Project

General

Profile

Actions

Cleanup #53127

open

mgr/dashboard: improve SAML2 SSO (Cephadm) set-up

Added by Ernesto Puerta over 2 years ago. Updated over 2 years ago.

Status:
New
Priority:
Normal
Assignee:
-
Category:
Security & Auth
Target version:
% Done:

0%

Tags:
Backport:
pacific
Reviewed:
Affected Versions:
Pull request ID:

Description

As described here with cephadm the ceph CLI commands no longer share the same filesystem as the mgr daemon's (as it happened with pre-containerized envs).

Additionally, some of the input arguments (sp_x_509_cert and sp_private_key) are of CephFilepath type, which validates (tries to open) the file path in the environment where the ceph CLI is running (which will be different than the daemon's one). This will force the user to ensure that the target files exist in both locations (same file path for 2 different environments).

In the case of cephadm this basically forces the user to duplicate the files and complicates the setup of the Dashboard SSO.

Approaches:
  • Change input parameter type CephFilepath to CephString (this will avoid the need of file duplication)
  • Use cephamd shell with the mgr mounts (cephadm shell -n mgr.<hostname> -m <mount>)
  • Extend the Ceph CLI tool current behaviour to inject contents of more than one file (-i <file>).
  • Improve documentation based on the user feedback.
Actions #1

Updated by Ernesto Puerta over 2 years ago

  • Tracker changed from Bug to Cleanup
  • Assignee deleted (Avan Thakkar)
Actions

Also available in: Atom PDF