Giters

rancher / dashboard

The Rancher UI

Home Page:https://rancher.com

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Support SAML Single Logout (SLO)

richard-cox opened this issue · comments

commented

SURE-3572

  • Users currently only log out from local auth, or in the case of SSO external auth providers just clear local content and direct the user back to log in page... they are not signed out of the external auth provider.
  • Some customers have requested that Logging out of rancher should also log them out of the external auth provider
  • This only makes sense for some auth providers, and in a limited way
  • Linked SURE details how this should work, but briefly
    • Should be configurable (admins can enable / disable)
    • Can be optional (admins can choose to force it, or allow both types of logout)
commented

Info from the referenced PR:

  1. Extended AuthConfig, SamlConfig with the proposed flags about SLO (supported, enabled, forced).
    1. Based on the CRD setup the supported flag might be nonsense.
    2. As in, cannot be set into the initial AuthConfig CR instances. UI may have to simply know that only the SAML providers support SLO, and none of the others.
  2. New structures SamlConfigLogoutInput, and ...Output. Same fields as the known SamlConfigTest... structures. Hold the request/response data from/to the UI for the logoutAll action (see below).
  3. The tokens API should export a new action logoutAll.
  4. Basic implemention of the logout flow. Compiles, untested.
  5. Linkage between token manager and saml to invoke the flow from the frontend

KNOWN ISSUES: Does not guard against call of regular logout when SLO is forced.
Does guard against forced but not enabled, and call to logout-all when not enabled.

I hope that is enough to get UI work somewhat started, even without a Rancher image containing this.

commented

FYI we do not have logout tests with credentials

commented

@richard-cox with what else is on your 2.9.0 plate, is this something that @aalves08 can pick up?

commented

Happy to hand over and offer guidance if needed

commented

@rancher/docs the documentation for rancher manager will need updating in regards to how they should configure the Single Logout on each of the SAML providers. Ex: https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml

Final UX will be coming soon (PR #11182 is still WIP)

commented

Hello @aalves08, I have created a docs issue for this and any docs related questions or comments can be directed there. Thank you!