Skip to content

Commit 91e2645

Browse files
Gerry-FordeGerry-Forde
authored
Merge branch 'release-1.5' into RHIDP-6323
2 parents 1bd6ae2 + d07858d commit 91e2645

9 files changed

+351
-157
lines changed

‎assemblies/assembly-configuring-a-floating-action-button.adoc‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
:context: configuring-a-floating-action-button
3+
[id="{context}"]
4+
= Configuring a floating action button in {product}
5+
6+
You can use the floating action button plugin to configure any action button as a floating button in any page in the {product-short} instance as you want. The floating action button plugin is disabled by default. You can also configure floating action buttons to display as submenu options within the main floating action button by assigning the floating action buttons to the same slot.
7+
8+
include::modules/configuring-a-floating-action-button/proc-configuring-floating-action-button-as-a-dynamic-plugin.adoc[leveloffset=+1]

‎modules/authentication/proc-enabling-authentication-with-github.adoc‎

Lines changed: 57 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -64,17 +64,17 @@ TIP: If you plan to make changes using the GitHub API, ensure that `Read and wri
6464
`GITHUB_WEBHOOK_SECRET`:: Enter the saved *Webhook secret*.
6565

6666
. To set up the GitHub authentication provider and enable integration with the GitHub API in your {product-short} custom configuration, edit your custom {product-short} ConfigMap such as `app-config-rhdh`, and add the following lines to the `app-config-rhdh.yaml` content:
67+
.. Configure mandatory fields:
6768
+
68-
--
6969
.`app-config-rhdh.yaml` fragment with mandatory fields to enable authentication with GitHub
7070
[source,yaml]
7171
----
7272
auth:
73-
environment: production
73+
environment: production # <1>
7474
providers:
7575
github:
7676
production:
77-
clientId: ${AUTH_GITHUB_CLIENT_ID}
77+
clientId: ${AUTH_GITHUB_CLIENT_ID} # <2>
7878
clientSecret: ${AUTH_GITHUB_CLIENT_SECRET}
7979
integrations:
8080
github:
@@ -87,26 +87,65 @@ integrations:
8787
webhookSecret: ${GITHUB_WEBHOOK_SECRET}
8888
privateKey: |
8989
${GITHUB_PRIVATE_KEY_FILE}
90-
signInPage: github
90+
signInPage: github # <3>
9191
----
92+
<1> Mark the environment as `production` and disable the Guest login option in the {product-short} login page.
93+
<2> Apply the GitHub credentials configured in your {product-short} secrets.
94+
<3> To enable the GitHub provider as your {product-short} sign-in provider.
9295

93-
`environment: production`::
94-
Mark the environment as `production` to hide the Guest login in the {product-short} home page.
96+
.. Optional: Consider adding the following optional fields:
9597

96-
`clientId`, `clientSecret`, `host`, `appId`, `webhookUrl`, `webhookSecret`, `privateKey`::
97-
Use the {product-short} application information that you have created in GitHub and configured in OpenShift as secrets.
98+
`callbackUrl`::
99+
The callback URL that GitHub uses when initiating an OAuth flow, such as: __<your_intermediate_service_url/handler>__.
100+
Define it when {product-short} is not the immediate receiver, such as in cases when you use one OAuth app for many {product-short} instances.
101+
+
102+
.`app-config-rhdh.yaml` fragment with optional `enterpriseInstanceUrl` field
103+
[source,yaml,subs="+quotes"]
104+
----
105+
auth:
106+
providers:
107+
github:
108+
production:
109+
callbackUrl: __<your_intermediate_service_url/handler>__
110+
----
98111

99-
`sigInPage: github`::
100-
To enable the GitHub provider as default sign-in provider.
112+
`enterpriseInstanceUrl`::
113+
Your GitHub Enterprise URL.
114+
Requires you defined the `GITHUB_HOST_DOMAIN` secret in the previous step.
115+
+
116+
.`app-config-rhdh.yaml` fragment with optional `enterpriseInstanceUrl` field
117+
[source,yaml,subs="+quotes"]
118+
----
119+
auth:
120+
providers:
121+
github:
122+
production:
123+
enterpriseInstanceUrl: ${GITHUB_HOST_DOMAIN}
124+
----
101125

102-
Optional: Consider adding the following optional fields:
126+
`signIn` ::
103127

104-
`dangerouslyAllowSignInWithoutUserInCatalog: true`::
105-
To enable authentication without requiring to provision users in the {product-short} software catalog.
128+
`resolvers`:::
129+
After successful authentication, the user signing in must be resolved to an existing user in the {product-short} catalog. To best match users securely for your use case, consider configuring a specific resolver. Enter the resolver list to override the default resolver: `usernameMatchingUserEntityName`.
130+
+
131+
The authentication provider tries each sign-in resolver in order until it succeeds, and fails if none succeed.
132+
+
133+
WARNING: In production mode, only configure one resolver to ensure users are securely matched.
134+
135+
`resolver`::::
136+
Enter the sign-in resolver name.
137+
Available resolvers:
138+
139+
* `usernameMatchingUserEntityName`
140+
* `preferredUsernameMatchingUserEntityName`
141+
* `emailMatchingUserEntityProfileEmail`
142+
143+
`dangerouslyAllowSignInWithoutUserInCatalog: true`::::
144+
Configure the sign-in resolver to bypass the user provisioning requirement in the {product-short} software catalog.
106145
+
107146
WARNING: Use `dangerouslyAllowSignInWithoutUserInCatalog` to explore {product-short} features, but do not use it in production.
108147
+
109-
.`app-config-rhdh.yaml` fragment with optional field to allow authenticating users absent from the software catalog
148+
.`app-config-rhdh.yaml` fragment with optional field to allow signing in users absent from the software catalog
110149
[source,yaml]
111150
----
112151
auth:
@@ -116,6 +155,10 @@ auth:
116155
production:
117156
clientId: ${AUTH_GITHUB_CLIENT_ID}
118157
clientSecret: ${AUTH_GITHUB_CLIENT_SECRET}
158+
signIn:
159+
resolvers:
160+
- resolver: usernameMatchingUserEntityName
161+
dangerouslyAllowSignInWithoutUserInCatalog: true
119162
integrations:
120163
github:
121164
- host: ${GITHUB_HOST_DOMAIN}
@@ -128,35 +171,6 @@ integrations:
128171
privateKey: |
129172
${GITHUB_PRIVATE_KEY_FILE}
130173
signInPage: github
131-
dangerouslyAllowSignInWithoutUserInCatalog: true
132-
----
133-
134-
`callbackUrl`::
135-
The callback URL that GitHub uses when initiating an OAuth flow, such as: __<your_intermediate_service_url/handler>__.
136-
Define it when {product-short} is not the immediate receiver, such as in cases when you use one OAuth app for many {product-short} instances.
137-
+
138-
.`app-config-rhdh.yaml` fragment with optional `enterpriseInstanceUrl` field
139-
[source,yaml,subs="+quotes"]
140-
----
141-
auth:
142-
providers:
143-
github:
144-
production:
145-
callbackUrl: __<your_intermediate_service_url/handler>__
146-
----
147-
148-
`enterpriseInstanceUrl`::
149-
Your GitHub Enterprise URL.
150-
Requires you defined the `GITHUB_HOST_DOMAIN` secret in the previous step.
151-
+
152-
.`app-config-rhdh.yaml` fragment with optional `enterpriseInstanceUrl` field
153-
[source,yaml,subs="+quotes"]
154-
----
155-
auth:
156-
providers:
157-
github:
158-
production:
159-
enterpriseInstanceUrl: ${GITHUB_HOST_DOMAIN}
160174
----
161175

162176
[TIP]
@@ -192,8 +206,6 @@ signInPage: __<your_main_authentication_provider>__
192206
----
193207
====
194208

195-
--
196-
197209
.Verification
198210
. Go to the {product-short} login page.
199211
. Your {product-short} sign-in page displays *Sign in using GitHub* and the Guest user sign-in is disabled.

‎modules/authentication/proc-enabling-authentication-with-microsoft-azure.adoc‎

Lines changed: 61 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -51,53 +51,26 @@ To grant administrator consent, a directory administrator must go to the link:ht
5151
`AUTH_AZURE_CLIENT_SECRET`:: Enter your saved *Application (client) secret*.
5252

5353
. Set up the Microsoft Azure authentication provider in your {product-short} custom configuration, such as `app-config-rhdh`:
54+
.. Configure mandatory fields:
5455
+
55-
--
5656
.`app-config-rhdh.yaml` fragment
5757
[source,yaml,subs="+quotes,+attributes"]
5858
----
5959
auth:
60-
environment: production
60+
environment: production # <1>
6161
providers:
6262
microsoft:
6363
production:
64-
clientId: ${AUTH_AZURE_CLIENT_ID}
64+
clientId: ${AUTH_AZURE_CLIENT_ID} # <2>
6565
clientSecret: ${AUTH_AZURE_CLIENT_SECRET}
6666
tenantId: ${AUTH_AZURE_TENANT_ID}
67-
signInPage: microsoft
67+
signInPage: microsoft # <3>
6868
----
69+
<1> Mark the environment as production and disable the **Guest** login option in the {product-short} login page.
70+
<2> Apply the Microsoft Azure credentials configured in your {product-short} secrets.
71+
<3> Set the Microsoft Azure provider as your {product-short} sign-in provider.
6972

70-
`environment: production`::
71-
Mark the environment as production to hide the **Guest** login in the {product-short} home page.
72-
73-
`clientId`, `clientSecret` and `tenantId`::
74-
Use the {product-short} application information that you have created in Microsoft Azure and configured in OpenShift as secrets.
75-
76-
`signInPage: microsoft`::
77-
Enable the Microsoft Azure provider as default sign-in provider.
78-
79-
Optional: Consider adding following optional fields:
80-
81-
`dangerouslyAllowSignInWithoutUserInCatalog: true`::
82-
+
83-
To enable authentication without requiring to provision users in the {product-short} software catalog.
84-
+
85-
WARNING: Use `dangerouslyAllowSignInWithoutUserInCatalog` to explore {product-short} features, but do not use it in production.
86-
+
87-
.`app-config-rhdh.yaml` fragment with optional field to allow authenticating users absent from the software catalog
88-
[source,yaml]
89-
----
90-
auth:
91-
environment: production
92-
providers:
93-
microsoft:
94-
production:
95-
clientId: ${AUTH_AZURE_CLIENT_ID}
96-
clientSecret: ${AUTH_AZURE_CLIENT_SECRET}
97-
tenantId: ${AUTH_AZURE_TENANT_ID}
98-
signInPage: microsoft
99-
dangerouslyAllowSignInWithoutUserInCatalog: true
100-
----
73+
.. Optional: Consider adding following optional fields:
10174

10275
`domainHint`::
10376
Optional for single-tenant applications.
@@ -133,7 +106,59 @@ auth:
133106
additionalScopes:
134107
- Mail.Send
135108
----
136-
--
109+
`sessionDuration`::
110+
Lifespan of the user session.
111+
Enter a duration in `ms` library format (such as '24h', '2 days'), ISO duration, or "human duration" as used in code.
112+
+
113+
.`app-config-rhdh.yaml` fragment with optional `sessionDuration` field
114+
[source,yaml,subs="+quotes"]
115+
----
116+
auth:
117+
providers:
118+
microsoft:
119+
production:
120+
sessionDuration: { hours: 24 }
121+
----
122+
123+
`signIn` ::
124+
125+
`resolvers`:::
126+
After successful authentication, the user signing in must be resolved to an existing user in the {product-short} catalog. To best match users securely for your use case, consider configuring a specific resolver. Enter the resolver list to override the default resolver: `emailLocalPartMatchingUserEntityName`.
127+
+
128+
The authentication provider tries each sign-in resolver in order until it succeeds, and fails if none succeed.
129+
+
130+
WARNING: In production mode, only configure one resolver to ensure users are securely matched.
131+
132+
`resolver`::::
133+
Enter the sign-in resolver name.
134+
Available resolvers:
135+
136+
* `userIdMatchingUserEntityAnnotation`
137+
* `emailLocalPartMatchingUserEntityName`
138+
* `emailMatchingUserEntityProfileEmail`
139+
140+
`dangerouslyAllowSignInWithoutUserInCatalog: true`::::
141+
Configure the sign-in resolver to bypass the user provisioning requirement in the {product-short} software catalog.
142+
+
143+
WARNING: Use `dangerouslyAllowSignInWithoutUserInCatalog` to explore {product-short} features, but do not use it in production.
144+
+
145+
.`app-config-rhdh.yaml` fragment with optional field to allow signing in users absent from the software catalog
146+
[source,yaml]
147+
----
148+
auth:
149+
environment: production
150+
providers:
151+
microsoft:
152+
production:
153+
clientId: ${AUTH_AZURE_CLIENT_ID}
154+
clientSecret: ${AUTH_AZURE_CLIENT_SECRET}
155+
tenantId: ${AUTH_AZURE_TENANT_ID}
156+
signIn:
157+
resolvers:
158+
- resolver: usernameMatchingUserEntityName
159+
dangerouslyAllowSignInWithoutUserInCatalog: true
160+
signInPage: microsoft
161+
----
137162

138163
[NOTE]
139164
====

0 commit comments

Comments
 (0)