diff --git a/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-k8s-operator-charm.md b/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-k8s-operator-charm.md index 19c0410..a7e5654 100644 --- a/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-k8s-operator-charm.md +++ b/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-k8s-operator-charm.md @@ -63,7 +63,6 @@ The output for this action will look like the following: result: new-config: |- canonical-livepatch-server-k8s: - auth.sso.url: login.ubuntu.com database.connection-lifetime-max: 30m database.connection-pool-max: 15 machine-reports.database.cleanup-interval: 6h @@ -90,6 +89,10 @@ result: The K8s charm compatible configuration is in the `new-config` field, with deprecated and unknown configuration keys listed in `removed-keys` and `unrecognized-keys` respectively. +```{note} +The action output may include `auth.sso.*` keys if your reactive charm had SSO configured. Ubuntu SSO authentication has been removed; remove any such keys before applying the configuration. +``` + The whole output for the action can also be taken and the new configuration portion written into a new YAML file with: ```bash @@ -100,7 +103,6 @@ With the above example, the resulting configuration file will contain: ```yaml canonical-livepatch-server-k8s: - auth.sso.url: login.ubuntu.com database.connection-lifetime-max: 30m database.connection-pool-max: 15 machine-reports.database.cleanup-interval: 6h diff --git a/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md b/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md index eac7258..0f583df 100644 --- a/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md +++ b/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md @@ -79,10 +79,10 @@ The script creates or overwrites the output file specified by the `-o` parameter | event_bus_client_key | machine-reports.event-bus.client-key | | | event_bus_ca_cert | machine-reports.event-bus.ca-cert | | | event_bus_brokers | machine-reports.event-bus.brokers | | -| auth_lp_teams | auth.sso.teams | Make sure this is set to true: auth.sso.enabled | -| auth_sso_public_key | auth.sso.public-key | | -| auth_sso_location | auth.sso.url | | -| auth_basic_users | auth.basic.users | Make sure that auth.basic.enable is set to true | +| auth_lp_teams | **Removed** | **Removed.** Ubuntu SSO authentication is no longer available for on-premises deployments. Use `auth.basic.*` instead. | +| auth_sso_public_key | **Removed** | **Removed.** See above. | +| auth_sso_location | **Removed** | **Removed.** See above. | +| auth_basic_users | auth.basic.users | Make sure that auth.basic.enabled is set to true | | | | | | swift_container_name | patch-storage.swift-container | | | swift_auth_url | patch-storage.swift-auth-url | | diff --git a/docs/server/how-to-guides/security/setup-administration-tool.md b/docs/server/how-to-guides/security/setup-administration-tool.md index 1b10edc..54cd83c 100644 --- a/docs/server/how-to-guides/security/setup-administration-tool.md +++ b/docs/server/how-to-guides/security/setup-administration-tool.md @@ -22,10 +22,7 @@ sudo snap alias canonical-livepatch-server-admin.livepatch-admin livepatch-admin ## Authentication -The Livepatch administration tool can authenticate with the Livepatch Server in two ways: - -* Ubuntu SSO -* Username and password +The Livepatch administration tool authenticates with the Livepatch Server using Basic Auth (username and password). (server-how-to-guides-password-authentication)= @@ -63,22 +60,10 @@ export LIVEPATCH_URL={haproxy URL or unit IP} livepatch-admin login --auth : ``` -## Ubuntu SSO authentication - -Ubuntu SSO authentication uses membership in public Launchpad groups to gate access. The Launchpad groups that have administrator privileges are specified using charmed operator configuration: - -``` -juju config livepatch auth_lp_teams='https://launchpad.net/~' -``` - -Multiple teams can be specified as a comma-separated list. - -When logging in, user interaction is required: +## Ubuntu SSO authentication (removed) +```{note} +Ubuntu SSO authentication has been removed. Use password (Basic Auth) authentication instead. ``` -export LIVEPATCH_URL={haproxy URL} - -livepatch-admin login -To login please visit http://127.0.0.1:44035 -``` \ No newline at end of file +Ubuntu SSO authentication was previously supported but has been removed and is no longer available for on-premises deployments. \ No newline at end of file diff --git a/docs/server/reference/platform/configuration.md b/docs/server/reference/platform/configuration.md index e6d961b..1aa28b8 100644 --- a/docs/server/reference/platform/configuration.md +++ b/docs/server/reference/platform/configuration.md @@ -66,9 +66,8 @@ The following sections describe the available configuration values. ### Admin authentication -The following values configure authentication to the server's admin endpoints. Only Basic Auth and Ubuntu SSO authentication are supported. +The following values configure authentication to the server's admin endpoints. Ubuntu SSO authentication has been removed; only Basic Auth is supported. The `auth.sso.*` keys below are retained for legacy configuration/migration reference and are ignored by the server. -- SSO Teams represent Launchpad teams. - Basic Auth configuration accepts a comma-separated list of users. See the [admin tool setup guide](/server/how-to-guides/security/setup-administration-tool.md#password-authentication) for details. - Basic Auth passwords must be bcrypt hashed. @@ -76,6 +75,15 @@ The following values configure authentication to the server's admin endpoints. O | ---- | ----------- | ------ | | `auth.basic.enabled` | Enable Basic Auth. | `bool` | | `auth.basic.users` | Comma-separated list of user objects. | `:, :` | + +#### Ubuntu SSO authentication (removed) + +```{note} +Ubuntu SSO authentication has been removed. Use Basic Auth instead. +``` + +| Name | Description | Values | +| ---- | ----------- | ------ | | `auth.sso.enabled` | Enable Ubuntu SSO authentication. | `bool` | | `auth.sso.teams` | SSO authentication configuration listing authorised teams. | `https://launchpad.net/~team-1,https://launchpad.net/~team-2` | | `auth.sso.url` | URL for SSO authentication. | `login.ubuntu.com` |