[DOC] Authentication section update #17

MagdaDziadosz · 2024-05-29T14:57:11Z

Update of the authentication section

content/docs/reference/authentication/LDAP.md

content/docs/reference/authentication/authentication.md

nwneisen · 2024-06-10T15:30:14Z

content/docs/reference/authentication/authentication.md

+the authentication in the MKE 4 configuration file and add your own method.
+
+---
+***Caution: Changing authentication method***


This should say "disabling" instead of "changing". Users will already have to configure authentication themselves, we just have tooling to make it easier.

If they disable the authentication section, then they are removing everything completely including our tooling and they will be responsible for 100% of the authentication

content/docs/reference/authentication/LDAP.md

KoryKessel-Mirantis · 2024-06-10T15:26:53Z

content/docs/reference/authentication/authentication.md

+Authentication can be configured in the `authentication` section of the MKE 4 config.
+By default, authentication is enabled, but each of the individual authentication 
+methods is disabled. It can be disabled by setting the root `enabled` to `false`. 
+This will completely remove any authentication-related components from being


Suggest:

"Doing so will completely remove any authentication-related components from being installed on your cluster."

KoryKessel-Mirantis · 2024-06-10T15:29:37Z

content/docs/reference/authentication/authentication.md

+
+## Authentication methods
+
+To learn more, refer to the documentation on specific authentication methods:


Suggested change

To learn more, refer to the documentation on specific authentication methods:

Documentation for specific authentication methods as they apply to MKE 4 is available:

KoryKessel-Mirantis · 2024-06-10T15:30:26Z

content/docs/reference/authentication/authentication.md

+
+To learn more, refer to the documentation on specific authentication methods:
+
+- [OpenID Connect (OIDC)](OIDC.md)


Suggested change

- [OpenID Connect (OIDC)](OIDC.md)

- [OIDC (OpenID Connect)](OIDC.md)

KoryKessel-Mirantis · 2024-06-10T15:31:10Z

content/docs/reference/authentication/authentication.md

+To learn more, refer to the documentation on specific authentication methods:
+
+- [OpenID Connect (OIDC)](OIDC.md)
+- [Security Assertion Markup Language (SAML)](SAML.md)


Suggested change

- [Security Assertion Markup Language (SAML)](SAML.md)

- [SAML (Security Assertion Markup Language)](SAML.md)

KoryKessel-Mirantis · 2024-06-10T15:31:39Z

content/docs/reference/authentication/authentication.md

+
+- [OpenID Connect (OIDC)](OIDC.md)
+- [Security Assertion Markup Language (SAML)](SAML.md)
+- [Lightweight Directory Access Protocol (LDAP)](LDAP.md)


Suggested change

- [Lightweight Directory Access Protocol (LDAP)](LDAP.md)

- [LDAP (Lightweight Directory Access Protocol)](LDAP.md)

Co-authored-by: Kory <57411706+KoryKessel-Mirantis@users.noreply.github.com>

nwneisen · 2024-06-11T14:46:31Z

content/docs/reference/authentication/LDAP.md

@@ -46,15 +52,17 @@ authentication:
 nameAttr: cn
 ```

-## Authentication Flow
+**To test the Authentication flow:**


This should be a heading section not bold text

@nwneisen , this approach is part of the current Mirantis docs style, to introduce straight procedures. It would be rendered as an H2 if (a) there was descriptive content behind the subject, and/or (b) there was another H2 level heading in the topic, and/or (c) there was a need for the subject to be prominent enough to display in the TOC/left-hand menu.

nwneisen · 2024-06-11T14:52:08Z

content/docs/reference/authentication/OIDC.md


-The remaining fields are used to configure the OIDC provider.
+The remaining fields in the `authentication.oidc` section are used to configure


We should move the configure okta to it's on file and section and refer to it here. There will be more IdP providers and this should be made generic for them. Many providers offer both SAML and OIDC and in the specific pages we can say how to pull the config values for them.

The hierarchy might look something like this

authentication ldap oidc .... SAML providers Configuration okta Configuration aws OIDC providers Configuration okta Configuration aws

Same thoughts for SAML

nwneisen · 2024-06-11T14:53:31Z

content/docs/reference/authentication/OIDC.md

+You can configure OIDC (OpenID Connect) for MKE 4 through the `authentication` section of the MKE configuration file. To enable the service, set 'enabled' to 'true'
+The remaining fields in the `authentication.oidc` section are used to configure
+the OIDC provider.
+For information on how to obtain the field values, refer to


This would then say "For information on how to obtain the field values, refer to the section for your provider of choice: link"

nwneisen · 2024-06-11T14:54:12Z

content/docs/reference/authentication/OIDC.md

@@ -24,30 +28,30 @@ authentication:
 redirectURI: http://dex.example.com:32000/callback
 ```

-Use the next section to understand how to configure Okta. Once the configuration is set, run the standard `mkectl apply` command with your config file and wait for the cluster to be ready.
+**To create a new application in Okta:**


This should be a heading not just bold

@nwneisen, I detailed the reasoning for this decision in a previous comment.

nwneisen · 2024-06-11T14:55:11Z

content/docs/reference/authentication/SAML.md

+To enable the service, set `enabled` to `true`.
+The remaining fields in the `authentication.saml` section are used to configure
+the SAML provider. 
+Refer to **Configure and create a new application in Okta** section of this document


Make any referrals a link

nwneisen · 2024-06-11T14:57:08Z

content/docs/reference/authentication/authentication.md

@@ -0,0 +1,50 @@
+# Authentication
+
+Mirantis Kubernetes Engine (MKE) 4 uses Dex for authentication.


It''s just MKE. The version is 4.0

It was agreed with the doc team that the first mention of MKE on each page will have this format.
If you want to change it, please bring it up to Kory, as it is a global change proposal.

nwneisen · 2024-06-11T14:57:32Z

content/docs/reference/authentication/authentication.md

+# Authentication
+
+Mirantis Kubernetes Engine (MKE) 4 uses Dex for authentication.
+If you want to use a different authentication method, disable


method -> component

nwneisen · 2024-06-11T14:58:16Z

content/docs/reference/authentication/authentication.md

+- **Identity Provider (IdP)**
+
+ To set OIDC or SAML you need to configure an IdP with an application.
+ Refer to the official Okta documentation tutorial [Add a SAML Identity Provider](https://help.okta.com/en-us/content/topics/security/idp-add-saml.htm).


This should point to the SAML providers section

nwneisen · 2024-06-11T14:58:33Z

content/docs/reference/authentication/authentication.md

+
+- **LDAP Server**
+
+ To set LDAP you need to configure an LDAP server with a user.


LDAP is many users. Not just one

nwneisen · 2024-06-11T14:59:22Z

content/docs/reference/authentication/authentication.md

+of the MKE configuration file. `authentication` is enabled by default, however
+the settings for each of the individual authentication methods are disabled.
+To enable a service, set its `enabled` configuration option to `true`.
+Doing so will completely remove any authentication-related components from


They aren't installed when it is disabled. Setting it to true will install them

content/docs/reference/authentication/LDAP.md

KoryKessel-Mirantis · 2024-06-11T11:40:31Z

content/docs/reference/authentication/OIDC.md

+OpenID Connect (OIDC) can be configured in the `authentication` section of
+the Mirantis Kubernetes Engine (MKE) 4 config.
+OIDC is disabled by default, to enable it set `enabled` to `true`.


My bad. 'enabled' needs to be enabled and 'true' needs to be true.

KoryKessel-Mirantis · 2024-06-11T11:46:42Z

content/docs/reference/authentication/OIDC.md


-The remaining fields are used to configure the OIDC provider.
+The remaining fields in the `authentication.oidc` section are used to configure


Suggest editing "refer to Create a new application in Okta section of this document." to instead read "refer to the Create a new application in Okta procedure below."

KoryKessel-Mirantis · 2024-06-11T15:47:15Z

content/docs/reference/authentication/LDAP.md

@@ -46,15 +52,17 @@ authentication:
 nameAttr: cn
 ```

-## Authentication Flow
+**To test the Authentication flow:**


@nwneisen , this approach is part of the current Mirantis docs style, to introduce straight procedures. It would be rendered as an H2 if (a) there was descriptive content behind the subject, and/or (b) there was another H2 level heading in the topic, and/or (c) there was a need for the subject to be prominent enough to display in the TOC/left-hand menu.

KoryKessel-Mirantis · 2024-06-12T12:51:35Z

content/docs/reference/authentication/OIDC.md

@@ -24,30 +28,30 @@ authentication:
 redirectURI: http://dex.example.com:32000/callback
 ```

-Use the next section to understand how to configure Okta. Once the configuration is set, run the standard `mkectl apply` command with your config file and wait for the cluster to be ready.
+**To create a new application in Okta:**


@nwneisen, I detailed the reasoning for this decision in a previous comment.

content/docs/reference/authentication/authentication.md

Authentication section update

5b21c1c

MagdaDziadosz requested review from ogusarenko and KoryKessel-Mirantis May 29, 2024 14:57

nwneisen reviewed May 29, 2024

View reviewed changes

content/docs/reference/authentication/LDAP.md Outdated Show resolved Hide resolved

content/docs/reference/authentication/LDAP.md Outdated Show resolved Hide resolved

MagdaDziadosz added 4 commits June 3, 2024 14:25

Fixes after PR review

d6844a2

Fixes after PR review

63336f5

Fixes after PR review

06e828a

Fixes after PR review

7d2f222

ry4nz reviewed Jun 6, 2024

View reviewed changes

content/docs/reference/authentication/authentication.md Show resolved Hide resolved

Fixes after review

e849e80

MagdaDziadosz requested review from nwneisen and ry4nz June 7, 2024 06:58

Fixes after review

66cc24b

nwneisen reviewed Jun 10, 2024

View reviewed changes

KoryKessel-Mirantis requested changes Jun 10, 2024

View reviewed changes

MagdaDziadosz and others added 2 commits June 11, 2024 10:03

Apply suggestions from code review

d99665f

Co-authored-by: Kory <57411706+KoryKessel-Mirantis@users.noreply.github.com>

Fixes after review

cff808d

nwneisen reviewed Jun 11, 2024

View reviewed changes

KoryKessel-Mirantis removed the request for review from ogusarenko June 11, 2024 15:43

Fixes after review

0bae8f3

MagdaDziadosz requested review from KoryKessel-Mirantis and nwneisen June 13, 2024 12:23

ry4nz reviewed Jun 13, 2024

View reviewed changes

content/docs/reference/authentication/LDAP.md Show resolved Hide resolved

Link fix

75b587e

KoryKessel-Mirantis requested changes Jun 14, 2024

View reviewed changes

Link fix

b9fab01

KoryKessel-Mirantis approved these changes Jun 14, 2024

View reviewed changes

KoryKessel-Mirantis merged commit 370a031 into main Jun 14, 2024
2 checks passed

KoryKessel-Mirantis deleted the authentication branch June 14, 2024 09:05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[DOC] Authentication section update #17

[DOC] Authentication section update #17

MagdaDziadosz commented May 29, 2024

nwneisen Jun 10, 2024

KoryKessel-Mirantis Jun 10, 2024

KoryKessel-Mirantis Jun 10, 2024

KoryKessel-Mirantis Jun 10, 2024

KoryKessel-Mirantis Jun 10, 2024

KoryKessel-Mirantis Jun 10, 2024

nwneisen Jun 11, 2024

KoryKessel-Mirantis Jun 11, 2024

nwneisen Jun 11, 2024

nwneisen Jun 11, 2024

nwneisen Jun 11, 2024

KoryKessel-Mirantis Jun 12, 2024

nwneisen Jun 11, 2024

nwneisen Jun 11, 2024

MagdaDziadosz Jun 13, 2024

nwneisen Jun 11, 2024

nwneisen Jun 11, 2024

nwneisen Jun 11, 2024

nwneisen Jun 11, 2024

KoryKessel-Mirantis Jun 11, 2024

KoryKessel-Mirantis Jun 11, 2024

KoryKessel-Mirantis Jun 11, 2024

KoryKessel-Mirantis Jun 12, 2024


		## Authentication methods

		To learn more, refer to the documentation on specific authentication methods:

	To learn more, refer to the documentation on specific authentication methods:
	Documentation for specific authentication methods as they apply to MKE 4 is available:


		To learn more, refer to the documentation on specific authentication methods:

		- [OpenID Connect (OIDC)](OIDC.md)

	- [OpenID Connect (OIDC)](OIDC.md)
	- [OIDC (OpenID Connect)](OIDC.md)

	- [Security Assertion Markup Language (SAML)](SAML.md)
	- [SAML (Security Assertion Markup Language)](SAML.md)

	- [Lightweight Directory Access Protocol (LDAP)](LDAP.md)
	- [LDAP (Lightweight Directory Access Protocol)](LDAP.md)


		The remaining fields are used to configure the OIDC provider.
		The remaining fields in the `authentication.oidc` section are used to configure

		@@ -0,0 +1,50 @@
		# Authentication

		Mirantis Kubernetes Engine (MKE) 4 uses Dex for authentication.


		- LDAP Server

		To set LDAP you need to configure an LDAP server with a user.

[DOC] Authentication section update #17

[DOC] Authentication section update #17

Conversation

MagdaDziadosz commented May 29, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment