Where to start setting up access
The order of connecting users and groups in the platform.
The page is needed by the platform administrator, who, after installation, configures user login and assignment of rights.
The platform can work with external user sources:
| Source | When to choose | Where to configure |
|---|---|---|
| LDAP | Users and groups already exist in Active Directory, OpenLDAP, FreeIPA, ALD Pro, Samba DC, MULTIDIRECTORY | LDAP integration |
| OIDC provider | Use Keycloak or Blitz to log in | External Authentication Providers |
LDAP and OIDC provider can be connected to the platform simultaneously. LDAP is used to log users in through the platform’s internal authentication service, as well as to look up users and groups when assigning rights. If a user authenticates with an external OIDC provider, the platform obtains authentication credentials from a directory connected to that provider, rather than from the LDAP directory configured in the platform.
Access in the platform is built around users and groups from external sources, who are assigned sets of permissions at the platform, tenant, cluster or namespace level. The general scheme of components is described in Architecture of access modules, and the low-level objects that the platform creates when setting rights are described in the section Custom resources for managing access rights.
Setting order
- Connect the user source:
- LDAP/LDAPS - if users and groups are in the LDAP directory;
- OIDC provider - if the login must go through an external authentication service (Keycloak or Blitz).
- Check the connection:
- for LDAP - search for a user or group when assigning rights;
- for OIDC provider - check the login through the external service and, if errors occur, use instructions for restoring access.
- Look at the existing permission sets in the platform and, if necessary, create custom ones.
- Assign rights to users or groups.
- Check the results of all user and group assignments on the Access Tree page.