search

loft-sh / kiosk

kiosk 🏢 Multi-Tenancy Extension For Kubernetes - Secure Cluster Sharing & Self-Service Namespace Provisioning
https://kubernetes.slack.com/?redir=%2Fmessages%2Fkiosk#/
Apache License 2.0
1.07k stars 68 forks source link

Hey is it possible/ how to use kiosk with saml2-based ADFS ? #132

Open Kiddinglife opened 3 years ago

Kiddinglife commented 3 years ago

I am currently using openunison as oidc provider that works well with saml2 ldp of the company. I saw kiosk works ith Dex. I am wondering if it also worked with openunison that is similar thing to Dex. the problem is the user group in smal2 assertin does not have pre-defined user group recource in k8s becasue k8s does not have provide api to create user groups by end-user. So mu question is does kiosk automatically link user group in saml2 assertion with account cdr resource in kiosk level?

FabianKramm commented 3 years ago

@Kiddinglife thanks for creating this issue! Kiosk uses the normal Group and User kind as you would use in any standard RoleBinding or ClusterRoleBinding:

apiVersion: tenancy.kiosk.sh/v1alpha1
kind: Account
metadata:
  name: group-account
spec:
  subjects:
  - kind: Group
    name: my-group
    apiGroup: rbac.authorization.k8s.io

So as long as your authentication provider does fill the groups field correctly, it works perfectly fine with kiosk as well.