Update the login/Keycloak docs page #1289
Conversation
| After the initial deployment, it is **highly** recommended that you change the Keycloak `root` user password as soon as you can. | ||
|
|
||
| > NOTE: Once you change the root password you will not be able to [add users from the command line](login.md#add-user-from-the-command-line) |
There was a problem hiding this comment.
Why change the root password? Is it because the yaml config file gets checked in to version control?
There was a problem hiding this comment.
It's not needed but is advised, I agree that this text does not reflect this idea correctly. Another thing that can be done is changing the Keycloak password to use qhub secrets (though I haven't tested it yet in this case).
| Groups represent a collection of users that perform similar actions and therefore require the similar permissions. By default, QHub is deployed with the following groups: 'admin', | ||
| 'developer', 'analyst' and 'viewer'. | ||
| Groups represent a collection of users that perform similar actions and therefore require similar permissions. By default, QHub is deployed with the following groups: 'admin', | ||
| 'developer', 'analyst' and 'viewer' (in roughly descending order of power). |
There was a problem hiding this comment.
Why isn't 'viewer' in the table below?
There was a problem hiding this comment.
I think we don't even have the viewer anymore, but I would need to do a fresh deploy to be sure.
|
|
||
|  | ||
| In this example, the new group only has one mapped role (`conda_store_admin`); however it's possible to attached multiple 'Client Roles' to a single group. |
There was a problem hiding this comment.
The relationship between groups and roles here is not at all intuitive if you don't have a background in user permission systems, I think.
There was a problem hiding this comment.
I agree this is a tough topic as some of those groups as acting as a permission system and some as user "groups" only. c.c @costrouc here to better elucidate this if needed.
|
|
||
|  | ||
|  |
There was a problem hiding this comment.
If we don't indent here, then Sphinx will not continue the list numbering—it will render the "2." below as "1."
|
|
||
| Visit <https://myqhubsite.com/> (or whatever domain you have chosen for your QHub). | ||
|
|
||
| Click 'Sign in with Keycloak'. | ||
| Click 'Sign in with Keycloak'. This will take you to the login form: |
There was a problem hiding this comment.
I don't love the two-step login, even if it's used at places as preeminent as Gmail. I wonder if the button should say "Sign in with Keycloak" or just "Sign In".
There was a problem hiding this comment.
well, that's customizable, but I don't see a good enough reason for the change. But is open for discussion 🙂
| [Groups](./login.md#groups) section below for more details). | ||
|
|
||
| Enter the name you would like for the user then click 'Save'. | ||
| 7. Click save. |
There was a problem hiding this comment.
To be honest, I don't love the indentation that these markdown lists create. I wonder if it would be better to reformat as:
Step 1. Blah blah blah
Step 2.in order to avoid the indentation.
There was a problem hiding this comment.
feel free to adopt it, we can always switch back if needed 🙂
|
Hi, @gabalafou thanks for opening this pull request and adding those considerations!!! I don't know if you need my comments in there or not, but I did it anyway 😃. We are still discussing the v0.4.1 post-release changes, and once that's done we can merge this!!! Thanks again for the contribution 🚀 |
viniciusdc
added
area: documentation 📖
Related to #1076.
Changes introduced in this PR:
Types of changes
What types of changes does your PR introduce?
Put an
xin the boxes that applyTesting
Requires testing
Documentation
Does your contribution include breaking changes or deprecations?
If so have you updated the documentation?
Screenshot
Here's how the page looks after these changes: