD Account** form using the information you copied while completing [Copy Azure Application Data](#5-copy-azure-application-data). :::caution diff --git a/versioned_docs/version-2.8/reference-guides/cli-with-rancher/kubectl-utility.md b/versioned_docs/version-2.8/reference-guides/cli-with-rancher/kubectl-utility.md index b3f49191ede..5b863d2e4be 100644 --- a/versioned_docs/version-2.8/reference-guides/cli-with-rancher/kubectl-utility.md +++ b/versioned_docs/version-2.8/reference-guides/cli-with-rancher/kubectl-utility.md @@ -32,5 +32,6 @@ This feature enables kubectl to authenticate with the Rancher server and get a n 3. FreeIPA 4. OpenLDAP 5. SAML providers: Ping, Okta, ADFS, Keycloak, Shibboleth +6. Azure AD When you first run kubectl, for example, `kubectl get pods`, you are prompted to pick an auth provider and log in with the Rancher server. The kubeconfig token is cached in the path where you run kubectl under `./.cache/token`. This token is valid until [it expires](../../api/api-tokens.md#disable-tokens-in-generated-kubeconfigs), or [gets deleted from the Rancher server](../../api/api-tokens.md#deleting-tokens). Upon expiration, you must log in with the Rancher server again to run the `kubectl get pods` command. diff --git a/versioned_docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-azure-ad.md b/versioned_docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-azure-ad.md index 7882e6d9be4..b17daeabbcd 100644 --- a/versioned_docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-azure-ad.md +++ b/versioned_docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-azure-ad.md @@ -133,7 +133,17 @@ Here are a few examples of permission combinations that satisfy Rancher's needs: ::: -#### 4. Copy Azure Application Data +#### 4. Allow Public Client Flows + +To login from Rancher CLI you must allow public client flows: + +1. From the left navigation menu, select **Authentication**. + +1. Under **Advanced Settings**, select **Yes** on the toggle next to **Allow public client flows**. + + ![Allow Public Client Flows](/img/azure-public-client-flows.png) + +#### 5. Copy Azure Application Data ![Application ID](/img/app-configuration.png) @@ -176,7 +186,7 @@ You'll also need to manually enter the Graph, Token, and Auth Endpoints. - **OAuth 2.0 token endpoint (v1)** (Token Endpoint) - **OAuth 2.0 authorization endpoint (v1)** (Auth Endpoint) -#### 5. Configure Azure AD in Rancher +#### 6. Configure Azure AD in Rancher To complete configuration, enter information about your AD instance in the Rancher UI. @@ -188,7 +198,7 @@ To complete configuration, enter information about your AD instance in the Ranch 1. Click **AzureAD**. -1. Complete the **Configure Azure AD Account** form using the information you copied while completing [Copy Azure Application Data](#4-copy-azure-application-data). +1. Complete the **Configure Azure AD Account** form using the information you copied while completing [Copy Azure Application Data](#5-copy-azure-application-data). :::caution @@ -353,4 +363,3 @@ Since the filter prevents Rancher from seeing that the user belongs to an exclud >- If you don't wish to upgrade to v2.7.0+ after the Azure AD Graph API is retired, you'll need to either: - Use the built-in Rancher auth or - Use another third-party auth system and set that up in Rancher. Please see the [authentication docs](authentication-config.md) to learn how to configure other open authentication providers. - diff --git a/versioned_docs/version-2.9/reference-guides/cli-with-rancher/kubectl-utility.md b/versioned_docs/version-2.9/reference-guides/cli-with-rancher/kubectl-utility.md index b3f49191ede..5b863d2e4be 100644 --- a/versioned_docs/version-2.9/reference-guides/cli-with-rancher/kubectl-utility.md +++ b/versioned_docs/version-2.9/reference-guides/cli-with-rancher/kubectl-utility.md @@ -32,5 +32,6 @@ This feature enables kubectl to authenticate with the Rancher server and get a n 3. FreeIPA 4. OpenLDAP 5. SAML providers: Ping, Okta, ADFS, Keycloak, Shibboleth +6. Azure AD When you first run kubectl, for example, `kubectl get pods`, you are prompted to pick an auth provider and log in with the Rancher server. The kubeconfig token is cached in the path where you run kubectl under `./.cache/token`. This token is valid until [it expires](../../api/api-tokens.md#disable-tokens-in-generated-kubeconfigs), or [gets deleted from the Rancher server](../../api/api-tokens.md#deleting-tokens). Upon expiration, you must log in with the Rancher server again to run the `kubectl get pods` command.