Files
rancher-docs/pages-for-subheaders/configure-shibboleth-saml.html
T

26 lines
38 KiB
HTML
Raw Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
<!doctype html>
<html lang="en" dir="ltr" class="docs-wrapper docs-doc-page docs-version-current plugin-docs plugin-id-default docs-doc-id-pages-for-subheaders/configure-shibboleth-saml">
<head>
<meta charset="UTF-8">
<meta name="generator" content="Docusaurus v2.2.0">
<title data-rh="true">Configuring Shibboleth (SAML) | Rancher Manager</title><meta data-rh="true" name="viewport" content="width=device-width,initial-scale=1"><meta data-rh="true" name="twitter:card" content="summary_large_image"><meta data-rh="true" property="og:url" content="http://ranchermanager.docs.rancher.com/pages-for-subheaders/configure-shibboleth-saml"><meta data-rh="true" name="docusaurus_locale" content="en"><meta data-rh="true" name="docsearch:language" content="en"><meta data-rh="true" name="docusaurus_version" content="current"><meta data-rh="true" name="docusaurus_tag" content="docs-default-current"><meta data-rh="true" name="docsearch:version" content="current"><meta data-rh="true" name="docsearch:docusaurus_tag" content="docs-default-current"><meta data-rh="true" property="og:title" content="Configuring Shibboleth (SAML) | Rancher Manager"><meta data-rh="true" name="description" content="If your organization uses Shibboleth Identity Provider (IdP) for user authentication, you can configure Rancher to allow your users to log in to Rancher using their Shibboleth credentials."><meta data-rh="true" property="og:description" content="If your organization uses Shibboleth Identity Provider (IdP) for user authentication, you can configure Rancher to allow your users to log in to Rancher using their Shibboleth credentials."><link data-rh="true" rel="icon" href="/img/favicon.png"><link data-rh="true" rel="canonical" href="http://ranchermanager.docs.rancher.com/pages-for-subheaders/configure-shibboleth-saml"><link data-rh="true" rel="alternate" href="http://ranchermanager.docs.rancher.com/pages-for-subheaders/configure-shibboleth-saml" hreflang="en"><link data-rh="true" rel="alternate" href="http://ranchermanager.docs.rancher.com/zh/pages-for-subheaders/configure-shibboleth-saml" hreflang="zh"><link data-rh="true" rel="alternate" href="http://ranchermanager.docs.rancher.com/pages-for-subheaders/configure-shibboleth-saml" hreflang="x-default"><link data-rh="true" rel="preconnect" href="https://30NEY6C9UY-dsn.algolia.net" crossorigin="anonymous"><link rel="search" type="application/opensearchdescription+xml" title="Rancher Manager" href="/opensearch.xml">
<!-- Google Tag Manager -->
<script>!function(e,t,a,n,g){e[n]=e[n]||[],e[n].push({"gtm.start":(new Date).getTime(),event:"gtm.js"});var m=t.getElementsByTagName(a)[0],r=t.createElement(a);r.async=!0,r.src="https://www.googletagmanager.com/gtm.js?id=GTM-57KS2MW",m.parentNode.insertBefore(r,m)}(window,document,"script","dataLayer")</script>
<!-- End Google Tag Manager -->
<script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" charset="UTF-8" data-domain-script="0f98beb0-fc4c-417d-a42e-564e2cae42d2" async></script>
<script src="/scripts/optanonwrapper.js" async></script><link rel="stylesheet" href="/assets/css/styles.f7a82f66.css">
<link rel="preload" href="/assets/js/runtime~main.c0888e46.js" as="script">
<link rel="preload" href="/assets/js/main.bc6fd292.js" as="script">
</head>
<body class="navigation-with-keyboard">
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
<div role="region" aria-label="Skip to main content"><a class="skipToContent_fXgn" href="#docusaurus_skipToContent_fallback">Skip to main content</a></div><nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Toggle navigation bar" aria-expanded="false" class="navbar__toggle clean-btn" type="button"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/"><div class="navbar__logo"><img src="/img/rancher-logo-horiz-color.svg" alt="logo" class="themedImage_ToTc themedImage--light_HNdA"><img src="/img/rancher-logo-horiz-color.svg" alt="logo" class="themedImage_ToTc themedImage--dark_i4oU"></div><b class="navbar__title text--truncate"></b></a><div class="navbar__item dropdown dropdown--hoverable"><a aria-current="page" class="navbar__link active" aria-haspopup="true" aria-expanded="false" role="button" href="/">v2.7</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/pages-for-subheaders/configure-shibboleth-saml">v2.7</a></li><li><a class="dropdown__link" href="/v2.6/pages-for-subheaders/configure-shibboleth-saml">v2.6</a></li><li><a class="dropdown__link" href="/v2.5/pages-for-subheaders/configure-shibboleth-saml">v2.5</a></li><li><a class="dropdown__link" href="/v2.0-v2.4/pages-for-subheaders/configure-shibboleth-saml">v2.0-v2.4</a></li><li><a class="dropdown__link" href="/versions">All versions</a></li></ul></div></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a href="#" aria-haspopup="true" aria-expanded="false" role="button" class="navbar__link"><svg viewBox="0 0 24 24" width="20" height="20" aria-hidden="true" class="iconLanguage_nlXk"><path fill="currentColor" d="M12.87 15.07l-2.54-2.51.03-.03c1.74-1.94 2.98-4.17 3.71-6.53H17V4h-7V2H8v2H1v1.99h11.17C11.5 7.92 10.44 9.75 9 11.35 8.07 10.32 7.3 9.19 6.69 8h-2c.73 1.63 1.73 3.17 2.98 4.56l-5.09 5.02L4 19l5-5 3.11 3.11.76-2.04zM18.5 10h-2L12 22h2l1.12-3h4.75L21 22h2l-4.5-12zm-2.62 7l1.62-4.33L19.12 17h-3.24z"></path></svg>English</a><ul class="dropdown__menu"><li><a href="/pages-for-subheaders/configure-shibboleth-saml" target="_self" rel="noopener noreferrer" class="dropdown__link dropdown__link--active" lang="en">English</a></li><li><a href="/zh/pages-for-subheaders/configure-shibboleth-saml" target="_self" rel="noopener noreferrer" class="dropdown__link" lang="zh">简体中文</a></li></ul></div><a href="https://github.com/rancher/rancher-docs" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link navbar__github">GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a><a href="https://rancher.com" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">Rancher Home<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a><div class="searchBox_ZlJk"><button type="button" class="DocSearch DocSearch-Button" aria-label="Search"><span class="DocSearch-Button-Container"><svg width="20" height="20" class="DocSearch-Search-Icon" viewBox="0 0 20 20"><path d="M14.386 14.386l4.0877 4.0877-4.0877-4.0877c-2.9418 2.9419-7.7115 2.9419-10.6533 0-2.9419-2.9418-2.9419-7.7115 0-10.6533 2.9418-2.9419 7.7115-2.9419 10.6533 0 2.9419 2.9418 2.9419 7.7115 0 10.6533z" stroke="currentColor" fill="none" fill-rule="evenodd" stroke-linecap="round" stroke-linejoin="round"></path></svg><span class="DocSearch-Button-Placeholder">Search</span></span><span class="DocSearch-Button-Keys"></span></button></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div id="docusaurus_skipToContent_fallback" class="main-wrapper mainWrapper_z2l0 docsWrapper_BCFX"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_sjWU" type="button"></button><div class="docPage__5DB"><aside class="theme-doc-sidebar-container docSidebarContainer_b6E3"><div class="sidebar_njMd"><nav class="menu thin-scrollbar menu_SIkG"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/">What is Rancher?</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/getting-started/overview">Getting Started</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret menu__link--active" aria-expanded="true" href="/pages-for-subheaders/new-user-guides">How-to Guides</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--active" aria-expanded="true" tabindex="0" href="/pages-for-subheaders/new-user-guides">New User Guides</a><button aria-label="Toggle the collapsible sidebar category &#x27;New User Guides&#x27;" type="button" class="clean-btn menu__caret"></button></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-3 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--active" aria-expanded="true" tabindex="0" href="/pages-for-subheaders/authentication-permissions-and-global-configuration">Authentication, Permissions, and Global Configuration</a><button aria-label="Toggle the collapsible sidebar category &#x27;Authentication, Permissions, and Global Configuration&#x27;" type="button" class="clean-btn menu__caret"></button></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-4 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/authentication-config">Authentication Config</a><button aria-label="Toggle the collapsible sidebar category &#x27;Authentication Config&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-4 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/configure-openldap">Configure OpenLDAP</a><button aria-label="Toggle the collapsible sidebar category &#x27;Configure OpenLDAP&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-4 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/configure-microsoft-ad-federation-service-saml">Configure Microsoft AD Federation Service (SAML)</a><button aria-label="Toggle the collapsible sidebar category &#x27;Configure Microsoft AD Federation Service (SAML)&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-4 menu__list-item"><div class="menu__list-item-collapsible menu__list-item-collapsible--active"><a class="menu__link menu__link--sublist menu__link--active" aria-current="page" aria-expanded="true" tabindex="0" href="/pages-for-subheaders/configure-shibboleth-saml">Configure Shibboleth (SAML)</a><button aria-label="Toggle the collapsible sidebar category &#x27;Configure Shibboleth (SAML)&#x27;" type="button" class="clean-btn menu__caret"></button></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-5 menu__list-item"><a class="menu__link" tabindex="0" href="/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions">Group Permissions with Shibboleth and OpenLDAP</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-4 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/manage-role-based-access-control-rbac">Manage Role-Based Access Control (RBAC)</a><button aria-label="Toggle the collapsible sidebar category &#x27;Manage Role-Based Access Control (RBAC)&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-4 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/about-provisioning-drivers">About Provisioning Drivers</a><button aria-label="Toggle the collapsible sidebar category &#x27;About Provisioning Drivers&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-4 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/about-rke1-templates">About RKE1 Templates</a><button aria-label="Toggle the collapsible sidebar category &#x27;About RKE1 Templates&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-4 menu__list-item"><a class="menu__link" tabindex="0" href="/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-cluster-templates">Cluster Templates</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-4 menu__list-item"><a class="menu__link" tabindex="0" href="/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/create-pod-security-policies">Pod Security Policies</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-4 menu__list-item"><a class="menu__link" tabindex="0" href="/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/global-default-private-registry">Configuring a Global Default Private Registry</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-4 menu__list-item"><a class="menu__link" tabindex="0" href="/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/custom-branding">Custom Branding</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-3 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/manage-clusters">Manage Clusters</a><button aria-label="Toggle the collapsible sidebar category &#x27;Manage Clusters&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-3 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/kubernetes-cluster-setup">Kubernetes Cluster Setup</a><button aria-label="Toggle the collapsible sidebar category &#x27;Kubernetes Cluster Setup&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-3 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/infrastructure-setup">Infrastructure Setup</a><button aria-label="Toggle the collapsible sidebar category &#x27;Infrastructure Setup&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-3 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/kubernetes-clusters-in-rancher-setup">Kubernetes Clusters in Rancher Setup</a><button aria-label="Toggle the collapsible sidebar category &#x27;Kubernetes Clusters in Rancher Setup&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-3 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/launch-kubernetes-with-rancher">Launch Kubernetes with Rancher</a><button aria-label="Toggle the collapsible sidebar category &#x27;Launch Kubernetes with Rancher&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-3 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/kubernetes-resources-setup">Kubernetes Resources Setup</a><button aria-label="Toggle the collapsible sidebar category &#x27;Kubernetes Resources Setup&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-3 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/helm-charts-in-rancher">Helm Charts in Rancher</a><button aria-label="Toggle the collapsible sidebar category &#x27;Helm Charts in Rancher&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-3 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/deploy-apps-across-clusters">Deploy Apps Across Clusters</a><button aria-label="Toggle the collapsible sidebar category &#x27;Deploy Apps Across Clusters&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-3 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/backup-restore-and-disaster-recovery">Backup, Restore, and Disaster Recovery</a><button aria-label="Toggle the collapsible sidebar category &#x27;Backup, Restore, and Disaster Recovery&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/how-to-guides/new-user-guides/add-users-to-projects">Adding Users to Projects</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/how-to-guides/new-user-guides/manage-namespaces">Namespaces</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/advanced-user-guides">Advanced User Guides</a><button aria-label="Toggle the collapsible sidebar category &#x27;Advanced User Guides&#x27;" type="button" class="clean-btn menu__caret"></button></div></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/pages-for-subheaders/best-practices">Reference Guides</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/pages-for-subheaders/cloud-marketplace">Integrations in Rancher</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/faq/general-faq">FAQ</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/troubleshooting/general-troubleshooting">Troubleshooting</a></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/contribute-to-rancher">Contributing to Rancher</a></li></ul></nav></div></aside><main class="docMainContainer_gTbr"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_VOVn"><div class="docItemContainer_Djhp"><article><nav class="theme-doc-breadcrumbs breadcrumbsContainer_Z_bl" aria-label="Breadcrumbs"><ul class="breadcrumbs" itemscope="" itemtype="https://schema.org/BreadcrumbList"><li class="breadcrumbs__item"><a aria-label="Home page" class="breadcrumbs__link" href="/"><svg viewBox="0 0 24 24" class="breadcrumbHomeIcon_OVgt"><path d="M10 19v-5h4v5c0 .55.45 1 1 1h3c.55 0 1-.45 1-1v-7h1.7c.46 0 .68-.57.33-.87L12.67 3.6c-.38-.34-.96-.34-1.34 0l-8.36 7.53c-.34.3-.13.87.33.87H5v7c0 .55.45 1 1 1h3c.55 0 1-.45 1-1z" fill="currentColor"></path></svg></a></li><li class="breadcrumbs__item"><span class="breadcrumbs__link">How-to Guides</span><meta itemprop="position" content="1"></li><li itemscope="" itemprop="itemListElement" itemtype="https://schema.org/ListItem" class="breadcrumbs__item"><a class="breadcrumbs__link" itemprop="item" href="/pages-for-subheaders/new-user-guides"><span itemprop="name">New User Guides</span></a><meta itemprop="position" content="2"></li><li itemscope="" itemprop="itemListElement" itemtype="https://schema.org/ListItem" class="breadcrumbs__item"><a class="breadcrumbs__link" itemprop="item" href="/pages-for-subheaders/authentication-permissions-and-global-configuration"><span itemprop="name">Authentication, Permissions, and Global Configuration</span></a><meta itemprop="position" content="3"></li><li itemscope="" itemprop="itemListElement" itemtype="https://schema.org/ListItem" class="breadcrumbs__item breadcrumbs__item--active"><span class="breadcrumbs__link" itemprop="name">Configure Shibboleth (SAML)</span><meta itemprop="position" content="4"></li></ul></nav><span class="theme-doc-version-badge badge badge--secondary">Version: v2.7</span><div class="tocCollapsible_ETCw theme-doc-toc-mobile tocMobile_ITEo"><button type="button" class="clean-btn tocCollapsibleButton_TO0P">On this page</button></div><div class="theme-doc-markdown markdown"><header><h1>Configuring Shibboleth (SAML)</h1></header><p>If your organization uses Shibboleth Identity Provider (IdP) for user authentication, you can configure Rancher to allow your users to log in to Rancher using their Shibboleth credentials.</p><p>In this configuration, when Rancher users log in, they will be redirected to the Shibboleth IdP to enter their credentials. After authentication, they will be redirected back to the Rancher UI.</p><p>If you also configure OpenLDAP as the back end to Shibboleth, it will return a SAML assertion to Rancher with user attributes that include groups. Then the authenticated user will be able to access resources in Rancher that their groups have permissions for.</p><blockquote><p>The instructions in this section assume that you understand how Rancher, Shibboleth, and OpenLDAP work together. For a more detailed explanation of how it works, refer to <a href="/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions">this page.</a></p></blockquote><h2 class="anchor anchorWithStickyNavbar_LWe7" id="setting-up-shibboleth-in-rancher">Setting up Shibboleth in Rancher<a class="hash-link" href="#setting-up-shibboleth-in-rancher" title="Direct link to heading">​</a></h2><h3 class="anchor anchorWithStickyNavbar_LWe7" id="shibboleth-prerequisites">Shibboleth Prerequisites<a class="hash-link" href="#shibboleth-prerequisites" title="Direct link to heading">​</a></h3><blockquote><ul><li>You must have a Shibboleth IdP Server configured.</li><li>Following are the Rancher Service Provider URLs needed for configuration:
Metadata URL: <code>https://&lt;rancher-server&gt;/v1-saml/shibboleth/saml/metadata</code>
Assertion Consumer Service (ACS) URL: <code>https://&lt;rancher-server&gt;/v1-saml/shibboleth/saml/acs</code></li><li>Export a <code>metadata.xml</code> file from your IdP Server. For more information, see the <a href="https://wiki.shibboleth.net/confluence/display/SP3/Home" target="_blank" rel="noopener noreferrer">Shibboleth documentation.</a></li></ul></blockquote><h3 class="anchor anchorWithStickyNavbar_LWe7" id="configure-shibboleth-in-rancher">Configure Shibboleth in Rancher<a class="hash-link" href="#configure-shibboleth-in-rancher" title="Direct link to heading">​</a></h3><p>If your organization uses Shibboleth for user authentication, you can configure Rancher to allow your users to log in using their IdP credentials.</p><ol><li><p>In the top left corner, click <strong>☰ &gt; Users &amp; Authentication</strong>.</p></li><li><p>In the left navigation menu, click <strong>Auth Provider</strong>.</p></li><li><p>Click <strong>Shibboleth</strong>.</p></li><li><p>Complete the <strong>Configure Shibboleth Account</strong> form. Shibboleth IdP lets you specify what data store you want to use. You can either add a database or use an existing ldap server. For example, if you select your Active Directory (AD) server, the examples below describe how you can map AD attributes to fields within Rancher.</p><ol><li><p><strong>Display Name Field</strong>: Enter the AD attribute that contains the display name of users (example: <code>displayName</code>).</p></li><li><p><strong>User Name Field</strong>: Enter the AD attribute that contains the user name/given name (example: <code>givenName</code>).</p></li><li><p><strong>UID Field</strong>: Enter an AD attribute that is unique to every user (example: <code>sAMAccountName</code>, <code>distinguishedName</code>).</p></li><li><p><strong>Groups Field</strong>: Make entries for managing group memberships (example: <code>memberOf</code>).</p></li><li><p><strong>Rancher API Host</strong>: Enter the URL for your Rancher Server.</p></li><li><p><strong>Private Key</strong> and <strong>Certificate</strong>: This is a key-certificate pair to create a secure shell between Rancher and your IdP.</p><p>You can generate one using an openssl command. For example:</p><div class="codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-text codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj &quot;/CN=myservice.example.com&quot;</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div></li><li><p><strong>IDP-metadata</strong>: The <code>metadata.xml</code> file that you exported from your IdP server.</p></li></ol></li></ol><ol><li><p>After you complete the <strong>Configure Shibboleth Account</strong> form, click <strong>Enable</strong>.</p><p>Rancher redirects you to the IdP login page. Enter credentials that authenticate with Shibboleth IdP to validate your Rancher Shibboleth configuration.</p><div class="theme-admonition theme-admonition-note alert alert--secondary admonition_LlT9"><div class="admonitionHeading_tbUL"><span class="admonitionIcon_kALy"><svg viewBox="0 0 14 16"><path fill-rule="evenodd" d="M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"></path></svg></span>note</div><div class="admonitionContent_S0QG"><p>You may have to disable your popup blocker to see the IdP login page.</p></div></div></li></ol><p><strong>Result:</strong> Rancher is configured to work with Shibboleth. Your users can now sign into Rancher using their Shibboleth logins.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="saml-provider-caveats">SAML Provider Caveats<a class="hash-link" href="#saml-provider-caveats" title="Direct link to heading">​</a></h3><p>If you configure Shibboleth without OpenLDAP, the following caveats apply due to the fact that SAML Protocol does not support search or lookup for users or groups.</p><ul><li>There is no validation on users or groups when assigning permissions to them in Rancher.</li><li>When adding users, the exact user IDs (i.e. UID Field) must be entered correctly. As you type the user ID, there will be no search for other user IDs that may match.</li><li>When adding groups, you must select the group from the drop-down that is next to the text box. Rancher assumes that any input from the text box is a user.</li><li>The group drop-down shows only the groups that you are a member of. You will not be able to add groups that you are not a member of.</li></ul><p>To enable searching for groups when assigning permissions in Rancher, you will need to configure a back end for the SAML provider that supports groups, such as OpenLDAP.</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="setting-up-openldap-in-rancher">Setting up OpenLDAP in Rancher<a class="hash-link" href="#setting-up-openldap-in-rancher" title="Direct link to heading">​</a></h2><p>If you also configure OpenLDAP as the back end to Shibboleth, it will return a SAML assertion to Rancher with user attributes that include groups. Then authenticated users will be able to access resources in Rancher that their groups have permissions for.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="openldap-prerequisites">OpenLDAP Prerequisites<a class="hash-link" href="#openldap-prerequisites" title="Direct link to heading">​</a></h3><p>Rancher must be configured with a LDAP bind account (aka service account) to search and retrieve LDAP entries pertaining to users and groups that should have access. It is recommended to not use an administrator account or personal account for this purpose and instead create a dedicated account in OpenLDAP with read-only access to users and groups under the configured search base (see below).</p><blockquote><p><strong>Using TLS?</strong></p><p>If the certificate used by the OpenLDAP server is self-signed or not from a recognized certificate authority, make sure have at hand the CA certificate (concatenated with any intermediate certificates) in PEM format. You will have to paste in this certificate during the configuration so that Rancher is able to validate the certificate chain.</p></blockquote><h3 class="anchor anchorWithStickyNavbar_LWe7" id="configure-openldap-in-rancher">Configure OpenLDAP in Rancher<a class="hash-link" href="#configure-openldap-in-rancher" title="Direct link to heading">​</a></h3><p>Configure the settings for the OpenLDAP server, groups and users. For help filling out each field, refer to the <a href="/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-openldap/openldap-config-reference">configuration reference.</a> Note that nested group membership is not available for Shibboleth.</p><blockquote><p>Before you proceed with the configuration, please familiarise yourself with the concepts of <a href="/pages-for-subheaders/authentication-config#external-authentication-configuration-and-principal-users">External Authentication Configuration and Principal Users</a>.</p></blockquote><ol><li>Log into the Rancher UI using the initial local <code>admin</code> account.</li><li>In the top left corner, click <strong>☰ &gt; Users &amp; Authentication</strong>.</li><li>In the left navigation menu, click <strong>Auth Provider</strong>.</li><li>Click <strong>OpenLDAP</strong>. The <strong>Configure an OpenLDAP server</strong> form will be displayed.</li></ol><h2 class="anchor anchorWithStickyNavbar_LWe7" id="troubleshooting">Troubleshooting<a class="hash-link" href="#troubleshooting" title="Direct link to heading">​</a></h2><p>If you are experiencing issues while testing the connection to the OpenLDAP server, first double-check the credentials entered for the service account as well as the search base configuration. You may also inspect the Rancher logs to help pinpointing the problem cause. Debug logs may contain more detailed information about the error. Please refer to <a href="/faq/technical-items#how-can-i-enable-debug-logging">How can I enable debug logging</a> in this documentation.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/rancher/rancher-docs/edit/main/docs/pages-for-subheaders/configure-shibboleth-saml.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_Z9Sw" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_vwxv"><span class="theme-last-updated">Last updated<!-- --> on <b><time datetime="2022-10-29T00:09:06.000Z">Oct 29, 2022</time></b></span></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><a class="pagination-nav__link pagination-nav__link--prev" href="/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">2. Configuring Rancher for Microsoft AD FS</div></a><a class="pagination-nav__link pagination-nav__link--next" href="/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Group Permissions with Shibboleth and OpenLDAP</div></a></nav></div></div><div class="col col--3"><div class="tableOfContents_bqdL thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#setting-up-shibboleth-in-rancher" class="table-of-contents__link toc-highlight">Setting up Shibboleth in Rancher</a><ul><li><a href="#shibboleth-prerequisites" class="table-of-contents__link toc-highlight">Shibboleth Prerequisites</a></li><li><a href="#configure-shibboleth-in-rancher" class="table-of-contents__link toc-highlight">Configure Shibboleth in Rancher</a></li><li><a href="#saml-provider-caveats" class="table-of-contents__link toc-highlight">SAML Provider Caveats</a></li></ul></li><li><a href="#setting-up-openldap-in-rancher" class="table-of-contents__link toc-highlight">Setting up OpenLDAP in Rancher</a><ul><li><a href="#openldap-prerequisites" class="table-of-contents__link toc-highlight">OpenLDAP Prerequisites</a></li><li><a href="#configure-openldap-in-rancher" class="table-of-contents__link toc-highlight">Configure OpenLDAP in Rancher</a></li></ul></li><li><a href="#troubleshooting" class="table-of-contents__link toc-highlight">Troubleshooting</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2023 SUSE Rancher. All Rights Reserved.</div></div></div></footer></div>
<script src="/assets/js/runtime~main.c0888e46.js"></script>
<script src="/assets/js/main.bc6fd292.js"></script>
<!-- Google Tag Manager (noscript) -->
<noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-57KS2MW" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
<!-- End Google Tag Manager (noscript) --></body>
</html>