mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-27 13:38:07 +00:00
411 lines
18 KiB
JavaScript
411 lines
18 KiB
JavaScript
"use strict";
|
||
(self["webpackChunkrancher_docs"] = self["webpackChunkrancher_docs"] || []).push([[19214],{
|
||
|
||
/***/ 3905:
|
||
/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
|
||
|
||
/* harmony export */ __webpack_require__.d(__webpack_exports__, {
|
||
/* harmony export */ Zo: () => (/* binding */ MDXProvider),
|
||
/* harmony export */ kt: () => (/* binding */ createElement)
|
||
/* harmony export */ });
|
||
/* unused harmony exports MDXContext, useMDXComponents, withMDXComponents */
|
||
/* harmony import */ var react__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(67294);
|
||
|
||
|
||
function _defineProperty(obj, key, value) {
|
||
if (key in obj) {
|
||
Object.defineProperty(obj, key, {
|
||
value: value,
|
||
enumerable: true,
|
||
configurable: true,
|
||
writable: true
|
||
});
|
||
} else {
|
||
obj[key] = value;
|
||
}
|
||
|
||
return obj;
|
||
}
|
||
|
||
function _extends() {
|
||
_extends = Object.assign || function (target) {
|
||
for (var i = 1; i < arguments.length; i++) {
|
||
var source = arguments[i];
|
||
|
||
for (var key in source) {
|
||
if (Object.prototype.hasOwnProperty.call(source, key)) {
|
||
target[key] = source[key];
|
||
}
|
||
}
|
||
}
|
||
|
||
return target;
|
||
};
|
||
|
||
return _extends.apply(this, arguments);
|
||
}
|
||
|
||
function ownKeys(object, enumerableOnly) {
|
||
var keys = Object.keys(object);
|
||
|
||
if (Object.getOwnPropertySymbols) {
|
||
var symbols = Object.getOwnPropertySymbols(object);
|
||
if (enumerableOnly) symbols = symbols.filter(function (sym) {
|
||
return Object.getOwnPropertyDescriptor(object, sym).enumerable;
|
||
});
|
||
keys.push.apply(keys, symbols);
|
||
}
|
||
|
||
return keys;
|
||
}
|
||
|
||
function _objectSpread2(target) {
|
||
for (var i = 1; i < arguments.length; i++) {
|
||
var source = arguments[i] != null ? arguments[i] : {};
|
||
|
||
if (i % 2) {
|
||
ownKeys(Object(source), true).forEach(function (key) {
|
||
_defineProperty(target, key, source[key]);
|
||
});
|
||
} else if (Object.getOwnPropertyDescriptors) {
|
||
Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
|
||
} else {
|
||
ownKeys(Object(source)).forEach(function (key) {
|
||
Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
|
||
});
|
||
}
|
||
}
|
||
|
||
return target;
|
||
}
|
||
|
||
function _objectWithoutPropertiesLoose(source, excluded) {
|
||
if (source == null) return {};
|
||
var target = {};
|
||
var sourceKeys = Object.keys(source);
|
||
var key, i;
|
||
|
||
for (i = 0; i < sourceKeys.length; i++) {
|
||
key = sourceKeys[i];
|
||
if (excluded.indexOf(key) >= 0) continue;
|
||
target[key] = source[key];
|
||
}
|
||
|
||
return target;
|
||
}
|
||
|
||
function _objectWithoutProperties(source, excluded) {
|
||
if (source == null) return {};
|
||
|
||
var target = _objectWithoutPropertiesLoose(source, excluded);
|
||
|
||
var key, i;
|
||
|
||
if (Object.getOwnPropertySymbols) {
|
||
var sourceSymbolKeys = Object.getOwnPropertySymbols(source);
|
||
|
||
for (i = 0; i < sourceSymbolKeys.length; i++) {
|
||
key = sourceSymbolKeys[i];
|
||
if (excluded.indexOf(key) >= 0) continue;
|
||
if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
|
||
target[key] = source[key];
|
||
}
|
||
}
|
||
|
||
return target;
|
||
}
|
||
|
||
var isFunction = function isFunction(obj) {
|
||
return typeof obj === 'function';
|
||
};
|
||
|
||
var MDXContext = /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.createContext({});
|
||
var withMDXComponents = function withMDXComponents(Component) {
|
||
return function (props) {
|
||
var allComponents = useMDXComponents(props.components);
|
||
return /*#__PURE__*/React.createElement(Component, _extends({}, props, {
|
||
components: allComponents
|
||
}));
|
||
};
|
||
};
|
||
var useMDXComponents = function useMDXComponents(components) {
|
||
var contextComponents = react__WEBPACK_IMPORTED_MODULE_0__.useContext(MDXContext);
|
||
var allComponents = contextComponents;
|
||
|
||
if (components) {
|
||
allComponents = isFunction(components) ? components(contextComponents) : _objectSpread2(_objectSpread2({}, contextComponents), components);
|
||
}
|
||
|
||
return allComponents;
|
||
};
|
||
var MDXProvider = function MDXProvider(props) {
|
||
var allComponents = useMDXComponents(props.components);
|
||
return /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.createElement(MDXContext.Provider, {
|
||
value: allComponents
|
||
}, props.children);
|
||
};
|
||
|
||
var TYPE_PROP_NAME = 'mdxType';
|
||
var DEFAULTS = {
|
||
inlineCode: 'code',
|
||
wrapper: function wrapper(_ref) {
|
||
var children = _ref.children;
|
||
return /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.createElement(react__WEBPACK_IMPORTED_MODULE_0__.Fragment, {}, children);
|
||
}
|
||
};
|
||
var MDXCreateElement = /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.forwardRef(function (props, ref) {
|
||
var propComponents = props.components,
|
||
mdxType = props.mdxType,
|
||
originalType = props.originalType,
|
||
parentName = props.parentName,
|
||
etc = _objectWithoutProperties(props, ["components", "mdxType", "originalType", "parentName"]);
|
||
|
||
var components = useMDXComponents(propComponents);
|
||
var type = mdxType;
|
||
var Component = components["".concat(parentName, ".").concat(type)] || components[type] || DEFAULTS[type] || originalType;
|
||
|
||
if (propComponents) {
|
||
return /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.createElement(Component, _objectSpread2(_objectSpread2({
|
||
ref: ref
|
||
}, etc), {}, {
|
||
components: propComponents
|
||
}));
|
||
}
|
||
|
||
return /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.createElement(Component, _objectSpread2({
|
||
ref: ref
|
||
}, etc));
|
||
});
|
||
MDXCreateElement.displayName = 'MDXCreateElement';
|
||
function createElement (type, props) {
|
||
var args = arguments;
|
||
var mdxType = props && props.mdxType;
|
||
|
||
if (typeof type === 'string' || mdxType) {
|
||
var argsLength = args.length;
|
||
var createElementArgArray = new Array(argsLength);
|
||
createElementArgArray[0] = MDXCreateElement;
|
||
var newProps = {};
|
||
|
||
for (var key in props) {
|
||
if (hasOwnProperty.call(props, key)) {
|
||
newProps[key] = props[key];
|
||
}
|
||
}
|
||
|
||
newProps.originalType = type;
|
||
newProps[TYPE_PROP_NAME] = typeof type === 'string' ? type : mdxType;
|
||
createElementArgArray[1] = newProps;
|
||
|
||
for (var i = 2; i < argsLength; i++) {
|
||
createElementArgArray[i] = args[i];
|
||
}
|
||
|
||
return react__WEBPACK_IMPORTED_MODULE_0__.createElement.apply(null, createElementArgArray);
|
||
}
|
||
|
||
return react__WEBPACK_IMPORTED_MODULE_0__.createElement.apply(null, args);
|
||
}
|
||
|
||
|
||
|
||
|
||
/***/ }),
|
||
|
||
/***/ 79066:
|
||
/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
|
||
|
||
__webpack_require__.r(__webpack_exports__);
|
||
/* harmony export */ __webpack_require__.d(__webpack_exports__, {
|
||
/* harmony export */ assets: () => (/* binding */ assets),
|
||
/* harmony export */ contentTitle: () => (/* binding */ contentTitle),
|
||
/* harmony export */ "default": () => (/* binding */ MDXContent),
|
||
/* harmony export */ frontMatter: () => (/* binding */ frontMatter),
|
||
/* harmony export */ metadata: () => (/* binding */ metadata),
|
||
/* harmony export */ toc: () => (/* binding */ toc)
|
||
/* harmony export */ });
|
||
/* harmony import */ var react__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(67294);
|
||
/* harmony import */ var _mdx_js_react__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3905);
|
||
/* @jsxRuntime classic */ /* @jsx mdx */ /* @jsxFrag React.Fragment */ function _define_property(obj, key, value) {
|
||
if (key in obj) {
|
||
Object.defineProperty(obj, key, {
|
||
value: value,
|
||
enumerable: true,
|
||
configurable: true,
|
||
writable: true
|
||
});
|
||
} else {
|
||
obj[key] = value;
|
||
}
|
||
return obj;
|
||
}
|
||
function _object_spread(target) {
|
||
for(var i = 1; i < arguments.length; i++){
|
||
var source = arguments[i] != null ? arguments[i] : {};
|
||
var ownKeys = Object.keys(source);
|
||
if (typeof Object.getOwnPropertySymbols === "function") {
|
||
ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
|
||
return Object.getOwnPropertyDescriptor(source, sym).enumerable;
|
||
}));
|
||
}
|
||
ownKeys.forEach(function(key) {
|
||
_define_property(target, key, source[key]);
|
||
});
|
||
}
|
||
return target;
|
||
}
|
||
function ownKeys(object, enumerableOnly) {
|
||
var keys = Object.keys(object);
|
||
if (Object.getOwnPropertySymbols) {
|
||
var symbols = Object.getOwnPropertySymbols(object);
|
||
if (enumerableOnly) {
|
||
symbols = symbols.filter(function(sym) {
|
||
return Object.getOwnPropertyDescriptor(object, sym).enumerable;
|
||
});
|
||
}
|
||
keys.push.apply(keys, symbols);
|
||
}
|
||
return keys;
|
||
}
|
||
function _object_spread_props(target, source) {
|
||
source = source != null ? source : {};
|
||
if (Object.getOwnPropertyDescriptors) {
|
||
Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
|
||
} else {
|
||
ownKeys(Object(source)).forEach(function(key) {
|
||
Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
|
||
});
|
||
}
|
||
return target;
|
||
}
|
||
function _object_without_properties(source, excluded) {
|
||
if (source == null) return {};
|
||
var target = _object_without_properties_loose(source, excluded);
|
||
var key, i;
|
||
if (Object.getOwnPropertySymbols) {
|
||
var sourceSymbolKeys = Object.getOwnPropertySymbols(source);
|
||
for(i = 0; i < sourceSymbolKeys.length; i++){
|
||
key = sourceSymbolKeys[i];
|
||
if (excluded.indexOf(key) >= 0) continue;
|
||
if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
|
||
target[key] = source[key];
|
||
}
|
||
}
|
||
return target;
|
||
}
|
||
function _object_without_properties_loose(source, excluded) {
|
||
if (source == null) return {};
|
||
var target = {};
|
||
var sourceKeys = Object.keys(source);
|
||
var key, i;
|
||
for(i = 0; i < sourceKeys.length; i++){
|
||
key = sourceKeys[i];
|
||
if (excluded.indexOf(key) >= 0) continue;
|
||
target[key] = source[key];
|
||
}
|
||
return target;
|
||
}
|
||
|
||
|
||
const frontMatter = {
|
||
title: 'Group Permissions with Shibboleth and OpenLDAP'
|
||
};
|
||
const contentTitle = undefined;
|
||
const metadata = {
|
||
"unversionedId": "how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-authentication/configure-shibboleth-saml/about-group-permissions",
|
||
"id": "version-2.5/how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-authentication/configure-shibboleth-saml/about-group-permissions",
|
||
"title": "Group Permissions with Shibboleth and OpenLDAP",
|
||
"description": "Because Shibboleth is a SAML provider, it doesn't support searching for groups. While a Shibboleth integration can validate user credentials, it can't be used to assign permissions to groups in Rancher without additional configuration.",
|
||
"source": "@site/versioned_docs/version-2.5/how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-authentication/configure-shibboleth-saml/about-group-permissions.md",
|
||
"sourceDirName": "how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-authentication/configure-shibboleth-saml",
|
||
"slug": "/how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-authentication/configure-shibboleth-saml/about-group-permissions",
|
||
"permalink": "/v2.5/how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-authentication/configure-shibboleth-saml/about-group-permissions",
|
||
"draft": false,
|
||
"editUrl": "https://github.com/rancher/rancher-docs/edit/main/versioned_docs/version-2.5/how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-authentication/configure-shibboleth-saml/about-group-permissions.md",
|
||
"tags": [],
|
||
"version": "2.5",
|
||
"lastUpdatedAt": 1687549984,
|
||
"formattedLastUpdatedAt": "Jun 23, 2023",
|
||
"frontMatter": {
|
||
"title": "Group Permissions with Shibboleth and OpenLDAP"
|
||
},
|
||
"sidebar": "tutorialSidebar",
|
||
"previous": {
|
||
"title": "Configuring Shibboleth (SAML)",
|
||
"permalink": "/v2.5/how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-authentication/configure-shibboleth-saml/"
|
||
},
|
||
"next": {
|
||
"title": "Managing Role-Based Access Control (RBAC)",
|
||
"permalink": "/v2.5/how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/"
|
||
}
|
||
};
|
||
const assets = {};
|
||
const toc = [
|
||
{
|
||
value: 'Terminology',
|
||
id: 'terminology',
|
||
level: 3
|
||
},
|
||
{
|
||
value: 'Adding OpenLDAP Group Permissions to Rancher Resources',
|
||
id: 'adding-openldap-group-permissions-to-rancher-resources',
|
||
level: 3
|
||
}
|
||
];
|
||
const layoutProps = {
|
||
toc
|
||
};
|
||
const MDXLayout = "wrapper";
|
||
function MDXContent(_param) {
|
||
var { components } = _param, props = _object_without_properties(_param, [
|
||
"components"
|
||
]);
|
||
return /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)(MDXLayout, _object_spread_props(_object_spread({}, layoutProps, props), {
|
||
components: components,
|
||
mdxType: "MDXLayout"
|
||
}), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("head", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("link", {
|
||
rel: "canonical",
|
||
href: "https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions"
|
||
})), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Because Shibboleth is a SAML provider, it doesn't support searching for groups. While a Shibboleth integration can validate user credentials, it can't be used to assign permissions to groups in Rancher without additional configuration.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `One solution to this problem is to configure an OpenLDAP identity provider. With an OpenLDAP back end for Shibboleth, you will be able to search for groups in Rancher and assign them to resources such as clusters, projects, or namespaces from the Rancher UI.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
|
||
"id": "terminology"
|
||
}, `Terminology`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("ul", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
|
||
parentName: "ul"
|
||
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
|
||
parentName: "li"
|
||
}, `Shibboleth`), ` is a single sign-on log-in system for computer networks and the Internet. It allows people to sign in using just one identity to various systems. It validates user credentials, but does not, on its own, handle group memberships.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
|
||
parentName: "ul"
|
||
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
|
||
parentName: "li"
|
||
}, `SAML:`), ` Security Assertion Markup Language, an open standard for exchanging authentication and authorization data between an identity provider and a service provider.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
|
||
parentName: "ul"
|
||
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
|
||
parentName: "li"
|
||
}, `OpenLDAP:`), ` a free, open-source implementation of the Lightweight Directory Access Protocol (LDAP). It is used to manage an organization’s computers and users. OpenLDAP is useful for Rancher users because it supports groups. In Rancher, it is possible to assign permissions to groups so that they can access resources such as clusters, projects, or namespaces, as long as the groups already exist in the identity provider.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
|
||
parentName: "ul"
|
||
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
|
||
parentName: "li"
|
||
}, `IdP or IDP:`), ` An identity provider. OpenLDAP is an example of an identity provider.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
|
||
"id": "adding-openldap-group-permissions-to-rancher-resources"
|
||
}, `Adding OpenLDAP Group Permissions to Rancher Resources`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `The diagram below illustrates how members of an OpenLDAP group can access resources in Rancher that the group has permissions for.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `For example, a cluster owner could add an OpenLDAP group to a cluster so that they have permissions view most cluster level resources and create new projects. Then the OpenLDAP group members will have access to the cluster as soon as they log in to Rancher.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `In this scenario, OpenLDAP allows the cluster owner to search for groups when assigning persmissions. Without OpenLDAP, the functionality to search for groups would not be supported.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `When a member of the OpenLDAP group logs in to Rancher, she is redirected to Shibboleth and enters her username and password.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Shibboleth validates her credentials, and retrieves user attributes from OpenLDAP, including groups. Then Shibboleth sends a SAML assertion to Rancher including the user attributes. Rancher uses the group data so that she can access all of the resources and permissions that her groups have permissions for.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("img", {
|
||
alt: "Adding OpenLDAP Group Permissions to Rancher Resources",
|
||
src: (__webpack_require__(48277)/* ["default"] */ .Z),
|
||
width: "656",
|
||
height: "730"
|
||
})));
|
||
}
|
||
MDXContent.isMDXComponent = true;
|
||
|
||
|
||
/***/ }),
|
||
|
||
/***/ 48277:
|
||
/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
|
||
|
||
/* harmony export */ __webpack_require__.d(__webpack_exports__, {
|
||
/* harmony export */ Z: () => (__WEBPACK_DEFAULT_EXPORT__)
|
||
/* harmony export */ });
|
||
/* harmony default export */ const __WEBPACK_DEFAULT_EXPORT__ = (__webpack_require__.p + "assets/images/shibboleth-with-openldap-groups-f337a46dd2c87e8342c13b8486a8c7b9.svg");
|
||
|
||
/***/ })
|
||
|
||
}]); |