/ /

利用 Kubernetes 的联合身份验证

Atlas Kubernetes Operator supports using federated authentication for your Atlas organization.

注意

You can't use Atlas Kubernetes Operator to set up an IdP. To set up an IdP, see Configure Database Deployment Authentication and Authorization.

设立IdP后，您可以管理角色映射，对用户进行身份验证以使用IdP 。

要通过 Atlas Kubernetes Operator 配置联合身份验证，您必须指定并更新AtlasFederatedAuth自定义资源。

When you create the AtlasFederatedAuth custom resource, Atlas Kubernetes Operator uses the Federated Authentication API Resource to update the organization configuration for the federation. In the organization configuration, you specify federation settings for your Atlas organization such as organization and role mappings.

The AtlasFederatedAuth Custom Resource is not required to map database users to an IdP, both any existing authentication IdP or workload and workforce IdP. You can use the AtlasDatabaseUser custom resource to manage database users, in which you specify the authentication method used for a given database user. The AtlasDatabaseUser custom resource must be configured in conjunction with federated authentication to associate users and roles in the IdP with users and groups in MongoDB.

The AtlasFederatedAuth Custom Resource is optional to use any federated authentication, provided that you have configured it elsewhere in Atlas.

先决条件

在使用 Atlas Kubernetes Operator 配置联合身份验证之前，您必须具备：

An existing identity provider (IdP) linked to Atlas. To learn how to link an IdP to Atlas, see Manage Identity Providers.
具有API密钥的密钥， Atlas Kubernetes Operator可使用该密钥连接到Atlas。 API密钥必须具有 Organization Owner角色。
在活跃的 Atlas 组织或组织中的项目中至少有一个角色。

更新组织配置

要通过 Atlas Kubernetes Operator 配置联合身份验证，请通过指定AtlasFederatedAuth自定义资源来更新联合的组织配置。

以下示例配置了执行以下操作的AtlasFederatedAuth自定义资源：

为链接到指定密钥的组织启用联合身份验证.
将my-org-domain.com添加为已批准的域。
为组织启用域限制。
禁用SSO调试。
Grants the Organization Member role to users after authenticating.
Maps the Organization Owner role for the organization and applies the role mapping to an IdP group named org-admin.
Maps the Organization Project Creator and Project Owner roles for a project in the organization named dev-project and applies the role mapping to an IdP group named dev-team.

要了解更多信息，请参阅参数。

注意

spec.roleMappings.roleAssignments 参数必须包含当前组织或组织中的项目中的至少一个组织角色。

示例：

cat <<EOF | kubectl apply -f -
apiVersion: atlas.mongodb.com/v1
kind: AtlasFederatedAuth
metadata:
  name: atlas-default-federated-auth
  namespace: mongodb-atlas-system
spec:
  enabled: true
  dataAccessIdentityProviders:
    - 32b6e34b3d91647abb20e7b8
    - 42d8v92k5a34184rnv93f0c1
  connectionSecretRef:
    name: my-org-secret
    namespace: mongodb-atlas-system
  domainAllowList:
    - my-org-domain.com
  domainRestrictionEnabled: true
  ssoDebugEnabled: false
  postAuthRoleGrants:
    - ORG_MEMBER
  roleMappings:
    - externalGroupName: org-admin
      roleAssignments:
        - role: ORG_OWNER
    - externalGroupName: dev-team
      roleAssignments:
        - role: ORG_GROUP_CREATOR
        - projectName: dev-project
          role: GROUP_OWNER
EOF

要检查更新进程的状态，请运行以下命令：

kubectl get atlasfederatedauth -o yaml

Atlas Kubernetes Operator 返回自定义资源并包含类似于以下示例的状态部分：

status:
  conditions:
    - type: Ready
      status: True
    - type: RolesReady
      status: True
    - type: UsersReady
      status: True

要了解此资源的可用参数，请参阅AtlasFederatedAuth自定义资源。