Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Backport of docs: Add complete auth method payloads into release/1.15.x #18911

Merged
merged 1 commit into from
Sep 19, 2023
Merged

Backport of docs: Add complete auth method payloads into release/1.15.x #18911

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
98 changes: 74 additions & 24 deletions website/content/api-docs/acl/binding-rules.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,38 +62,63 @@ The corresponding CLI command is [`consul acl binding-rule create`](/consul/comm
- `BindType=service` - The computed bind name value is used as an
`ACLServiceIdentity.ServiceName` field in the token that is created.

<CodeBlockConfig heading="Equivalent payload for Consul token API endpoint">

```json
{ ...other fields...
"ServiceIdentities": [
{ "ServiceName": "<computed BindName>" }
]
{
"AccessorID": "<token accessor ID>",
"SecretID": "<token secret ID>",
"ServiceIdentities": [
{
"ServiceName": "<computed BindName>"
}
]
}
```

</CodeBlockConfig>

- `BindType=node` - The computed bind name value is used as an
`ACLNodeIdentity.NodeName` field in the token that is created.

<CodeBlockConfig heading="Equivalent payload for Consul token API endpoint">

```json
{ ...other fields...
"NodeIdentities": [
{ "NodeName": "<computed BindName>", "Datacenter": "<local datacenter>" }
]
{
"AccessorID": "<token accessor ID>",
"SecretID": "<token secret ID>",
"NodeIdentities": [
{
"NodeName": "<computed BindName>",
"Datacenter": "<local datacenter>"
}
]
}
```

</CodeBlockConfig>

- `BindType=role` - The computed bind name value is used as a `RoleLink.Name`
field in the token that is created. This binding rule will only apply if a
role with the given name exists at login-time. If it does not then this
rule is ignored.

<CodeBlockConfig heading="Equivalent payload for Consul token API endpoint">

```json
{ ...other fields...
"Roles": [
{ "Name": "<computed BindName>" }
]
{
"AccessorID": "<token accessor ID>",
"SecretID": "<token secret ID>",
"Roles": [
{
"Name": "<computed BindName>"
}
]
}
```

</CodeBlockConfig>

- `BindName` `(string: <required>)` - The name to bind to a token at
login-time. What it binds to can be adjusted with different values of the
`BindType` field. This can either be a plain string or lightly templated
Expand Down Expand Up @@ -250,38 +275,63 @@ The corresponding CLI command is [`consul acl binding-rule update`](/consul/comm
- `BindType=service` - The computed bind name value is used as an
`ACLServiceIdentity.ServiceName` field in the token that is created.

<CodeBlockConfig heading="Equivalent payload for Consul token API endpoint">

```json
{ ...other fields...
"ServiceIdentities": [
{ "ServiceName": "<computed BindName>" }
]
{
"AccessorID": "<token accessor ID>",
"SecretID": "<token secret ID>",
"ServiceIdentities": [
{
"ServiceName": "<computed BindName>"
}
]
}
```

</CodeBlockConfig>

- `BindType=node` - The computed bind name value is used as an
`ACLNodeIdentity.NodeName` field in the token that is created.

<CodeBlockConfig heading="Equivalent payload for Consul token API endpoint">

```json
{ ...other fields...
"NodeIdentities": [
{ "NodeName": "<computed BindName>", "Datacenter": "<local datacenter>" }
]
{
"AccessorID": "<token accessor ID>",
"SecretID": "<token secret ID>",
"NodeIdentities": [
{
"NodeName": "<computed BindName>",
"Datacenter": "<local datacenter>"
}
]
}
```

</CodeBlockConfig>

- `BindType=role` - The computed bind name value is used as a `RoleLink.Name`
field in the token that is created. This binding rule will only apply if a
role with the given name exists at login-time. If it does not then this
rule is ignored.

<CodeBlockConfig heading="Equivalent payload for Consul token API endpoint">

```json
{ ...other fields...
"Roles": [
{ "Name": "<computed BindName>" }
]
{
"AccessorID": "<token accessor ID>",
"SecretID": "<token secret ID>",
"Roles": [
{
"Name": "<computed BindName>"
}
]
}
```

</CodeBlockConfig>

- `BindName` `(string: <required>)` - The name to bind to a token at
login-time. What it binds to can be adjusted with different values of the
`BindType` field. This can either be a plain string or lightly templated
Expand Down
4 changes: 3 additions & 1 deletion website/content/docs/security/acl/auth-methods/aws-iam.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,9 @@ parameters for an auth method of type `aws-iam`:

```json
{
...other fields...
"Name": "example-iam-auth",
"Type": "aws-iam",
"Description": "Example AWS IAM auth method",
"Config": {
"BoundIAMPrincipalARNs": ["arn:aws:iam::123456789012:role/MyRoleName"],
"EnableIAMEntityDetails": true,
Expand Down
12 changes: 9 additions & 3 deletions website/content/docs/security/acl/auth-methods/jwt.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,9 @@ parameters are required to properly configure an auth method of type

```json
{
...other fields...
"Name": "example-jwt-auth-static-keys",
"Type": "jwt",
"Description": "Example JWT auth method with static keys",
"Config": {
"BoundIssuer": "corp-issuer",
"JWTValidationPubKeys": [
Expand All @@ -113,7 +115,9 @@ parameters are required to properly configure an auth method of type

```json
{
...other fields...
"Name": "example-jwt-auth-jwks",
"Type": "jwt",
"Description": "Example JWT auth method with JWKS",
"Config": {
"JWKSURL": "https://my-corp-jwks-url.example.com/",
"ClaimMappings": {
Expand All @@ -131,7 +135,9 @@ parameters are required to properly configure an auth method of type

```json
{
...other fields...
"Name": "example-oidc-auth",
"Type": "oidc",
"Description": "Example OIDC auth method",
"Config": {
"BoundAudiences": [
"V1RPi2MYptMV1RPi2MYptMV1RPi2MYpt"
Expand Down
6 changes: 4 additions & 2 deletions website/content/docs/security/acl/auth-methods/kubernetes.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
layout: docs
page_title: Kubernetes Auth Method
page_title: Kubernetes Auth Method
description: >-
Use the Kubernetes auth method type to authenticate to Consul with a Kubernetes service account token and receive an ACL token with privileges based on JWT identity attributes. Learn how to configure auth method parameters using this reference page and example configuration.
---
Expand Down Expand Up @@ -61,7 +61,9 @@ parameters are required to properly configure an auth method of type

```json
{
...other fields...
"Name": "example-k8s-auth",
"Type": "kubernetes",
"Description": "Example JWT auth method",
"Config": {
"Host": "https://192.0.2.42:8443",
"CACert": "-----BEGIN CERTIFICATE-----\n...-----END CERTIFICATE-----\n",
Expand Down
4 changes: 3 additions & 1 deletion website/content/docs/security/acl/auth-methods/oidc.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,9 @@ parameters are required to properly configure an auth method of type

```json
{
...other fields...
"Name": "example-oidc-auth",
"Type": "oidc",
"Description": "Example OIDC auth method",
"Config": {
"AllowedRedirectURIs": [
"http://localhost:8550/oidc/callback",
Expand Down
19 changes: 12 additions & 7 deletions website/content/partials/jwt_claim_mapping_details.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,13 +19,18 @@ rule, and the lists of values mapped by `ListClaimMappings` cannot.
Assume this is your config snippet:

```json
{ ...other fields...
"ClaimMappings": {
"givenName": "first_name",
"surname": "last_name"
},
"ListClaimMappings": {
"groups": "groups"
{
"Name": "example-auth-method",
"Type": "<jwt|oidc>",
"Description": "Example auth method",
"Config": {
"ClaimMappings": {
"givenName": "first_name",
"surname": "last_name"
},
"ListClaimMappings": {
"groups": "groups"
}
}
}
```
Expand Down