mirror of https://github.com/docker/docs.git
Update LDAP integration topic for UCP 2.1.3 web ui (#3107)
This commit is contained in:
Jim Galasyn
GitHub
parent
8cb2926ce6
commit
35f2f181b3
|
|
@ -24,33 +24,60 @@ go to the **UCP web UI**, navigate to the **Admin Settings** page, and click the
|
|||
|
||||
Then configure your LDAP directory integration.
|
||||
|
||||
**Authentication**
|
||||
## Authentication
|
||||
|
||||
| Field | Description |
|
||||
|:-------------------------------------------------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| Method | The method used to create and authenticate users. The *LDAP* method uses a remote directory server to automatically create users and all logins will be forwarded to the directory server. |
|
||||
| Default permission for newly discovered accounts | The permission level assigned by default to a new user. [Learn more about default permission levels](../../manage-users/permission-levels.md). |
|
||||
|
||||
**Login session controls**
|
||||
|
||||
Click **+** on the right side of the Authentication section to specify settings for user sessions.
|
||||
|
||||
| Field | Description |
|
||||
|:------------------------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| Lifetime hours | Specifies the initial lifetime (in hours) of a session from the moment it is generated. |
|
||||
| Renewal threshold hours | Indicates a period of time (in hours) before the expiration of a session where, if used, a session will be extended by the current configured lifetime from then. This value cannot be greater than the configured lifetime. A value equal to the lifetime means that sessions will be extended with every use. A value of zero indicates that sessions should never be extended but this may result in unexpectedly being logged out if the session expires while performing a series of actions in the UI. |
|
||||
| Per user limit | Specifies the maximum number of sessions that any user can have active at any given time. If creating a new session would put a user over this limit then the least recently used session will be deleted. A value of zero disables limiting the number of sessions that users may have. |
|
||||
|
||||
Click **Update Sessions Config** to save your login sessions settings.
|
||||
|
||||
## LDAP Account Provisioning Settings
|
||||
|
||||
**Recovery Admin Account**
|
||||
|
||||
| Field | Description |
|
||||
|:------------------------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| Recovery admin username | The username for a recovery user that can access UCP even when the integration with LDAP is misconfigured or the LDAP server is offline. |
|
||||
| Recovery admin password | The password for the recovery user which is securely salted and hashed and stored in UCP. The recovery admin user can use this password to login if the LDAP server is misconfigured or offline. |
|
||||
|
||||
|
||||
**LDAP server configuration**
|
||||
|
||||
| Field | Description |
|
||||
|:------------------------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| LDAP server URL | The URL where the LDAP server can be reached. |
|
||||
| Recovery admin username | The username for a recovery user that can access UCP even when the integration with LDAP is misconfigured or the LDAP server is offline. |
|
||||
| Recovery admin password | The password for the recovery user which is securely salted and hashed and stored in UCP. The recovery admin user can use this password to login if the LDAP server is misconfigured or offline. |
|
||||
| Reader DN | The distinguished name of the LDAP account used for searching entries in the LDAP server. As a best practice this should be an LDAP read-only user. |
|
||||
| Reader password | The password of the account used for searching entries in the LDAP server. |
|
||||
|
||||
**LDAP security options**
|
||||
|
||||
| Field | Description |
|
||||
|:----------------------------------------|:--------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| Reader password | The password of the account used for searching entries in the LDAP server.
|
||||
| Skip verification of server certificate | Whether to verify the LDAP server certificate when using TLS. The connection is still encrypted, but vulnerable to man-in-the-middle attacks. |
|
||||
| Use StartTLS | Whether to authenticate/encrypt the connection after connecting to the LDAP server over TCP. If you set the LDAP Server URL field with `ldaps://`, this field is ignored. |
|
||||
| No simple pagination | If your LDAP server doesn't support pagination. |
|
||||
|
||||
**Additional Domain Servers**
|
||||
|
||||
A list of additional LDAP domains and corresponding server configs from which to sync users and team members.
|
||||
|
||||
Click **+ Add another domain server** to add more LDAP domains.
|
||||
|
||||
| Field | Description |
|
||||
|:------------------------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| LDAP domain | The root domain component of this server, for example, `dc=example,dc=com`. A longest-suffix match of the base DN for LDAP searches is used to select which LDAP server to use for search requests. If no matching domain is found, the default LDAP server config is used. |
|
||||
|
||||
|
||||
**User search configurations**
|
||||
|
||||
| Field | Description |
|
||||
| Field | Description |
|
||||
|:------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| Base DN | The distinguished name of the node in the directory tree where the search should start looking for users. |
|
||||
| Username attribute | The LDAP attribute to use as username on UCP. Only user entries with a valid username will be created. A valid username is no longer than 100 characters and does not contain any unprintable characters, whitespace characters, or any of the following characters: `/` `\` `[` `]` `:` `;` `|` `=` `,` `+` `*` `?` `<` `>` `'` `"`. |
|
||||
|
|
@ -70,15 +97,6 @@ where users may be found in multiple distinct subtrees of your organization's
|
|||
directory. Any user entry which matches at least one of the search
|
||||
configurations will be synced as a user.
|
||||
|
||||
**Advanced LDAP configuration**
|
||||
|
||||
| Field | Description |
|
||||
|:---------------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| No simple pagination | If your LDAP server doesn't support pagination. |
|
||||
| Enable sync of admin users | Whether to import LDAP users as UCP administrators. |
|
||||
| LDAP Match Method | If admin user sync is enabled, this option specifies whether to match admin user entries using a search query or by selecting them as members from a group. For the expanded options, refer to the options described below. |
|
||||
|
||||
|
||||
**Match LDAP Group Members**
|
||||
|
||||
This option specifies that system admins should be synced directly with members
|
||||
|
|
@ -104,6 +122,18 @@ remain a system admin.
|
|||
| Search scope | Whether to perform the LDAP search on a single level of the LDAP tree, or search through the full LDAP tree starting at the Base DN. |
|
||||
| Search Filter | The LDAP search filter used to find users. If you leave this field empty, all existing users in the search scope will be added as members of the team. |
|
||||
|
||||
**Advanced LDAP configuration**
|
||||
|
||||
Click **+** on the right side of the provisioning section to specify advanced settings for LDAP configuration.
|
||||
|
||||
| Field | Description |
|
||||
|:---------------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| Enable sync of admin users | Whether to import LDAP users as UCP administrators. |
|
||||
| LDAP Match Method | If admin user sync is enabled, this option specifies whether to match admin user entries using a search query or by selecting them as members from a group. For the expanded options, refer to the options described below. |
|
||||
| Base DN | The distinguished name of the element from which the LDAP server will search for users. |
|
||||
| Search filter | Whether to search for users in the entire subtree of the base DN or to only search one level under the base DN (if false). |
|
||||
| Search scope | Whether to perform the LDAP search on a single level of the LDAP tree, or search through the full LDAP tree starting at the Base DN. |
|
||||
|
||||
|
||||
**Sync configuration**
|
||||
|
||||
|
|
|
|||
Binary file not shown.
|
Before Width: | Height: | Size: 272 KiB After Width: | Height: | Size: 71 KiB |
Loading…
Reference in New Issue