This documentation is for a release that is no longer maintained
See documentation for the latest supported version 3 or the latest supported version 4.第 4 章 Configuring identity providers
4.1. Configuring an HTPasswd identity provider 复制链接链接已复制到粘贴板!
By default, only a kubeadmin
user exists on your cluster. To specify an identity provider, you must create a Custom Resource (CR) that describes that identity provider and add it to the cluster.
OpenShift Container Platform user names containing /
, :
, and %
are not supported.
To define an HTPasswd identity provider you must perform the following steps:
-
Create an
htpasswd
file to store the user and password information. Instructions are provided for Linux and Windows. -
Create an OpenShift Container Platform secret to represent the
htpasswd
file. - Define the HTPasswd identity provider resource.
- Apply the resource to the default OAuth configuration.
4.1.2. Creating an HTPasswd file using Linux 复制链接链接已复制到粘贴板!
To use the HTPasswd identity provider, you must generate a flat file that contains the user names and passwords for your cluster by using htpasswd
.
Prerequisites
-
Have access to the
htpasswd
utility. On Red Hat Enterprise Linux this is available by installing thehttpd-tools
package.
Procedure
Create or update your flat file with a user name and hashed password:
htpasswd -c -B -b </path/to/users.htpasswd> <user_name> <password>
$ htpasswd -c -B -b </path/to/users.htpasswd> <user_name> <password>
Copy to Clipboard Copied! Toggle word wrap Toggle overflow The command generates a hashed version of the password.
For example:
htpasswd -c -B -b users.htpasswd user1 MyPassword!
$ htpasswd -c -B -b users.htpasswd user1 MyPassword!
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Example output
Adding password for user user1
Adding password for user user1
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Continue to add or update credentials to the file:
htpasswd -B -b </path/to/users.htpasswd> <user_name> <password>
$ htpasswd -B -b </path/to/users.htpasswd> <user_name> <password>
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
4.1.3. Creating an HTPasswd file using Windows 复制链接链接已复制到粘贴板!
To use the HTPasswd identity provider, you must generate a flat file that contains the user names and passwords for your cluster by using htpasswd
.
Prerequisites
-
Have access to
htpasswd.exe
. This file is included in the\bin
directory of many Apache httpd distributions.
Procedure
Create or update your flat file with a user name and hashed password:
> htpasswd.exe -c -B -b <\path\to\users.htpasswd> <user_name> <password>
> htpasswd.exe -c -B -b <\path\to\users.htpasswd> <user_name> <password>
Copy to Clipboard Copied! Toggle word wrap Toggle overflow The command generates a hashed version of the password.
For example:
> htpasswd.exe -c -B -b users.htpasswd user1 MyPassword!
> htpasswd.exe -c -B -b users.htpasswd user1 MyPassword!
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Example output
Adding password for user user1
Adding password for user user1
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Continue to add or update credentials to the file:
> htpasswd.exe -b <\path\to\users.htpasswd> <user_name> <password>
> htpasswd.exe -b <\path\to\users.htpasswd> <user_name> <password>
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
4.1.4. Creating the HTPasswd Secret 复制链接链接已复制到粘贴板!
To use the HTPasswd identity provider, you must define a secret that contains the HTPasswd user file.
Prerequisites
- Create an HTPasswd file.
Procedure
Create an OpenShift Container Platform
Secret
object that contains the HTPasswd users file.oc create secret generic htpass-secret --from-file=htpasswd=</path/to/users.htpasswd> -n openshift-config
$ oc create secret generic htpass-secret --from-file=htpasswd=</path/to/users.htpasswd> -n openshift-config
Copy to Clipboard Copied! Toggle word wrap Toggle overflow 注意The secret key containing the users file for the
--from-file
argument must be namedhtpasswd
, as shown in the above command.
4.1.5. Sample HTPasswd CR 复制链接链接已复制到粘贴板!
The following custom resource (CR) shows the parameters and acceptable values for an HTPasswd identity provider.
HTPasswd CR
Additional resources
-
See Identity provider parameters for information on parameters, such as
mappingMethod
, that are common to all identity providers.
4.1.6. Adding an identity provider to your clusters 复制链接链接已复制到粘贴板!
After you install your cluster, add an identity provider to it so your users can authenticate.
Prerequisites
- Create an OpenShift Container Platform cluster.
- Create the custom resource (CR) for your identity providers.
- You must be logged in as an administrator.
Procedure
Apply the defined CR:
oc apply -f </path/to/CR>
$ oc apply -f </path/to/CR>
Copy to Clipboard Copied! Toggle word wrap Toggle overflow 注意If a CR does not exist,
oc apply
creates a new CR and might trigger the following warning:Warning: oc apply should be used on resources created by either oc create --save-config or oc apply
. In this case you can safely ignore this warning.Log in to the cluster as a user from your identity provider, entering the password when prompted.
oc login -u <username>
$ oc login -u <username>
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Confirm that the user logged in successfully, and display the user name.
oc whoami
$ oc whoami
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
4.1.7. Updating users for an HTPasswd identity provider 复制链接链接已复制到粘贴板!
You can add or remove users from an existing HTPasswd identity provider.
Prerequisites
-
You have created a
Secret
object that contains the HTPasswd user file. This procedure assumes that it is namedhtpass-secret
. -
You have configured an HTPasswd identity provider. This procedure assumes that it is named
my_htpasswd_provider
. -
You have access to the
htpasswd
utility. On Red Hat Enterprise Linux this is available by installing thehttpd-tools
package. - You have cluster administrator privileges.
Procedure
Retrieve the HTPasswd file from the
htpass-secret
Secret
object and save the file to your file system:oc get secret htpass-secret -ojsonpath={.data.htpasswd} -n openshift-config | base64 --decode > users.htpasswd
$ oc get secret htpass-secret -ojsonpath={.data.htpasswd} -n openshift-config | base64 --decode > users.htpasswd
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Add or remove users from the
users.htpasswd
file.To add a new user:
htpasswd -bB users.htpasswd <username> <password>
$ htpasswd -bB users.htpasswd <username> <password>
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Example output
Adding password for user <username>
Adding password for user <username>
Copy to Clipboard Copied! Toggle word wrap Toggle overflow To remove an existing user:
htpasswd -D users.htpasswd <username>
$ htpasswd -D users.htpasswd <username>
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Example output
Deleting password for user <username>
Deleting password for user <username>
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
Replace the
htpass-secret
Secret
object with the updated users in theusers.htpasswd
file:oc create secret generic htpass-secret --from-file=htpasswd=users.htpasswd --dry-run=client -o yaml -n openshift-config | oc replace -f -
$ oc create secret generic htpass-secret --from-file=htpasswd=users.htpasswd --dry-run=client -o yaml -n openshift-config | oc replace -f -
Copy to Clipboard Copied! Toggle word wrap Toggle overflow If you removed one or more users, you must additionally remove existing resources for each user.
Delete the
User
object:oc delete user <username>
$ oc delete user <username>
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Example output
user.user.openshift.io "<username>" deleted
user.user.openshift.io "<username>" deleted
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Be sure to remove the user, otherwise the user can continue using their token as long as it has not expired.
Delete the
Identity
object for the user:oc delete identity my_htpasswd_provider:<username>
$ oc delete identity my_htpasswd_provider:<username>
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Example output
identity.user.openshift.io "my_htpasswd_provider:<username>" deleted
identity.user.openshift.io "my_htpasswd_provider:<username>" deleted
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
Configure your identity provider (IDP) through the web console instead of the CLI.
Prerequisites
- You must be logged in to the web console as a cluster administrator.
Procedure
-
Navigate to Administration
Cluster Settings. - Under the Global Configuration tab, click OAuth.
- Under the Identity Providers section, select your identity provider from the Add drop-down menu.
You can specify multiple IDPs through the web console without overwriting existing IDPs.