Skip to content

OSDOCS-16959-config-google CQA #116118

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wgabor0427 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

OSDOCS-16959-config-google CQA #116118

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions authentication/identity_providers/configuring-google-identity-provider.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,8 @@ include::_attributes/common-attributes.adoc[]

toc::[]

Configure the `google` identity provider using the link:https://developers.google.com/identity/protocols/OpenIDConnect[Google OpenID Connect integration].
[role="_abstract"]
Configure a Google identity provider so users can authenticate to {product-title} with Google accounts, or restrict sign-in to a hosted domain.

ifdef::openshift-origin,openshift-enterprise,openshift-webscale[]
include::modules/identity-provider-overview.adoc[leveloffset=+1]
Expand All @@ -24,8 +25,13 @@ include::modules/identity-provider-google-CR.adoc[leveloffset=+1]
[role="_additional-resources"]
.Additional resources

* See xref:../../authentication/understanding-identity-provider.adoc#identity-provider-parameters_understanding-identity-provider[Identity provider parameters] for information on parameters, such as `mappingMethod`, that are common to all identity providers.
* xref:../../authentication/understanding-identity-provider.adoc#identity-provider-parameters_understanding-identity-provider[Identity provider parameters]

include::modules/identity-provider-add.adoc[leveloffset=+1]

[id="additional-resources-google-identity-provider_{context}"]
== Additional resources

* link:https://developers.google.com/identity/protocols/OpenIDConnect[Google OpenID Connect integration]

endif::[]
21 changes: 10 additions & 11 deletions modules/identity-provider-add.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,18 +29,18 @@ endif::[]
[id="add-identity-provider_{context}"]
= Adding an identity provider to your cluster

After you install your cluster, add an identity provider to it so your
users can authenticate.
[role="_abstract"]
Apply the OAuth custom resource to add an identity provider to your cluster so users can authenticate with external credentials instead of the default `kubeadmin` user.

.Prerequisites

* Create an {product-title} cluster.
* Create the custom resource (CR) for your identity providers.
* You must be logged in as an administrator.
* An {product-title} cluster is installed.
* The custom resource (CR) for your identity provider is defined.
* You are logged in as an administrator.

.Procedure

. Apply the defined CR:
. Apply the defined CR by running the following command:
+
[source,terminal]
----
Expand All @@ -53,8 +53,7 @@ If a CR does not exist, `oc apply` creates a new CR and might trigger the follow
====

ifndef::no-username-password-login[]
. Log in to the cluster as a user from your identity provider, entering the
password when prompted.
. Log in to the cluster as a user from your identity provider by running the following command, which prompts for your user name and password:
+
[source,terminal]
----
Expand All @@ -70,7 +69,7 @@ As long as the `kubeadmin` user has been removed, the `oc login` command provide
+
You can also access this page from the web console by navigating to *(?) Help* -> *Command Line Tools* -> *Copy Login Command*.

. Log in to the cluster, passing in the token to authenticate.
. Log in to the cluster by running the following command, passing in the token to authenticate:
+
[source,terminal]
----
Expand All @@ -82,7 +81,7 @@ $ oc login --token=<token>
ifdef::oidc[]
If your OpenID Connect identity provider supports the resource owner password credentials (ROPC) grant flow, you can log in with a user name and password. You might need to take steps to enable the ROPC grant flow for your identity provider.

After the OIDC identity provider is configured in {product-title}, you can log in by using the following command, which prompts for your user name and password:
After the OIDC identity provider is configured in {product-title}, you can log in by running the following command, which prompts for your user name and password:

[source,terminal]
----
Expand All @@ -96,7 +95,7 @@ endif::oidc[]
====
endif::no-username-password-login[]

. Confirm that the user logged in successfully, and display the user name.
. Confirm that the user logged in successfully and that the user name displays by running the following command:
+
[source,terminal]
----
Expand Down
35 changes: 15 additions & 20 deletions modules/identity-provider-google-CR.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,10 +6,8 @@
[id="identity-provider-google-CR_{context}"]
= Sample Google CR

The following custom resource (CR) shows the parameters and acceptable
values for a Google identity provider.

.Google CR
[role="_abstract"]
Use this sample OAuth custom resource to configure Google identity provider parameters, so you can apply the configuration with the correct client ID, secret reference, and hosted domain settings.

[source,yaml]
----
Expand All @@ -19,24 +17,21 @@ metadata:
name: cluster
spec:
identityProviders:
- name: googleidp <1>
mappingMethod: claim <2>
- name: googleidp
mappingMethod: claim
type: Google
google:
clientID: {...} <3>
clientSecret: <4>
clientID: {...}
clientSecret:
name: google-secret
hostedDomain: "example.com" <5>
hostedDomain: "example.com"
----
<1> This provider name is prefixed to the Google numeric user ID to form an
identity name. It is also used to build the redirect URL.
<2> Controls how mappings are established between this provider's identities and `User` objects.
<3> The client ID of a link:https://console.developers.google.com/[registered
Google project]. The project must be configured with a redirect URI of

where:

`spec.identityProviders.name`:: This provider name is prefixed to the Google numeric user ID to form an identity name. It is also used to build the redirect URL.
`spec.identityProviders.mappingMethod`:: Controls how mappings are established between identities from this provider and `User` objects.
`spec.identityProviders.google.clientID`:: The client ID from the Google Cloud project where you create the OAuth client. The project must be configured with a redirect URI of
`\https://oauth-openshift.apps.<cluster-name>.<cluster-domain>/oauth2callback/<idp-provider-name>`.
<4> Reference to an {product-title} `Secret` object containing the client secret
issued by Google.
<5> A
link:https://developers.google.com/identity/protocols/OpenIDConnect#hd-param[hosted domain]
used to restrict sign-in accounts. Optional if the `lookup` `mappingMethod`
is used. If empty, any Google account is allowed to authenticate.
`spec.identityProviders.google.clientSecret`:: Reference to an {product-title} `Secret` object containing the client secret issued by Google.
`spec.identityProviders.google.hostedDomain`:: A hosted domain used to restrict sign-in accounts. Optional if the `lookup` `mappingMethod` is used. If empty, any Google account is allowed to authenticate.
5 changes: 4 additions & 1 deletion modules/identity-provider-google-about.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,10 @@
[id="identity-provider-google-about_{context}"]
= About Google authentication

Using Google as an identity provider allows any Google user to authenticate to your server. You can limit authentication to members of a specific hosted domain with the `hostedDomain` configuration attribute.
[role="_abstract"]
Allow users to sign in to {product-title} with Google accounts to simplify authentication and reduce credential management. Set a hosted domain to limit sign-in to your organization.

Google authentication uses OpenID Connect through the cluster OAuth server.

[NOTE]
====
Expand Down
9 changes: 5 additions & 4 deletions modules/identity-provider-secret.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,11 +9,12 @@
[id="identity-provider-creating-secret_{context}"]
= Creating the secret

Identity providers use {product-title} `Secret` objects in the `openshift-config` namespace to contain the client secret, client certificates, and keys.
[role="_abstract"]
Create a Secret in the `openshift-config` namespace to store identity provider client secrets, certificates, or keys, so the OAuth custom resource can reference them without exposing sensitive values.

.Procedure

* Create a `Secret` object containing a string by using the following command:
. Create a `Secret` object containing a string by running the following command:
+
[source,terminal]
----
Expand All @@ -22,7 +23,7 @@ $ oc create secret generic <secret_name> --from-literal=clientSecret=<secret> -n
+
[TIP]
====
You can alternatively apply the following YAML to create the secret:
You can also apply the following YAML to create the secret:

[source,yaml]
----
Expand All @@ -37,7 +38,7 @@ data:
----
====

* You can define a `Secret` object containing the contents of a file by using the following command:
. Define a `Secret` object containing the contents of a file by running the following command:
+
[source,terminal]
----
Expand Down