Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,8 @@
On a Helm-based installation, you can configure {product-short} to log in as a Guest user and access {product-short} features.

.Prerequisites
* You link:{configuring-book-url}[added a custom {product-short} application configuration], and have sufficient permissions to modify it.
* You link:{configuring-book-url}#using-the-helm-chart-to-run-rhdh-with-your-custom-configuration[use the {product} Helm chart to run {product-short}].
* You added a custom {product-short} application configuration, and have sufficient permissions to modify it.
* You use the {product} Helm chart to run {product-short}.

.Procedure
* To enable the guest user in your {product-short} custom configuration, link:{configuring-book-url}#using-the-helm-chart-to-run-rhdh-with-your-custom-configuration[configure your {product} Helm Chart] with following content:
Expand All @@ -31,3 +31,9 @@ upstream:
. To log in with the Guest user account, click **Enter** in the **Guest** tile.
. In the {product-short} **Settings** page, your profile name is **Guest**.
. You can use {product-short} features.

[role="_additional-resources"]
.Additional resources

* link:{configuring-book-url}[Adding a custom {product-short} application configuration]
* link:{configuring-book-url}#using-the-helm-chart-to-run-rhdh-with-your-custom-configuration[Using the {product} Helm chart to run {product-short}]
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,8 @@
After an Operator-based installation, you can configure {product-short} to log in as a Guest user and access {product-short} features.

.Prerequisites
* You link:[installed {product-short} by using the Operator].
* You link:{configuring-book-url}[added a custom {product-short} application configuration], and have sufficient permissions to modify it.
* You installed {product-short} by using the Operator.
* You added a custom {product-short} application configuration, and have sufficient permissions to modify it.

.Procedure
* To enable the guest user in your {product-short} custom configuration, link:{configuring-book-url}#provisioning-your-custom-configuration[edit your {product-short} application configuration] with following content:
Expand All @@ -26,3 +26,9 @@ auth:
. To log in with the Guest user account, click **Enter** in the **Guest** tile.
. In the {product-short} **Settings** page, your profile name is **Guest**.
. You can use {product-short} features.

[role="_additional-resources"]
.Additional resources

* link:[Installing {product-short} by using the Operator]
* link:{configuring-book-url}[Adding a custom {product-short} application configuration]
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
To customize how {rhbk} users and groups are mapped to {product} entities, you can create a backend module that uses the `keycloakTransformerExtensionPoint` to provide custom user and group transformers for the Keycloak backend.

.Prerequisites
* You have xref:provisioning-users-from-rhbk-to-the-software-catalog[enabled provisioning users from {rhbk-brand-name} ({rhbk}) to the software catalog].
* You have enabled provisioning users from {rhbk-brand-name} ({rhbk}) to the software catalog.

.Procedure
. Create a new backend module with the `yarn new` command.
Expand Down Expand Up @@ -90,3 +90,8 @@ Check the console logs to verify that the synchronization is completed.
* You can select a group, view the list, and access or review the information imported from {rhbk}.

* You can log in with an {rhbk} account.

[role="_additional-resources"]
.Additional resources

* xref:provisioning-users-from-rhbk-to-the-software-catalog[Enabling provisioning users from {rhbk-brand-name} ({rhbk}) to the software catalog]
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@

.Prerequisites
. You have the permission to register an application in Microsoft Azure.
* You link:{configuring-book-url}[added a custom {product-short} application configuration], and have sufficient permissions to modify it.
* You added a custom {product-short} application configuration, and have sufficient permissions to modify it.

.Procedure
. To allow {product-short} to authenticate with Microsoft Azure, link:https://learn.microsoft.com/en-us/entra/identity-platform/scenario-web-app-sign-user-app-registration?tabs=aspnetcore#register-an-app-by-using-the-azure-portal[create an OAuth application in Microsoft Azure].
Expand Down Expand Up @@ -170,3 +170,8 @@ This step is optional for environments with outgoing access restrictions, such a
* `graph.microsoft.com`: For retrieving user profile information (as referenced in the source code).
If this host is unreachable, you might see an _Authentication failed, failed to fetch user profile_ error when attempting to log in.
====

[role="_additional-resources"]
.Additional resources

* link:{configuring-book-url}[Adding a custom {product-short} application configuration]
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ To authenticate users with {rhbk-brand-name} ({rhbk}), enable the OpenID Connect


.Prerequisites
* You link:{configuring-book-url}[added a custom {product-short} application configuration], and have sufficient permissions to modify it.
* You added a custom {product-short} application configuration, and have sufficient permissions to modify it.
* You have sufficient permissions in {rhsso} to create and manage a realm.

.Procedure
Expand Down Expand Up @@ -215,3 +215,8 @@ If multiple valid refresh tokens are issued due to frequent refresh token reques
. Go to the {product-short} login page.
. Your {product-short} sign-in page displays *Sign in using OIDC* and the Guest user sign-in is disabled.
. Log in with OIDC by using the saved **Username** and **Password** values.

[role="_additional-resources"]
.Additional resources

* link:{configuring-book-url}[Adding a custom {product-short} application configuration]
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,9 @@
To authenticate users with GitHub, configure the GitHub authentication provider in {product} and provision the users and groups from GitHub to the {product-short} software catalog.

.Prerequisites
* You link:{configuring-book-url}[added a custom {product-short} application configuration], and have sufficient permissions to modify it.
* You added a custom {product-short} application configuration, and have sufficient permissions to modify it.

* You have sufficient permissions in GitHub to create and manage a link:https://docs.github.com/en/apps/overview[GitHub App].
* You have sufficient permissions in GitHub to create and manage a GitHub App.
Alternatively, you can ask your GitHub administrator to prepare the required GitHub App.

.Procedure
Expand Down Expand Up @@ -207,3 +207,8 @@ WARNING: Use `dangerouslyAllowSignInWithoutUserInCatalog` to explore {product-sh
.. Your {product-short} sign-in page displays *Sign in using GitHub* and the Guest user sign-in is disabled.
.. Log in with a GitHub account.

[role="_additional-resources"]
.Additional resources

* link:{configuring-book-url}[Adding a custom {product-short} application configuration]
* link:https://docs.github.com/en/apps/overview[GitHub App]
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
To authenticate users with Microsoft Azure, after xref:enabling-authentication-with-microsoft-azure[Enabling authentication with Microsoft Azure], provision users from Microsoft Azure to the {product-short} software catalog.

.Prerequisites
* You have xref:enabling-authentication-with-microsoft-azure[enabled authentication with Microsoft Azure].
* You have enabled authentication with Microsoft Azure.

.Procedure
. link:{installing-and-viewing-plugins-book-url}[Enable the `backstage-plugin-catalog-backend-module-msgraph-dynamic` plugin].
Expand Down Expand Up @@ -266,3 +266,8 @@ backend:start: {"class":"MicrosoftGraphOrgEntityProvider$1","level":"info","mess
----

. Log in with a Microsoft Azure account.

[role="_additional-resources"]
.Additional resources

* xref:enabling-authentication-with-microsoft-azure[Enabling authentication with Microsoft Azure]
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
= Provisioning users from {rhbk-brand-name} ({rhbk}) to the software catalog

.Prerequisites
* You xref:enabling-authentication-with-rhbk[enabled authentication with {rhbk}].
* You enabled authentication with {rhbk}.

.Procedure
. link:{installing-and-viewing-plugins-book-url}[Enable the `backstage-plugin-catalog-backend-module-keycloak-dynamic` plugin].
Expand Down Expand Up @@ -156,3 +156,8 @@ catalog:
----

. Log in with an {rhbk} account.

[role="_additional-resources"]
.Additional resources

* xref:enabling-authentication-with-rhbk[Enabling authentication with {rhbk}]
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
You can configure the RBAC backend plugin by updating the `{my-app-config-file}` file to enable the permission framework.

.Prerequisites
* You have installed the `@janus-idp/backstage-plugin-rbac` plugin in {product-short}. For more information, see link:{plugins-configure-book-url}[{plugins-configure-book-title}].
* You have installed the `@janus-idp/backstage-plugin-rbac` plugin in {product-short}.

.Procedure
* Update the `{my-app-config-file}` file to enable the permission framework as shown:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ You need to prepare your files, upload them to your {ocp-short} project,
and configure {product-short} to use the external files.

.Prerequisites
* xref:enabling-and-giving-access-to-rbac[You enabled the RBAC feature].
* You enabled the RBAC feature.

.Procedure
. Define your policies in a `rbac-policies.csv` CSV file by using the following format:
Expand Down Expand Up @@ -103,3 +103,8 @@ permission:
policies-csv-file: /opt/app-root/src/rbac-policies.csv
policyFileReload: true
----

[role="_additional-resources"]
.Additional resources

* xref:enabling-and-giving-access-to-rbac[Enabling the RBAC feature]
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ You need to prepare your files, upload them to your {ocp-short} project,
and configure {product-short} to use the external files.

.Prerequisites
* xref:enabling-and-giving-access-to-rbac[You enabled the RBAC feature].
* You enabled the RBAC feature.

.Procedure
. Define your policies in a `rbac-policies.csv` CSV file by using the following format:
Expand Down Expand Up @@ -102,3 +102,8 @@ permission:
policies-csv-file: /opt/app-root/src/rbac-policies.csv
policyFileReload: true
----

[role="_additional-resources"]
.Additional resources

xref:enabling-and-giving-access-to-rbac[Enabling the RBAC feature]
10 changes: 8 additions & 2 deletions modules/authorization/proc-enabling-the-rbac-plugin.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,8 @@ Enable the RBAC plugin and declare policy administrators to start using RBAC fea
The permission policies for users and groups in the {product-short} are managed by permission policy administrators. Only permission policy administrators can access the Role-Based Access Control REST API.

.Prerequisites
* You have link:{configuring-book-url}[added a custom {product-short} application configuration], and have necessary permissions to modify it.
* You have link:{authentication-book-url}[enabled an authentication provider].
* You have added a custom {product-short} application configuration, and have necessary permissions to modify it.
* You have enabled an authentication provider.

.Procedure
. The RBAC plugin is installed but disabled by default.
Expand Down Expand Up @@ -69,3 +69,9 @@ The *Register* button is not visible.

.Next steps
* Explicitly enable permissions to resources in {product-short}.

[role="_additional-resources"]
.Additional resources

* link:{configuring-book-url}[Adding a custom {product-short} application configuration]
* link:{authentication-book-url}[Enabling an authentication provider]
5 changes: 4 additions & 1 deletion modules/authorization/proc-rbac-ui-create-role.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
You can create a role in the {product} using the Web UI.

.Prerequisites
* You xref:enabling-and-giving-access-to-rbac[have enabled RBAC, have a policy administrator role in {product-short}, and have added plugins with permission].
* You have enabled RBAC, have a policy administrator role in {product-short}, and have added plugins with permission.

.Procedure

Expand All @@ -27,4 +27,7 @@ The *RBAC* tab appears, displaying all the created roles in the {product-short}.

The created role appears in the list available in the *RBAC* tab.

[role="_additional-resources"]
.Additional resources

* xref:enabling-and-giving-access-to-rbac[Enabling and giving access to RBAC]
7 changes: 6 additions & 1 deletion modules/authorization/proc-rbac-ui-delete-role.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ The policies generated from a `policy.csv` or ConfigMap file cannot be edited or
====

.Prerequisites
* You xref:enabling-and-giving-access-to-rbac[have enabled RBAC and have a policy administrator role in {product-short}].
* You have enabled RBAC and have a policy administrator role in {product-short}.
* The role that you want to delete is created in the {product-short}.

.Procedure
Expand All @@ -25,3 +25,8 @@ The *RBAC* tab appears, displaying all the created roles in the {product-short}.
+
*Delete this role?* pop-up appears on the screen.
. Click *DELETE*.

[role="_additional-resources"]
.Additional resources

* xref:enabling-and-giving-access-to-rbac[Enabling RBAC in {product-short}]
6 changes: 5 additions & 1 deletion modules/authorization/proc-rbac-ui-edit-role.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ The policies generated from a `policy.csv` or ConfigMap file cannot be edited or
====

.Prerequisites
* You xref:enabling-and-giving-access-to-rbac[have enabled RBAC, have a policy administrator role in {product-short}, and have added plugins with permission].
* You have enabled RBAC, have a policy administrator role in {product-short}, and have added plugins with permission.
* The role that you want to edit is created in the {product-short}.

.Procedure
Expand All @@ -27,3 +27,7 @@ The *RBAC* tab appears, displaying all the created roles in the {product-short}.

After editing a role, you can view the edited details of a role on the *OVERVIEW* page of a role. You can also edit a role’s users and groups or permissions by using the edit icon on the respective cards on the *OVERVIEW* page.

[role="_additional-resources"]
.Additional resources

* xref:enabling-and-giving-access-to-rbac[Enabling RBAC in {product-short}]
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
You can send RBAC REST API requests using any REST client.

.Prerequisites
* xref:enabling-and-giving-access-to-rbac[You have access to the RBAC feature].
* You have access to the RBAC feature.

.Procedure
include::snip-finding-bearer-token.adoc[]
Expand All @@ -31,3 +31,7 @@ Body::
Enter the JSON body with data that your xref:ref-rbac-rest-api-endpoints_{context}[API endpoint] might need with the HTTP `POST` request.
--

[role="_additional-resources"]
.Additional resources

xref:enabling-and-giving-access-to-rbac[Enabling and giving access to the RBAC feature]
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
You can send RBAC REST API requests by using the curl utility.

.Prerequisites
* xref:enabling-and-giving-access-to-rbac[You have access to the RBAC feature].
* You have access to the RBAC feature.

.Procedure
include::snip-finding-bearer-token.adoc[]
Expand Down Expand Up @@ -169,3 +169,8 @@ curl -v -H "Content-Type: application/json" \
`404` Not Found:: Could not find requested resource.
`409` Conflict:: Request conflict with the current state and the target resource.
--

[role="_additional-resources"]
.Additional resources

* xref:enabling-and-giving-access-to-rbac[Enabling and giving access to the RBAC feature]
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
You can enable guest authentication and use it alongside the RBAC frontend plugin.

.Prerequisites
* You have installed the `@janus-idp/backstage-plugin-rbac` plugin in {product-short}. For more information, see link:{plugins-configure-book-url}[{plugins-configure-book-title}].
* You have installed the `@janus-idp/backstage-plugin-rbac` plugin in {product-short}.

.Procedure

Expand Down