User guide

Gafaelfawr was written to run within the Vera C. Rubin Science Platform. While there is nothing intrinsic in Gafaelfawr that would prevent it from working in some other environment, only installation via Phalanx is supported or has been tested.

Configuration

• Prerequisites
• Authentication provider
  • GitHub
  • CILogon
  • Other OpenID Connect provider
• Vault secrets
• Helm configuration
  • Basic settings
  • Authentication provider
    • GitHub
    • CILogon
    • Generic OpenID Connect
  • LDAP
    • LDAP authentication
    • LDAP groups
    • LDAP user information
  • Firestore UID/GID assignment
  • ForgeRock Identity Management GID queries
  • Scopes
  • Quotas
  • Redis storage
  • Cloud SQL
  • Logging and proxies
  • Slack alerts
  • Maintenance timing
  • OpenID Connect server
• Administrators
  • Bootstrapping

Protecting services

• How Gafaelfawr-protected ingresses work
  • Header filtering
  • Error handling
• Configuring ingress with GafaelfawrIngress
  • Basic configuration
  • Redirecting users to log in
  • Changing the challenge type
  • Requesting delegated tokens
    • Internal tokens
    • Notebook tokens
    • Minimum token lifetime
    • Delegate token in Authorization header
  • Anonymous ingresses
  • Request headers
• Configuring an ingress manually
  • Basic configuration
  • Redirecting users to log in
  • Requesting delegated tokens
  • Header filtering for anonymous ingresses
  • Configuring authentication
• Service tokens
• Configuring OpenID Connect
  • Basic configuration
  • Examples
    • Chronograf
    • Open Distro for Elasticsearch

Reference

• Logging
  • Log attributes
• Command-line interface
  • gafaelfawr
    • audit
    • delete-all-data
    • generate-key
    • generate-session-secret
    • generate-token
    • help
    • init
    • maintenance
    • openapi-schema
    • run
  • Kubernetes operator