1 — Configuring Microsoft AD FS for Rancher

Before configuring Rancher to support AD FS users, you must add Rancher as a relying party trust in AD FS.

  • Log into your AD server as an administrative user.

  • Open the AD FS Management console. Select Add Relying Party Trust… from the Actions menu and click Start.

1 — Configuring Microsoft AD FS for Rancher - 图1

  • Select Enter data about the relying party manually as the option for obtaining data about the relying party.

1 — Configuring Microsoft AD FS for Rancher - 图2

  • Enter your desired Display name for your Relying Party Trust. For example, Rancher.

1 — Configuring Microsoft AD FS for Rancher - 图3

  • Select AD FS profile as the configuration profile for your relying party trust.

1 — Configuring Microsoft AD FS for Rancher - 图4

  • Leave the optional token encryption certificate empty, as Rancher AD FS will not be using one.

1 — Configuring Microsoft AD FS for Rancher - 图5

1 — Configuring Microsoft AD FS for Rancher - 图6

1 — Configuring Microsoft AD FS for Rancher - 图7

  • This tutorial will not cover multi-factor authentication; please refer to the Microsoft documentation if you would like to configure multi-factor authentication.

1 — Configuring Microsoft AD FS for Rancher - 图8

  • From Choose Issuance Authorization RUles, you may select either of the options available according to use case. However, for the purposes of this guide, select Permit all users to access this relying party.

1 — Configuring Microsoft AD FS for Rancher - 图9

  • After reviewing your settings, select Next to add the relying party trust.

1 — Configuring Microsoft AD FS for Rancher - 图10

  • Select Open the Edit Claim Rules… and click Close.

1 — Configuring Microsoft AD FS for Rancher - 图11

  • On the Issuance Transform Rules tab, click Add Rule….

1 — Configuring Microsoft AD FS for Rancher - 图12

  • Select Send LDAP Attributes as Claims as the Claim rule template.

1 — Configuring Microsoft AD FS for Rancher - 图13

  • Set the Claim rule name to your desired name (for example, Rancher Attributes) and select Active Directory as the Attribute store. Create the following mapping to reflect the table below:

LDAP AttributeOutgoing Claim TypeGiven-NameGiven NameUser-Principal-NameUPNToken-Groups - Qualified by Long Domain NameGroupSAM-Account-NameName

1 — Configuring Microsoft AD FS for Rancher - 图14

  • Download the federationmetadata.xml from your AD server at:
  1. https://<AD_SERVER>/federationmetadata/2007-06/federationmetadata.xml

Result: You’ve added Rancher as a relying trust party. Now you can configure Rancher to leverage AD.

Next: Configuring Rancher for Microsoft AD FS