跳到主要内容
版本：v2.5

1. Configuring Microsoft AD FS for Rancher

Before you configure Rancher to support Active Directory Federation Service (AD FS), you must add Rancher as a relying party trust in AD FS.

  1. Log into your AD server as an administrative user.

  2. Open the AD FS Management console. Select Add Relying Party Trust... from the Actions menu and click Start.

  3. Select Enter data about the relying party manually as the option for obtaining data about the relying party.

  4. Enter your desired Display name for your Relying Party Trust. For example, Rancher.

  5. Select AD FS profile as the configuration profile for your relying party trust.

  6. Leave the optional token encryption certificate empty, as Rancher AD FS will not be using one.

  7. Select Enable support for the SAML 2.0 WebSSO protocol and enter https://<rancher-server>/v1-saml/adfs/saml/acs for the service URL.

  8. Add https://<rancher-server>/v1-saml/adfs/saml/metadata as the Relying party trust identifier.

  9. This tutorial will not cover multi-factor authentication; please refer to the Microsoft documentation if you would like to configure multi-factor authentication.

  10. From Choose Issuance Authorization RUles, you may select either of the options available according to use case. However, for the purposes of this guide, select Permit all users to access this relying party.

  11. After reviewing your settings, select Next to add the relying party trust.

  1. Select Open the Edit Claim Rules... and click Close.

  2. On the Issuance Transform Rules tab, click Add Rule....

  3. Select Send LDAP Attributes as Claims as the Claim rule template.

  4. Set the Claim rule name to your desired name (for example, Rancher Attributes) and select Active Directory as the Attribute store. Create the following mapping to reflect the table below:

    LDAP AttributeOutgoing Claim Type
    Given-NameGiven Name
    User-Principal-NameUPN
    Token-Groups - Qualified by Long Domain NameGroup
    SAM-Account-NameName

  5. Download the federationmetadata.xml from your AD server at:

https://<AD_SERVER>/federationmetadata/2007-06/federationmetadata.xml

Result: You've added Rancher as a relying trust party. Now you can configure Rancher to leverage AD.

Next: Configuring Rancher for Microsoft AD FS​