Overview of authentication and authorization
Glossary of common terms for Red Hat OpenShift Service on AWS authentication and authorization
This glossary defines common terms that are used in Red Hat OpenShift Service on AWS authentication and authorization.
- authentication
-
An authentication determines access to an Red Hat OpenShift Service on AWS cluster and ensures only authenticated users access the Red Hat OpenShift Service on AWS cluster.
- authorization
-
Authorization determines whether the identified user has permissions to perform the requested action.
- bearer token
-
Bearer token is used to authenticate to API with the header
Authorization: Bearer <token>.
- config map
-
A config map provides a way to inject configuration data into the pods. You can reference the data stored in a config map in a volume of type
ConfigMap. Applications running in a pod can use this data. - containers
-
Lightweight and executable images that consist of software and all its dependencies. Because containers virtualize the operating system, you can run containers in a data center, public or private cloud, or your local host.
- Custom Resource (CR)
-
A CR is an extension of the Kubernetes API.
- group
-
A group is a set of users. A group is useful for granting permissions to multiple users one time.
- HTPasswd
-
HTPasswd updates the files that store usernames and password for authentication of HTTP users.
- Keystone
-
Keystone is an Red Hat OpenStack Platform (RHOSP) project that provides identity, token, catalog, and policy services.
- Lightweight directory access protocol (LDAP)
-
LDAP is a protocol that queries user information.
- namespace
-
A namespace isolates specific system resources that are visible to all processes. Inside a namespace, only processes that are members of that namespace can see those resources.
- node
-
A node is a worker machine in the Red Hat OpenShift Service on AWS cluster. A node is either a virtual machine (VM) or a physical machine.
- OAuth client
-
OAuth client is used to get a bearer token.
- OAuth server
-
The Red Hat OpenShift Service on AWS control plane includes a built-in OAuth server that determines the user’s identity from the configured identity provider and creates an access token.
- OpenID Connect
-
The OpenID Connect is a protocol to authenticate the users to use single sign-on (SSO) to access sites that use OpenID Providers.
- pod
-
A pod is the smallest logical unit in Kubernetes. A pod is comprised of one or more containers to run in a worker node.
- regular users
-
users that are created automatically in the cluster upon first login or via the API.
- request header
-
A request header is an HTTP header that is used to provide information about HTTP request context, so that the server can track the response of the request.
- role-based access control (RBAC)
-
A key security control to ensure that cluster users and workloads have access to only the resources required to execute their roles.
- service accounts
-
Service accounts are used by the cluster components or applications.
- system users
-
users that are created automatically when the cluster is installed.
- users
-
users is an entity that can make requests to API.
About authentication in Red Hat OpenShift Service on AWS
To control access to an Red Hat OpenShift Service on AWS cluster,
an administrator with the dedicated-admin role
can configure user authentication and ensure only approved users access the cluster.
To interact with an Red Hat OpenShift Service on AWS cluster, users must first authenticate to the Red Hat OpenShift Service on AWS API in some way. You can authenticate by providing an OAuth access token or an X.509 client certificate in your requests to the Red Hat OpenShift Service on AWS API.
|
If you do not present a valid access token or certificate, your request is unauthenticated and you receive an HTTP 401 error. |
An administrator can configure authentication by configuring an identity provider. You can define any supported identity provider in Red Hat OpenShift Service on AWS and add it to your cluster.
About authorization in Red Hat OpenShift Service on AWS
Authorization involves determining whether the identified user has permissions to perform the requested action.
Administrators can define permissions and assign them to users using the RBAC objects, such as rules, roles, and bindings. To understand how authorization works in Red Hat OpenShift Service on AWS, see Evaluating authorization.
You can also control access to an Red Hat OpenShift Service on AWS cluster through projects and namespaces.
Along with controlling user access to a cluster, you can also control the actions a pod can perform and the resources it can access using security context constraints (SCCs).
You can manage authorization for Red Hat OpenShift Service on AWS through the following tasks:
-
Creating a local role and assigning it to a user or group.
-
Assigning a cluster role to a user or group: Red Hat OpenShift Service on AWS includes a set of default cluster roles. You can add them to a user or group.
-
Creating cluster-admin and dedicated-admin users: The user who created the Red Hat OpenShift Service on AWS cluster can grant access to other
cluster-adminanddedicated-adminusers. -
Creating service accounts: Service accounts provide a flexible way to control API access without sharing a regular user’s credentials. A user can create and use a service account in applications and also as an OAuth client.
-
Scoping tokens: A scoped token is a token that identifies as a specific user who can perform only specific operations. You can create scoped tokens to delegate some of your permissions to another user or a service account.
-
Syncing LDAP groups: You can manage user groups in one place by syncing the groups stored in an LDAP server with the Red Hat OpenShift Service on AWS user groups.