Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Auth Providers: Add search_using_service_account field #12871

Open
2 tasks
rak-phillip opened this issue Dec 11, 2024 · 5 comments · Fixed by #13223
Open
2 tasks

Auth Providers: Add search_using_service_account field #12871

rak-phillip opened this issue Dec 11, 2024 · 5 comments · Fixed by #13223
Assignees
Labels
area/authentication kind/design kind/enhancement QA/dev-automation Issues that engineers have written automation around so QA doesn't have look at this QA/manual-test Indicates issue requires manually testing
Milestone

Comments

@rak-phillip
Copy link
Member

rak-phillip commented Dec 11, 2024

Add the ability to configure searchUsingServiceAccount while creating and editing openldap and freeipa auth providers.

Acceptance criteria

  • searchUsingServiceAccount is able to be configured for openldap and freeipa auth providers
  • searchUsingServiceAccount is a boolean with a default value of false

Notes

  • The new searchUsingServiceAccount setting is located under /v3/authconfigs
  • searchUsingServiceAccount applies only to freeipa an openldap providers
  • shell/edit/auth/ldap/config.vue is most likely the component that will receive this change
  • The save method appears to be defined in shell/mixins/auth-config.js

Details

This feature request is related to rancher/rancher#43064.

Rancher currently scopes searches to the permissions of the requesting user to prevent permission escalation. This approach doesn't support typical setups where users have no permissions in the authentication provider, and a service account is used to control read permissions. Adding search_using_service_account allows users who use the more typical setups to use Rancher in the method that they desire.

@rak-phillip rak-phillip added this to the v2.11.0 milestone Dec 11, 2024
@github-actions github-actions bot added the QA/dev-automation Issues that engineers have written automation around so QA doesn't have look at this label Dec 11, 2024
@cnotv cnotv self-assigned this Jan 28, 2025
@cnotv
Copy link
Member

cnotv commented Jan 28, 2025

While setting up the auth provider I got this message and confused me a lot.

Image

@cnotv
Copy link
Member

cnotv commented Jan 28, 2025

Also this icon not sure what means here

Image

@cnotv
Copy link
Member

cnotv commented Jan 28, 2025

To add context, the search which needs to be enabled with the checkbox/toggler is inside the Cluster Membership configuration.
Here an example like in GitHub when searching an user to add:

Image

@yonasberhe23
Copy link
Contributor

Manual validation is required. While the related unit test verifies the existence of the configuration, we should perform regression testing around FreeIPA and OpenLDAP auth providers (e.g. ensure the configuration is correctly passed in the request payload).

@cnotv
Copy link
Member

cnotv commented Feb 6, 2025

Yeah, I am trying to debug #12477 and we do not have a single (unit) test in the whole auth provider configuration CRUD process.
It's a good idea to check if existing logic is still working, beside I did not touch the code, so it should be not affected.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/authentication kind/design kind/enhancement QA/dev-automation Issues that engineers have written automation around so QA doesn't have look at this QA/manual-test Indicates issue requires manually testing
Projects
None yet
Development

Successfully merging a pull request may close this issue.

5 participants