Skip to content

Commit d07858d

Browse files
themr0cJessicaJHeehmanwani-rh
authored
RHIDP-5959 Update dangerouslyAllowSignInWithoutUserInCatalog config (#978) (#982)
* RHIDP-5959 Update dangerouslyAllowSignInWithoutUserInCatalog config * Update modules/authentication/proc-enabling-authentication-with-github.adoc * Update modules/authentication/proc-enabling-authentication-with-github.adoc * Update modules/authentication/proc-enabling-authentication-with-github.adoc * Update modules/authentication/proc-enabling-authentication-with-github.adoc * Update modules/authentication/proc-enabling-authentication-with-microsoft-azure.adoc * Update modules/authentication/proc-enabling-authentication-with-microsoft-azure.adoc * Update modules/authentication/proc-enabling-authentication-with-github.adoc * Update modules/authentication/proc-enabling-authentication-with-github.adoc * Update modules/authentication/proc-enabling-authentication-with-microsoft-azure.adoc * Update modules/authentication/proc-enabling-authentication-with-microsoft-azure.adoc * Update modules/authentication/proc-enabling-authentication-with-github.adoc * Update modules/authentication/proc-enabling-authentication-with-microsoft-azure.adoc * Update modules/authentication/proc-enabling-authentication-with-rhbk.adoc * Update modules/authentication/proc-enabling-authentication-with-github.adoc * Update modules/authentication/proc-enabling-authentication-with-rhbk.adoc * Update modules/authentication/proc-enabling-authentication-with-microsoft-azure.adoc * Update modules/authentication/proc-enabling-authentication-with-rhbk.adoc * Update modules/authentication/proc-enabling-authentication-with-microsoft-azure.adoc * Update modules/authentication/proc-enabling-authentication-with-rhbk.adoc * Apply suggestions from code review * Apply suggestions from code review * Update modules/authentication/proc-enabling-authentication-with-github.adoc * Update modules/authentication/proc-enabling-authentication-with-microsoft-azure.adoc * Update modules/authentication/proc-enabling-authentication-with-rhbk.adoc --------- Signed-off-by: Fabrice Flore-Thébault <[email protected]> Co-authored-by: Jessica He <[email protected]> Co-authored-by: Heena Manwani <[email protected]>
1 parent 8fee23f commit d07858d

6 files changed

+191
-157
lines changed

‎modules/authentication/proc-enabling-authentication-with-github.adoc‎

Lines changed: 57 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -64,17 +64,17 @@ TIP: If you plan to make changes using the GitHub API, ensure that `Read and wri
6464
`GITHUB_WEBHOOK_SECRET`:: Enter the saved *Webhook secret*.
6565

6666
. To set up the GitHub authentication provider and enable integration with the GitHub API in your {product-short} custom configuration, edit your custom {product-short} ConfigMap such as `app-config-rhdh`, and add the following lines to the `app-config-rhdh.yaml` content:
67+
.. Configure mandatory fields:
6768
+
68-
--
6969
.`app-config-rhdh.yaml` fragment with mandatory fields to enable authentication with GitHub
7070
[source,yaml]
7171
----
7272
auth:
73-
environment: production
73+
environment: production # <1>
7474
providers:
7575
github:
7676
production:
77-
clientId: ${AUTH_GITHUB_CLIENT_ID}
77+
clientId: ${AUTH_GITHUB_CLIENT_ID} # <2>
7878
clientSecret: ${AUTH_GITHUB_CLIENT_SECRET}
7979
integrations:
8080
github:
@@ -87,26 +87,65 @@ integrations:
8787
webhookSecret: ${GITHUB_WEBHOOK_SECRET}
8888
privateKey: |
8989
${GITHUB_PRIVATE_KEY_FILE}
90-
signInPage: github
90+
signInPage: github # <3>
9191
----
92+
<1> Mark the environment as `production` and disable the Guest login option in the {product-short} login page.
93+
<2> Apply the GitHub credentials configured in your {product-short} secrets.
94+
<3> To enable the GitHub provider as your {product-short} sign-in provider.
9295

93-
`environment: production`::
94-
Mark the environment as `production` to hide the Guest login in the {product-short} home page.
96+
.. Optional: Consider adding the following optional fields:
9597

96-
`clientId`, `clientSecret`, `host`, `appId`, `webhookUrl`, `webhookSecret`, `privateKey`::
97-
Use the {product-short} application information that you have created in GitHub and configured in OpenShift as secrets.
98+
`callbackUrl`::
99+
The callback URL that GitHub uses when initiating an OAuth flow, such as: __<your_intermediate_service_url/handler>__.
100+
Define it when {product-short} is not the immediate receiver, such as in cases when you use one OAuth app for many {product-short} instances.
101+
+
102+
.`app-config-rhdh.yaml` fragment with optional `enterpriseInstanceUrl` field
103+
[source,yaml,subs="+quotes"]
104+
----
105+
auth:
106+
providers:
107+
github:
108+
production:
109+
callbackUrl: __<your_intermediate_service_url/handler>__
110+
----
98111

99-
`sigInPage: github`::
100-
To enable the GitHub provider as default sign-in provider.
112+
`enterpriseInstanceUrl`::
113+
Your GitHub Enterprise URL.
114+
Requires you defined the `GITHUB_HOST_DOMAIN` secret in the previous step.
115+
+
116+
.`app-config-rhdh.yaml` fragment with optional `enterpriseInstanceUrl` field
117+
[source,yaml,subs="+quotes"]
118+
----
119+
auth:
120+
providers:
121+
github:
122+
production:
123+
enterpriseInstanceUrl: ${GITHUB_HOST_DOMAIN}
124+
----
101125

102-
Optional: Consider adding the following optional fields:
126+
`signIn` ::
103127

104-
`dangerouslyAllowSignInWithoutUserInCatalog: true`::
105-
To enable authentication without requiring to provision users in the {product-short} software catalog.
128+
`resolvers`:::
129+
After successful authentication, the user signing in must be resolved to an existing user in the {product-short} catalog. To best match users securely for your use case, consider configuring a specific resolver. Enter the resolver list to override the default resolver: `usernameMatchingUserEntityName`.
130+
+
131+
The authentication provider tries each sign-in resolver in order until it succeeds, and fails if none succeed.
132+
+
133+
WARNING: In production mode, only configure one resolver to ensure users are securely matched.
134+
135+
`resolver`::::
136+
Enter the sign-in resolver name.
137+
Available resolvers:
138+
139+
* `usernameMatchingUserEntityName`
140+
* `preferredUsernameMatchingUserEntityName`
141+
* `emailMatchingUserEntityProfileEmail`
142+
143+
`dangerouslyAllowSignInWithoutUserInCatalog: true`::::
144+
Configure the sign-in resolver to bypass the user provisioning requirement in the {product-short} software catalog.
106145
+
107146
WARNING: Use `dangerouslyAllowSignInWithoutUserInCatalog` to explore {product-short} features, but do not use it in production.
108147
+
109-
.`app-config-rhdh.yaml` fragment with optional field to allow authenticating users absent from the software catalog
148+
.`app-config-rhdh.yaml` fragment with optional field to allow signing in users absent from the software catalog
110149
[source,yaml]
111150
----
112151
auth:
@@ -116,6 +155,10 @@ auth:
116155
production:
117156
clientId: ${AUTH_GITHUB_CLIENT_ID}
118157
clientSecret: ${AUTH_GITHUB_CLIENT_SECRET}
158+
signIn:
159+
resolvers:
160+
- resolver: usernameMatchingUserEntityName
161+
dangerouslyAllowSignInWithoutUserInCatalog: true
119162
integrations:
120163
github:
121164
- host: ${GITHUB_HOST_DOMAIN}
@@ -128,35 +171,6 @@ integrations:
128171
privateKey: |
129172
${GITHUB_PRIVATE_KEY_FILE}
130173
signInPage: github
131-
dangerouslyAllowSignInWithoutUserInCatalog: true
132-
----
133-
134-
`callbackUrl`::
135-
The callback URL that GitHub uses when initiating an OAuth flow, such as: __<your_intermediate_service_url/handler>__.
136-
Define it when {product-short} is not the immediate receiver, such as in cases when you use one OAuth app for many {product-short} instances.
137-
+
138-
.`app-config-rhdh.yaml` fragment with optional `enterpriseInstanceUrl` field
139-
[source,yaml,subs="+quotes"]
140-
----
141-
auth:
142-
providers:
143-
github:
144-
production:
145-
callbackUrl: __<your_intermediate_service_url/handler>__
146-
----
147-
148-
`enterpriseInstanceUrl`::
149-
Your GitHub Enterprise URL.
150-
Requires you defined the `GITHUB_HOST_DOMAIN` secret in the previous step.
151-
+
152-
.`app-config-rhdh.yaml` fragment with optional `enterpriseInstanceUrl` field
153-
[source,yaml,subs="+quotes"]
154-
----
155-
auth:
156-
providers:
157-
github:
158-
production:
159-
enterpriseInstanceUrl: ${GITHUB_HOST_DOMAIN}
160174
----
161175

162176
[TIP]
@@ -192,8 +206,6 @@ signInPage: __<your_main_authentication_provider>__
192206
----
193207
====
194208

195-
--
196-
197209
.Verification
198210
. Go to the {product-short} login page.
199211
. Your {product-short} sign-in page displays *Sign in using GitHub* and the Guest user sign-in is disabled.

‎modules/authentication/proc-enabling-authentication-with-microsoft-azure.adoc‎

Lines changed: 61 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -51,53 +51,26 @@ To grant administrator consent, a directory administrator must go to the link:ht
5151
`AUTH_AZURE_CLIENT_SECRET`:: Enter your saved *Application (client) secret*.
5252

5353
. Set up the Microsoft Azure authentication provider in your {product-short} custom configuration, such as `app-config-rhdh`:
54+
.. Configure mandatory fields:
5455
+
55-
--
5656
.`app-config-rhdh.yaml` fragment
5757
[source,yaml,subs="+quotes,+attributes"]
5858
----
5959
auth:
60-
environment: production
60+
environment: production # <1>
6161
providers:
6262
microsoft:
6363
production:
64-
clientId: ${AUTH_AZURE_CLIENT_ID}
64+
clientId: ${AUTH_AZURE_CLIENT_ID} # <2>
6565
clientSecret: ${AUTH_AZURE_CLIENT_SECRET}
6666
tenantId: ${AUTH_AZURE_TENANT_ID}
67-
signInPage: microsoft
67+
signInPage: microsoft # <3>
6868
----
69+
<1> Mark the environment as production and disable the **Guest** login option in the {product-short} login page.
70+
<2> Apply the Microsoft Azure credentials configured in your {product-short} secrets.
71+
<3> Set the Microsoft Azure provider as your {product-short} sign-in provider.
6972

70-
`environment: production`::
71-
Mark the environment as production to hide the **Guest** login in the {product-short} home page.
72-
73-
`clientId`, `clientSecret` and `tenantId`::
74-
Use the {product-short} application information that you have created in Microsoft Azure and configured in OpenShift as secrets.
75-
76-
`signInPage: microsoft`::
77-
Enable the Microsoft Azure provider as default sign-in provider.
78-
79-
Optional: Consider adding following optional fields:
80-
81-
`dangerouslyAllowSignInWithoutUserInCatalog: true`::
82-
+
83-
To enable authentication without requiring to provision users in the {product-short} software catalog.
84-
+
85-
WARNING: Use `dangerouslyAllowSignInWithoutUserInCatalog` to explore {product-short} features, but do not use it in production.
86-
+
87-
.`app-config-rhdh.yaml` fragment with optional field to allow authenticating users absent from the software catalog
88-
[source,yaml]
89-
----
90-
auth:
91-
environment: production
92-
providers:
93-
microsoft:
94-
production:
95-
clientId: ${AUTH_AZURE_CLIENT_ID}
96-
clientSecret: ${AUTH_AZURE_CLIENT_SECRET}
97-
tenantId: ${AUTH_AZURE_TENANT_ID}
98-
signInPage: microsoft
99-
dangerouslyAllowSignInWithoutUserInCatalog: true
100-
----
73+
.. Optional: Consider adding following optional fields:
10174

10275
`domainHint`::
10376
Optional for single-tenant applications.
@@ -133,7 +106,59 @@ auth:
133106
additionalScopes:
134107
- Mail.Send
135108
----
136-
--
109+
`sessionDuration`::
110+
Lifespan of the user session.
111+
Enter a duration in `ms` library format (such as '24h', '2 days'), ISO duration, or "human duration" as used in code.
112+
+
113+
.`app-config-rhdh.yaml` fragment with optional `sessionDuration` field
114+
[source,yaml,subs="+quotes"]
115+
----
116+
auth:
117+
providers:
118+
microsoft:
119+
production:
120+
sessionDuration: { hours: 24 }
121+
----
122+
123+
`signIn` ::
124+
125+
`resolvers`:::
126+
After successful authentication, the user signing in must be resolved to an existing user in the {product-short} catalog. To best match users securely for your use case, consider configuring a specific resolver. Enter the resolver list to override the default resolver: `emailLocalPartMatchingUserEntityName`.
127+
+
128+
The authentication provider tries each sign-in resolver in order until it succeeds, and fails if none succeed.
129+
+
130+
WARNING: In production mode, only configure one resolver to ensure users are securely matched.
131+
132+
`resolver`::::
133+
Enter the sign-in resolver name.
134+
Available resolvers:
135+
136+
* `userIdMatchingUserEntityAnnotation`
137+
* `emailLocalPartMatchingUserEntityName`
138+
* `emailMatchingUserEntityProfileEmail`
139+
140+
`dangerouslyAllowSignInWithoutUserInCatalog: true`::::
141+
Configure the sign-in resolver to bypass the user provisioning requirement in the {product-short} software catalog.
142+
+
143+
WARNING: Use `dangerouslyAllowSignInWithoutUserInCatalog` to explore {product-short} features, but do not use it in production.
144+
+
145+
.`app-config-rhdh.yaml` fragment with optional field to allow signing in users absent from the software catalog
146+
[source,yaml]
147+
----
148+
auth:
149+
environment: production
150+
providers:
151+
microsoft:
152+
production:
153+
clientId: ${AUTH_AZURE_CLIENT_ID}
154+
clientSecret: ${AUTH_AZURE_CLIENT_SECRET}
155+
tenantId: ${AUTH_AZURE_TENANT_ID}
156+
signIn:
157+
resolvers:
158+
- resolver: usernameMatchingUserEntityName
159+
dangerouslyAllowSignInWithoutUserInCatalog: true
160+
signInPage: microsoft
161+
----
137162

138163
[NOTE]
139164
====

0 commit comments

Comments
 (0)