SpaceDeck – Administration
Access the Administration Screen
If a user role is defined as an Admin, the Administration screens can be accessed via the cog at the bottom left hand corner.
In order to create, delete or update Connection (Identify Provider) or Roles Management settings, the user should be assigned the appropriate role. These are specified below.
An explanation of all the available permissions can be found in the Security Overview page.
General Setup
Populate the Connection fields in order to configure SSO login using a predefined IDP.
For user management through the IDP, roles and groups are created and then certain roles can be assigned to the user, for example admin. Via SpaceDeck roles are then created with the same name which was created in the IDP and permissions are then assigned accordingly for each role.
Refer to SpaceDeck - SSO IDP Setup for an example of IDP setup through Okta
In order to be able to configure the Connection (Identify Provider) fields the user has to be assigned the specific permission of Manager Identify Providers, otherwise an error 403 (Forbidden) response will be displayed.
An explanation of all the available roles and permissions can be found on the Security Overview page.
Connection Fields
-
Provider type – The protocol the IDP supports. Currently GigaSpaces supports using any IDP that supports OpenID Connect (OIDC).
-
Provider id – This is a generic ID that will be used as a name for the auth-config creator.
-
Redirect URIs – Upon successful sign-in, this endpoint in our server will receive the data from the IDP.
-
Issue URL – URL of the IDP issuer. For example, Okta, JumpCloud, Azure Active Directory.
-
Client Id – Unlike the Provider ID, this ID serves as a unique identifier which the IDP generates to the user so they can identify with it,
-
Client Secret – This is a secret key that is used with the Client ID in order to improve security.
-
Authorization Grant Type – Each IDP has rules regarding how roles are grouped. These rules have an arbitrary name provided by the IDP. The roles user must use this name to create the roles.
-
Scope - Azure AD can generate two versions of tokens v1.0 and v2.0 . However, using the default scope “openid” that GigaSpaces use for all other identity providers (like Okta), Azure AD will only generates a token for v1.0. As GigaSpaces require a token of v2.0, the contents of this custom Scope field is used to request that Azure AD generate a token version v2.0. See the Azure AD IDP Setup tab for more details.
Once the connection details are entered, click Apply.
Role Management
Each role that is configured will have certain privileges (permissions) assigned to it.
The roles should be configured by the company IT manager in the config map of the Kubernetes environment or through IDP setup.
Default Roles
If there is no configuration in the config map (this is not recommended), there is one default roles that is included with the installation which cannot be edited via SpaceDeck and this is ROLE_ADMIN.
To see which privileges (permissions) are applied to a role (in this case ROLE_ADMIN), click the role name:
From the IDP side the default role of ROLE_ADMIN will not be created automatically during launch. Therefore, the admin should manually create a group (role) in the IDP with the same name as the default role name in the config map.