Set Up External Authentication

    KubeSphere provides a built-in OAuth server. Users can obtain OAuth access tokens to authenticate themselves to the KubeSphere API. As a KubeSphere administrator, you can edit of the CRD ClusterConfiguration to configure OAuth and specify identity providers.

    You need to deploy a Kubernetes cluster and install KubeSphere in the cluster. For details, see Installing on Linux and .

    1. Log in to KubeSphere as admin, move the cursor to in the lower-right corner, click kubectl, and run the following command to edit ks-installer of the CRD ClusterConfiguration:

    2. Add the following fields under spec.authentication.jwtSecret.

      Example:

      • jwtSecret: Secret used to sign user tokens. In a multi-cluster environment, all clusters must use the same Secret.
      • authenticateRateLimiterMaxTries: Maximum number of consecutive login failures allowed during a period specified by authenticateRateLimiterDuration. If the number of consecutive login failures of a user reaches the limit, the user will be blocked.
      • authenticateRateLimiterDuration: Period during which authenticateRateLimiterMaxTries applies.
      • maximumClockSkew: Maximum clock skew for time-sensitive operations such as token expiration validation. The default value is 10s.
      • multipleLogin: Whether multiple users are allowed to log in from different locations. The default value is true.
      • oauthOptions: OAuth settings.
        • accessTokenMaxAge: Access token lifetime. For member clusters in a multi-cluster environment, the default value is 0h, which means access tokens never expire. For other clusters, the default value is 2h.
        • accessTokenInactivityTimeout: Access token inactivity timeout period. An access token becomes invalid after it is idle for a period specified by this field. After an access token times out, the user needs to obtain a new access token to regain access.
        • identityProviders: Identity providers.
          • : Identity provider name.
          • type: Identity provider type.
          • provider: Identity provider information. Fields in this section vary according to the identity provider type.

    3. If mappingMethod is set to lookup, run the following command and add the labels to map a KubeSphere user to a third-party account. Skip this step if mappingMethod is set to .

    4. After the fields are configured, save your changes, and wait until the restart of ks-installer is complete.

      Note

      In a multi-cluster environment, you only need to configure the host cluster.

    You can configure multiple identity providers (IdPs) in the ‘identityProviders’ section. The identity provider authenticates the user and provides an identity token to kubesphere.