Skip to content

Commit fc7f261

Browse files
themr0cJessicaJHeehmanwani-rh
authored
RHIDP-5959 Update dangerouslyAllowSignInWithoutUserInCatalog config (#978)
* RHIDP-5959 Update dangerouslyAllowSignInWithoutUserInCatalog config Signed-off-by: Fabrice Flore-Thébault <[email protected]> * Update modules/authentication/proc-enabling-authentication-with-github.adoc Co-authored-by: Jessica He <[email protected]> * Update modules/authentication/proc-enabling-authentication-with-github.adoc Co-authored-by: Jessica He <[email protected]> * Update modules/authentication/proc-enabling-authentication-with-github.adoc Co-authored-by: Jessica He <[email protected]> * Update modules/authentication/proc-enabling-authentication-with-github.adoc Co-authored-by: Jessica He <[email protected]> * Update modules/authentication/proc-enabling-authentication-with-microsoft-azure.adoc * Update modules/authentication/proc-enabling-authentication-with-microsoft-azure.adoc * Update modules/authentication/proc-enabling-authentication-with-github.adoc * Update modules/authentication/proc-enabling-authentication-with-github.adoc * Update modules/authentication/proc-enabling-authentication-with-microsoft-azure.adoc * Update modules/authentication/proc-enabling-authentication-with-microsoft-azure.adoc * Update modules/authentication/proc-enabling-authentication-with-github.adoc * Update modules/authentication/proc-enabling-authentication-with-microsoft-azure.adoc * Update modules/authentication/proc-enabling-authentication-with-rhbk.adoc * Update modules/authentication/proc-enabling-authentication-with-github.adoc * Update modules/authentication/proc-enabling-authentication-with-rhbk.adoc * Update modules/authentication/proc-enabling-authentication-with-microsoft-azure.adoc * Update modules/authentication/proc-enabling-authentication-with-rhbk.adoc * Update modules/authentication/proc-enabling-authentication-with-microsoft-azure.adoc * Update modules/authentication/proc-enabling-authentication-with-rhbk.adoc * Apply suggestions from code review Co-authored-by: Jessica He <[email protected]> * Apply suggestions from code review * Update modules/authentication/proc-enabling-authentication-with-github.adoc Co-authored-by: Heena Manwani <[email protected]> * Update modules/authentication/proc-enabling-authentication-with-microsoft-azure.adoc Co-authored-by: Heena Manwani <[email protected]> * Update modules/authentication/proc-enabling-authentication-with-rhbk.adoc Co-authored-by: Heena Manwani <[email protected]> --------- Signed-off-by: Fabrice Flore-Thébault <[email protected]> Co-authored-by: Jessica He <[email protected]> Co-authored-by: Heena Manwani <[email protected]>
1 parent 53184bc commit fc7f261

6 files changed

+164
-158
lines changed

‎modules/authentication/proc-enabling-authentication-with-github.adoc‎

Lines changed: 58 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -64,17 +64,17 @@ TIP: If you plan to make changes using the GitHub API, ensure that `Read and wri
6464
`GITHUB_WEBHOOK_SECRET`:: Enter the saved *Webhook secret*.
6565

6666
. To set up the GitHub authentication provider and enable integration with the GitHub API in your {product-short} custom configuration, edit your custom {product-short} ConfigMap such as `app-config-rhdh`, and add the following lines to the `app-config-rhdh.yaml` content:
67+
.. Configure mandatory fields:
6768
+
68-
--
6969
.`app-config-rhdh.yaml` fragment with mandatory fields to enable authentication with GitHub
7070
[source,yaml]
7171
----
7272
auth:
73-
environment: production
73+
environment: production # <1>
7474
providers:
7575
github:
7676
production:
77-
clientId: ${AUTH_GITHUB_CLIENT_ID}
77+
clientId: ${AUTH_GITHUB_CLIENT_ID} # <2>
7878
clientSecret: ${AUTH_GITHUB_CLIENT_SECRET}
7979
integrations:
8080
github:
@@ -87,49 +87,13 @@ integrations:
8787
webhookSecret: ${GITHUB_WEBHOOK_SECRET}
8888
privateKey: |
8989
${GITHUB_PRIVATE_KEY_FILE}
90-
signInPage: github
90+
signInPage: github # <3>
9191
----
92+
<1> Mark the environment as `production` and disable the Guest login option in the {product-short} login page.
93+
<2> Apply the GitHub credentials configured in your {product-short} secrets.
94+
<3> To enable the GitHub provider as your {product-short} sign-in provider.
9295

93-
`environment: production`::
94-
Mark the environment as `production` to hide the Guest login in the {product-short} home page.
95-
96-
`clientId`, `clientSecret`, `host`, `appId`, `webhookUrl`, `webhookSecret`, `privateKey`::
97-
Use the {product-short} application information that you have created in GitHub and configured in OpenShift as secrets.
98-
99-
`sigInPage: github`::
100-
To enable the GitHub provider as default sign-in provider.
101-
102-
Optional: Consider adding the following optional fields:
103-
104-
`dangerouslyAllowSignInWithoutUserInCatalog: true`::
105-
To enable authentication without requiring to provision users in the {product-short} software catalog.
106-
+
107-
WARNING: Use `dangerouslyAllowSignInWithoutUserInCatalog` to explore {product-short} features, but do not use it in production.
108-
+
109-
.`app-config-rhdh.yaml` fragment with optional field to allow authenticating users absent from the software catalog
110-
[source,yaml]
111-
----
112-
auth:
113-
environment: production
114-
providers:
115-
github:
116-
production:
117-
clientId: ${AUTH_GITHUB_CLIENT_ID}
118-
clientSecret: ${AUTH_GITHUB_CLIENT_SECRET}
119-
integrations:
120-
github:
121-
- host: ${GITHUB_HOST_DOMAIN}
122-
apps:
123-
- appId: ${AUTH_GITHUB_APP_ID}
124-
clientId: ${AUTH_GITHUB_CLIENT_ID}
125-
clientSecret: ${GITHUB_CLIENT_SECRET}
126-
webhookUrl: ${GITHUB_WEBHOOK_URL}
127-
webhookSecret: ${GITHUB_WEBHOOK_SECRET}
128-
privateKey: |
129-
${GITHUB_PRIVATE_KEY_FILE}
130-
signInPage: github
131-
dangerouslyAllowSignInWithoutUserInCatalog: true
132-
----
96+
.. Optional: Consider adding the following optional fields:
13397

13498
`callbackUrl`::
13599
The callback URL that GitHub uses when initiating an OAuth flow, such as: __<your_intermediate_service_url/handler>__.
@@ -175,6 +139,56 @@ auth:
175139
sessionDuration: { hours: 24 }
176140
----
177141

142+
`signIn` ::
143+
144+
`resolvers`:::
145+
After successful authentication, the user signing in must be resolved to an existing user in the {product-short} catalog. To best match users securely for your use case, consider configuring a specific resolver. Enter the resolver list to override the default resolver: `usernameMatchingUserEntityName`.
146+
+
147+
The authentication provider tries each sign-in resolver in order until it succeeds, and fails if none succeed.
148+
+
149+
WARNING: In production mode, only configure one resolver to ensure users are securely matched.
150+
151+
`resolver`::::
152+
Enter the sign-in resolver name.
153+
Available resolvers:
154+
155+
* `usernameMatchingUserEntityName`
156+
* `preferredUsernameMatchingUserEntityName`
157+
* `emailMatchingUserEntityProfileEmail`
158+
159+
`dangerouslyAllowSignInWithoutUserInCatalog: true`::::
160+
Configure the sign-in resolver to bypass the user provisioning requirement in the {product-short} software catalog.
161+
+
162+
WARNING: Use `dangerouslyAllowSignInWithoutUserInCatalog` to explore {product-short} features, but do not use it in production.
163+
+
164+
.`app-config-rhdh.yaml` fragment with optional field to allow signing in users absent from the software catalog
165+
[source,yaml]
166+
----
167+
auth:
168+
environment: production
169+
providers:
170+
github:
171+
production:
172+
clientId: ${AUTH_GITHUB_CLIENT_ID}
173+
clientSecret: ${AUTH_GITHUB_CLIENT_SECRET}
174+
signIn:
175+
resolvers:
176+
- resolver: usernameMatchingUserEntityName
177+
dangerouslyAllowSignInWithoutUserInCatalog: true
178+
integrations:
179+
github:
180+
- host: ${GITHUB_HOST_DOMAIN}
181+
apps:
182+
- appId: ${AUTH_GITHUB_APP_ID}
183+
clientId: ${AUTH_GITHUB_CLIENT_ID}
184+
clientSecret: ${GITHUB_CLIENT_SECRET}
185+
webhookUrl: ${GITHUB_WEBHOOK_URL}
186+
webhookSecret: ${GITHUB_WEBHOOK_SECRET}
187+
privateKey: |
188+
${GITHUB_PRIVATE_KEY_FILE}
189+
signInPage: github
190+
----
191+
178192
[TIP]
179193
====
180194
To enable GitHub integration with a different authentication provider, complete the following configurations:
@@ -208,8 +222,6 @@ signInPage: __<your_main_authentication_provider>__
208222
----
209223
====
210224

211-
--
212-
213225
.Verification
214226
. Go to the {product-short} login page.
215227
. Your {product-short} sign-in page displays *Sign in using GitHub* and the Guest user sign-in is disabled.

‎modules/authentication/proc-enabling-authentication-with-microsoft-azure.adoc‎

Lines changed: 47 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -51,53 +51,26 @@ To grant administrator consent, a directory administrator must go to the link:ht
5151
`AUTH_AZURE_CLIENT_SECRET`:: Enter your saved *Application (client) secret*.
5252

5353
. Set up the Microsoft Azure authentication provider in your {product-short} custom configuration, such as `app-config-rhdh`:
54+
.. Configure mandatory fields:
5455
+
55-
--
5656
.`app-config-rhdh.yaml` fragment
5757
[source,yaml,subs="+quotes,+attributes"]
5858
----
5959
auth:
60-
environment: production
60+
environment: production # <1>
6161
providers:
6262
microsoft:
6363
production:
64-
clientId: ${AUTH_AZURE_CLIENT_ID}
64+
clientId: ${AUTH_AZURE_CLIENT_ID} # <2>
6565
clientSecret: ${AUTH_AZURE_CLIENT_SECRET}
6666
tenantId: ${AUTH_AZURE_TENANT_ID}
67-
signInPage: microsoft
67+
signInPage: microsoft # <3>
6868
----
69+
<1> Mark the environment as production and disable the **Guest** login option in the {product-short} login page.
70+
<2> Apply the Microsoft Azure credentials configured in your {product-short} secrets.
71+
<3> Set the Microsoft Azure provider as your {product-short} sign-in provider.
6972

70-
`environment: production`::
71-
Mark the environment as production to hide the **Guest** login in the {product-short} home page.
72-
73-
`clientId`, `clientSecret` and `tenantId`::
74-
Use the {product-short} application information that you have created in Microsoft Azure and configured in OpenShift as secrets.
75-
76-
`signInPage: microsoft`::
77-
Enable the Microsoft Azure provider as default sign-in provider.
78-
79-
Optional: Consider adding following optional fields:
80-
81-
`dangerouslyAllowSignInWithoutUserInCatalog: true`::
82-
+
83-
To enable authentication without requiring to provision users in the {product-short} software catalog.
84-
+
85-
WARNING: Use `dangerouslyAllowSignInWithoutUserInCatalog` to explore {product-short} features, but do not use it in production.
86-
+
87-
.`app-config-rhdh.yaml` fragment with optional field to allow authenticating users absent from the software catalog
88-
[source,yaml]
89-
----
90-
auth:
91-
environment: production
92-
providers:
93-
microsoft:
94-
production:
95-
clientId: ${AUTH_AZURE_CLIENT_ID}
96-
clientSecret: ${AUTH_AZURE_CLIENT_SECRET}
97-
tenantId: ${AUTH_AZURE_TENANT_ID}
98-
signInPage: microsoft
99-
dangerouslyAllowSignInWithoutUserInCatalog: true
100-
----
73+
.. Optional: Consider adding following optional fields:
10174

10275
`domainHint`::
10376
Optional for single-tenant applications.
@@ -148,7 +121,45 @@ auth:
148121
sessionDuration: { hours: 24 }
149122
----
150123

151-
--
124+
`signIn` ::
125+
126+
`resolvers`:::
127+
After successful authentication, the user signing in must be resolved to an existing user in the {product-short} catalog. To best match users securely for your use case, consider configuring a specific resolver. Enter the resolver list to override the default resolver: `emailLocalPartMatchingUserEntityName`.
128+
+
129+
The authentication provider tries each sign-in resolver in order until it succeeds, and fails if none succeed.
130+
+
131+
WARNING: In production mode, only configure one resolver to ensure users are securely matched.
132+
133+
`resolver`::::
134+
Enter the sign-in resolver name.
135+
Available resolvers:
136+
137+
* `userIdMatchingUserEntityAnnotation`
138+
* `emailLocalPartMatchingUserEntityName`
139+
* `emailMatchingUserEntityProfileEmail`
140+
141+
`dangerouslyAllowSignInWithoutUserInCatalog: true`::::
142+
Configure the sign-in resolver to bypass the user provisioning requirement in the {product-short} software catalog.
143+
+
144+
WARNING: Use `dangerouslyAllowSignInWithoutUserInCatalog` to explore {product-short} features, but do not use it in production.
145+
+
146+
.`app-config-rhdh.yaml` fragment with optional field to allow signing in users absent from the software catalog
147+
[source,yaml]
148+
----
149+
auth:
150+
environment: production
151+
providers:
152+
microsoft:
153+
production:
154+
clientId: ${AUTH_AZURE_CLIENT_ID}
155+
clientSecret: ${AUTH_AZURE_CLIENT_SECRET}
156+
tenantId: ${AUTH_AZURE_TENANT_ID}
157+
signIn:
158+
resolvers:
159+
- resolver: usernameMatchingUserEntityName
160+
dangerouslyAllowSignInWithoutUserInCatalog: true
161+
signInPage: microsoft
162+
----
152163

153164
[NOTE]
154165
====

0 commit comments

Comments
 (0)