Login improvements - Githubissues

floreks commented 7 years ago

Tracking issue for further non-critical login improvements.

[x] Allow overriding key holder name/namespace with arguments passed to dashboard. This will allow multiple dashboard deployments to use different encryption keys.
[ ] Token blacklisting feature In case user logs out his token should be invalidated. We should blacklist it until it expires.
[ ] Key rotation feature
[ ] Consider generating self-signed certificates signed by apiserver CA. This would allow to keep HTTPS enabled by default.
[ ] Support for external identity providers (i.e. Github OAuth, OIDC). #2621, #2630
[ ] Improve error handling and localize all errors.
[ ] https://github.com/kubernetes/dashboard/issues/964#issuecomment-332842897
[ ] Allow logging in when a very long token is provided (i.e. Azure with groups, etc.)

cohadar commented 6 years ago

It would be nice when I login with kubeconfig file to automatically show me the namespace from kubeconfig file instead of just showing default namespace by default.

pdf commented 6 years ago

Is there a ticket on the core side that tracks implementation of the API features/endpoints required for OIDC to work sensibly in dashboard?

floreks commented 6 years ago

I haven't been following core roadmap lately, so I don't know. We'll try to revisit it after angular migration.

colemickens commented 6 years ago

What's the latest on this? I'm interested in having OIDC auth information published in the kube-public namespace for interested clients to discover, for other reasons, in addition to possibly having the dashboard auth scenario be much simpler.

yhaskell commented 6 years ago

It would be also awesome if, when you go to some url (for example, dashboard/#!/log/namespace/pod), and it required sign, it wouldn't forget your url and send you to the page you wanted, and not to overview of default namespace.

jurgenweber commented 5 years ago

It would be absolutely fantastic if we could get some traction on this.

erandu commented 5 years ago

Also interested by the feature that @cohadar suggested :

It would be nice when I login with kubeconfig file to automatically show me the namespace from kubeconfig file instead of just showing default namespace by default.

Any news/info about this ? Thanks

nandonespolo commented 4 years ago

Is there any integration on access to the dashboard and AWS IAM?

Many thanks.

sshishov commented 4 years ago

Still waiting for this...

maciaszczykm commented 4 years ago

@sshishov You can wait or you can contribute. We are not able to do everything instantly with just a few people.

andloh commented 4 years ago

Any news regarding oidc support? :)

barnybadzoo commented 3 years ago

I know this things take a long time.. any news about it ?

floreks commented 3 years ago

The main issue is that we don't have anyone willing to work on that right now. Our main focus goes to designing and creating a new standalone gRPC API for Dashboard.

buji-code commented 2 years ago

What's the status on OIDC support?

akhil117 commented 1 year ago

Allow logging in when a very long token is provided (i.e. Azure with groups, etc.)

What's the status on Allow logging in when a very long token is provided @floreks ?

juanchovelezpro commented 2 months ago

@akhil117 If your organization has a large number of groups, probably you would need to allow only the groups you want to allow in your Cluster to avoid a huge authorization header that will be passed to the Kubernetes Dashboard. To do this you will need to select the groups in Azure AD Enterprise Applications → Search your application → Users and groups, and select the groups you want to authenticate in your cluster

kubernetes / dashboard

Login improvements #2353