diff --git a/authentication/identity_providers/configuring-google-identity-provider.adoc b/authentication/identity_providers/configuring-google-identity-provider.adoc index 1efd3bae389c..c26378d08695 100644 --- a/authentication/identity_providers/configuring-google-identity-provider.adoc +++ b/authentication/identity_providers/configuring-google-identity-provider.adoc @@ -6,7 +6,8 @@ include::_attributes/common-attributes.adoc[] toc::[] -Configure the `google` identity provider using the link:https://developers.google.com/identity/protocols/OpenIDConnect[Google OpenID Connect integration]. +[role="_abstract"] +Configure a Google identity provider so users can authenticate to {product-title} with Google accounts, or restrict sign-in to a hosted domain. ifdef::openshift-origin,openshift-enterprise,openshift-webscale[] include::modules/identity-provider-overview.adoc[leveloffset=+1] @@ -24,8 +25,13 @@ include::modules/identity-provider-google-CR.adoc[leveloffset=+1] [role="_additional-resources"] .Additional resources -* See xref:../../authentication/understanding-identity-provider.adoc#identity-provider-parameters_understanding-identity-provider[Identity provider parameters] for information on parameters, such as `mappingMethod`, that are common to all identity providers. +* xref:../../authentication/understanding-identity-provider.adoc#identity-provider-parameters_understanding-identity-provider[Identity provider parameters] include::modules/identity-provider-add.adoc[leveloffset=+1] +[id="additional-resources-google-identity-provider_{context}"] +== Additional resources + +* link:https://developers.google.com/identity/protocols/OpenIDConnect[Google OpenID Connect integration] + endif::[] diff --git a/modules/identity-provider-add.adoc b/modules/identity-provider-add.adoc index d6a460a966cc..64ce24389137 100644 --- a/modules/identity-provider-add.adoc +++ b/modules/identity-provider-add.adoc @@ -29,18 +29,18 @@ endif::[] [id="add-identity-provider_{context}"] = Adding an identity provider to your cluster -After you install your cluster, add an identity provider to it so your -users can authenticate. +[role="_abstract"] +Apply the OAuth custom resource to add an identity provider to your cluster so users can authenticate with external credentials instead of the default `kubeadmin` user. .Prerequisites -* Create an {product-title} cluster. -* Create the custom resource (CR) for your identity providers. -* You must be logged in as an administrator. +* An {product-title} cluster is installed. +* The custom resource (CR) for your identity provider is defined. +* You are logged in as an administrator. .Procedure -. Apply the defined CR: +. Apply the defined CR by running the following command: + [source,terminal] ---- @@ -53,8 +53,7 @@ If a CR does not exist, `oc apply` creates a new CR and might trigger the follow ==== ifndef::no-username-password-login[] -. Log in to the cluster as a user from your identity provider, entering the -password when prompted. +. Log in to the cluster as a user from your identity provider by running the following command, which prompts for your user name and password: + [source,terminal] ---- @@ -70,7 +69,7 @@ As long as the `kubeadmin` user has been removed, the `oc login` command provide + You can also access this page from the web console by navigating to *(?) Help* -> *Command Line Tools* -> *Copy Login Command*. -. Log in to the cluster, passing in the token to authenticate. +. Log in to the cluster by running the following command, passing in the token to authenticate: + [source,terminal] ---- @@ -82,7 +81,7 @@ $ oc login --token= ifdef::oidc[] If your OpenID Connect identity provider supports the resource owner password credentials (ROPC) grant flow, you can log in with a user name and password. You might need to take steps to enable the ROPC grant flow for your identity provider. -After the OIDC identity provider is configured in {product-title}, you can log in by using the following command, which prompts for your user name and password: +After the OIDC identity provider is configured in {product-title}, you can log in by running the following command, which prompts for your user name and password: [source,terminal] ---- @@ -96,7 +95,7 @@ endif::oidc[] ==== endif::no-username-password-login[] -. Confirm that the user logged in successfully, and display the user name. +. Confirm that the user logged in successfully and that the user name displays by running the following command: + [source,terminal] ---- diff --git a/modules/identity-provider-google-CR.adoc b/modules/identity-provider-google-CR.adoc index f0915d3f33c1..f7a7642cd18d 100644 --- a/modules/identity-provider-google-CR.adoc +++ b/modules/identity-provider-google-CR.adoc @@ -6,10 +6,8 @@ [id="identity-provider-google-CR_{context}"] = Sample Google CR -The following custom resource (CR) shows the parameters and acceptable -values for a Google identity provider. - -.Google CR +[role="_abstract"] +Use this sample OAuth custom resource to configure Google identity provider parameters, so you can apply the configuration with the correct client ID, secret reference, and hosted domain settings. [source,yaml] ---- @@ -19,24 +17,21 @@ metadata: name: cluster spec: identityProviders: - - name: googleidp <1> - mappingMethod: claim <2> + - name: googleidp + mappingMethod: claim type: Google google: - clientID: {...} <3> - clientSecret: <4> + clientID: {...} + clientSecret: name: google-secret - hostedDomain: "example.com" <5> + hostedDomain: "example.com" ---- -<1> This provider name is prefixed to the Google numeric user ID to form an -identity name. It is also used to build the redirect URL. -<2> Controls how mappings are established between this provider's identities and `User` objects. -<3> The client ID of a link:https://console.developers.google.com/[registered -Google project]. The project must be configured with a redirect URI of + +where: + +`spec.identityProviders.name`:: This provider name is prefixed to the Google numeric user ID to form an identity name. It is also used to build the redirect URL. +`spec.identityProviders.mappingMethod`:: Controls how mappings are established between identities from this provider and `User` objects. +`spec.identityProviders.google.clientID`:: The client ID from the Google Cloud project where you create the OAuth client. The project must be configured with a redirect URI of `\https://oauth-openshift.apps../oauth2callback/`. -<4> Reference to an {product-title} `Secret` object containing the client secret -issued by Google. -<5> A -link:https://developers.google.com/identity/protocols/OpenIDConnect#hd-param[hosted domain] -used to restrict sign-in accounts. Optional if the `lookup` `mappingMethod` -is used. If empty, any Google account is allowed to authenticate. +`spec.identityProviders.google.clientSecret`:: Reference to an {product-title} `Secret` object containing the client secret issued by Google. +`spec.identityProviders.google.hostedDomain`:: A hosted domain used to restrict sign-in accounts. Optional if the `lookup` `mappingMethod` is used. If empty, any Google account is allowed to authenticate. diff --git a/modules/identity-provider-google-about.adoc b/modules/identity-provider-google-about.adoc index 23e61ad22b7c..a7f314a9346d 100644 --- a/modules/identity-provider-google-about.adoc +++ b/modules/identity-provider-google-about.adoc @@ -6,7 +6,10 @@ [id="identity-provider-google-about_{context}"] = About Google authentication -Using Google as an identity provider allows any Google user to authenticate to your server. You can limit authentication to members of a specific hosted domain with the `hostedDomain` configuration attribute. +[role="_abstract"] +Allow users to sign in to {product-title} with Google accounts to simplify authentication and reduce credential management. Set a hosted domain to limit sign-in to your organization. + +Google authentication uses OpenID Connect through the cluster OAuth server. [NOTE] ==== diff --git a/modules/identity-provider-secret.adoc b/modules/identity-provider-secret.adoc index edf9175055d9..e6fd696a53ee 100644 --- a/modules/identity-provider-secret.adoc +++ b/modules/identity-provider-secret.adoc @@ -9,11 +9,12 @@ [id="identity-provider-creating-secret_{context}"] = Creating the secret -Identity providers use {product-title} `Secret` objects in the `openshift-config` namespace to contain the client secret, client certificates, and keys. +[role="_abstract"] +Create a Secret in the `openshift-config` namespace to store identity provider client secrets, certificates, or keys, so the OAuth custom resource can reference them without exposing sensitive values. .Procedure -* Create a `Secret` object containing a string by using the following command: +. Create a `Secret` object containing a string by running the following command: + [source,terminal] ---- @@ -22,7 +23,7 @@ $ oc create secret generic --from-literal=clientSecret= -n + [TIP] ==== -You can alternatively apply the following YAML to create the secret: +You can also apply the following YAML to create the secret: [source,yaml] ---- @@ -37,7 +38,7 @@ data: ---- ==== -* You can define a `Secret` object containing the contents of a file by using the following command: +. Define a `Secret` object containing the contents of a file by running the following command: + [source,terminal] ----