Uploaded image for project: 'Red Hat Internal Developer Platform'
  1. Red Hat Internal Developer Platform
  2. RHIDP-3074

Signing in without user in the software catalog is now disabled by default

Prepare for Y ReleasePrepare for Z ReleaseRemove QuarterXMLWordPrintable

    • Icon: Epic Epic
    • Resolution: Done
    • Icon: Undefined Undefined
    • 1.3
    • None
    • Authentication
    • None
    • Convert SignInWithCatalogUserOptional to Optional Setting
    • 3
    • False
    • Hide

      None

      Show
      None
    • False
    • To Do
    • RHIDP-2999 - Standardize authentication providers
    • QE Needed, Docs Needed, TE Needed, Customer Facing, PX Needed
    • 0% To Do, 0% In Progress, 100% Done
    • Hide
      By default, it is now required for the user entity to exist in the software catalog to allow sign in.
      This is required for production ready deployments since identities need to exist and originate from a trusted source (i.e. the Identity Provider) in order for security controls such as RBAC and Audit logging to be effective.
      To bypass this, enable the `dangerouslySignInWithoutUserInCatalog` configuration that allows sign in without the user being in the catalog.
      Enabling this option is dangerous as it might allow unauthorized users to gain access.
      Show
      By default, it is now required for the user entity to exist in the software catalog to allow sign in. This is required for production ready deployments since identities need to exist and originate from a trusted source (i.e. the Identity Provider) in order for security controls such as RBAC and Audit logging to be effective. To bypass this, enable the `dangerouslySignInWithoutUserInCatalog` configuration that allows sign in without the user being in the catalog. Enabling this option is dangerous as it might allow unauthorized users to gain access.
    • Removed Functionality
    • Done
    • RHDH Core Team 3260

      EPIC Goal

      Convert SignInWithCatalogUserOptional to an optional setting, defaulting to off, to enhance security and user management in RHDH.

      Background/Feature Origin

      • Current SignInWithCatalogUserOptional setting allows users to log in without a catalog user entity
      • This default behavior may pose security risks in some environments

      Why is this important?

      • Improves security by ensuring users have proper catalog entries by default
      • Provides flexibility for admins to enable the option when needed

      User Scenarios

      • As an admin, I want to ensure all logged-in users have corresponding catalog entries
      • As an admin, I want the option to allow users to log in without catalog entries in specific scenarios

      Dependencies (internal and external)

      • Existing authentication system in RHDH
      • User management components in the catalog

      Acceptance Criteria

      • Change SignInWithCatalogUserOptional to be an optional setting
      • Set the default value of SignInWithCatalogUserOptional to 'off'
      • Implement configuration option for admins to enable SignInWithCatalogUserOptional
      • Ensure backward compatibility for existing setups
      • Update documentation to reflect the changes in SignInWithCatalogUserOptional behavior
      • Develop test cases for both enabled and disabled states of SignInWithCatalogUserOptional
      • Verify that disabling SignInWithCatalogUserOptional prevents logins for users without catalog entries

      Release Enablement/Demo - Provide necessary release enablement details and documents
      DEV - Upstream code and tests merged: <link to meaningful PR or GitHub Issue>
      DEV - Upstream documentation merged: <link to meaningful PR or GitHub Issue>
      DEV - Downstream build attached to advisory: <link to errata>
      QE - Test plans in Playwright: <link or reference to playwright>
      QE - Automated tests merged: <link or reference to automated tests>
      DOC - Downstream documentation merged: <link to meaningful PR>

            rh-ee-jhe Jessica He
            rh-ee-mhild Marcel Hild
            RHIDP - Security
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: