From 5b83927145bfa7a3dc81e3f8e34079d69ecdff78 Mon Sep 17 00:00:00 2001 From: Kunal Mohan Date: Tue, 7 Jul 2026 15:09:15 +0530 Subject: [PATCH 1/6] Update SSO docs --- ...rate-from-reactive-charm-to-k8s-operator-charm.md | 4 ++++ .../migrate-from-reactive-charm-to-operator-charm.md | 6 +++--- .../security/setup-administration-tool.md | 8 ++++++-- docs/server/reference/platform/configuration.md | 12 ++++++++++-- 4 files changed, 23 insertions(+), 7 deletions(-) diff --git a/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-k8s-operator-charm.md b/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-k8s-operator-charm.md index 19c0410..f5ef449 100644 --- a/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-k8s-operator-charm.md +++ b/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-k8s-operator-charm.md @@ -90,6 +90,10 @@ result: The K8s charm compatible configuration is in the `new-config` field, with deprecated and unknown configuration keys listed in `removed-keys` and `unrecognized-keys` respectively. +```{note} +If the migrated configuration includes `auth.sso.*` keys, note that Ubuntu SSO authentication is deprecated and is no longer available for on-premises deployments. Remove those keys and configure Basic Auth (`auth.basic.*`) instead. +``` + The whole output for the action can also be taken and the new configuration portion written into a new YAML file with: ```bash diff --git a/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md b/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md index eac7258..b4c0b00 100644 --- a/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md +++ b/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md @@ -79,9 +79,9 @@ The script creates or overwrites the output file specified by the `-o` parameter | event_bus_client_key | machine-reports.event-bus.client-key | | | event_bus_ca_cert | machine-reports.event-bus.ca-cert | | | event_bus_brokers | machine-reports.event-bus.brokers | | -| auth_lp_teams | auth.sso.teams | Make sure this is set to true: auth.sso.enabled | -| auth_sso_public_key | auth.sso.public-key | | -| auth_sso_location | auth.sso.url | | +| auth_lp_teams | auth.sso.teams | **Deprecated.** Ubuntu SSO authentication is no longer available for on-premises deployments. Use `auth.basic.*` instead. | +| auth_sso_public_key | auth.sso.public-key | **Deprecated.** See above. | +| auth_sso_location | auth.sso.url | **Deprecated.** See above. | | auth_basic_users | auth.basic.users | Make sure that auth.basic.enable is set to true | | | | | | swift_container_name | patch-storage.swift-container | | diff --git a/docs/server/how-to-guides/security/setup-administration-tool.md b/docs/server/how-to-guides/security/setup-administration-tool.md index 1b10edc..26efabf 100644 --- a/docs/server/how-to-guides/security/setup-administration-tool.md +++ b/docs/server/how-to-guides/security/setup-administration-tool.md @@ -24,8 +24,8 @@ sudo snap alias canonical-livepatch-server-admin.livepatch-admin livepatch-admin The Livepatch administration tool can authenticate with the Livepatch Server in two ways: -* Ubuntu SSO * Username and password +* Ubuntu SSO (deprecated) (server-how-to-guides-password-authentication)= @@ -63,7 +63,11 @@ export LIVEPATCH_URL={haproxy URL or unit IP} livepatch-admin login --auth : ``` -## Ubuntu SSO authentication +## Ubuntu SSO authentication (deprecated) + +```{note} +Ubuntu SSO authentication is deprecated and is no longer available for on-premises deployments. Use password (Basic Auth) authentication instead. +``` Ubuntu SSO authentication uses membership in public Launchpad groups to gate access. The Launchpad groups that have administrator privileges are specified using charmed operator configuration: diff --git a/docs/server/reference/platform/configuration.md b/docs/server/reference/platform/configuration.md index e6d961b..960960f 100644 --- a/docs/server/reference/platform/configuration.md +++ b/docs/server/reference/platform/configuration.md @@ -66,9 +66,8 @@ The following sections describe the available configuration values. ### Admin authentication -The following values configure authentication to the server's admin endpoints. Only Basic Auth and Ubuntu SSO authentication are supported. +The following values configure authentication to the server's admin endpoints. Ubuntu SSO authentication is deprecated and is no longer available for on-premises deployments. Only Basic Auth is supported. -- SSO Teams represent Launchpad teams. - Basic Auth configuration accepts a comma-separated list of users. See the [admin tool setup guide](/server/how-to-guides/security/setup-administration-tool.md#password-authentication) for details. - Basic Auth passwords must be bcrypt hashed. @@ -76,6 +75,15 @@ The following values configure authentication to the server's admin endpoints. O | ---- | ----------- | ------ | | `auth.basic.enabled` | Enable Basic Auth. | `bool` | | `auth.basic.users` | Comma-separated list of user objects. | `:, :` | + +#### Ubuntu SSO authentication (deprecated) + +```{note} +Ubuntu SSO authentication is deprecated and is no longer available for on-premises deployments. Use Basic Auth instead. +``` + +| Name | Description | Values | +| ---- | ----------- | ------ | | `auth.sso.enabled` | Enable Ubuntu SSO authentication. | `bool` | | `auth.sso.teams` | SSO authentication configuration listing authorised teams. | `https://launchpad.net/~team-1,https://launchpad.net/~team-2` | | `auth.sso.url` | URL for SSO authentication. | `login.ubuntu.com` | From ac1d4ca084e32e2d7161cfb9d22ba48e3d0d8639 Mon Sep 17 00:00:00 2001 From: Kunal Mohan Date: Wed, 8 Jul 2026 11:10:09 +0530 Subject: [PATCH 2/6] replace deprecated with removed --- .../migrate-from-reactive-charm-to-k8s-operator-charm.md | 2 +- .../migrate-from-reactive-charm-to-operator-charm.md | 6 +++--- .../how-to-guides/security/setup-administration-tool.md | 6 +++--- docs/server/reference/platform/configuration.md | 6 +++--- 4 files changed, 10 insertions(+), 10 deletions(-) diff --git a/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-k8s-operator-charm.md b/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-k8s-operator-charm.md index f5ef449..4a261a5 100644 --- a/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-k8s-operator-charm.md +++ b/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-k8s-operator-charm.md @@ -91,7 +91,7 @@ result: The K8s charm compatible configuration is in the `new-config` field, with deprecated and unknown configuration keys listed in `removed-keys` and `unrecognized-keys` respectively. ```{note} -If the migrated configuration includes `auth.sso.*` keys, note that Ubuntu SSO authentication is deprecated and is no longer available for on-premises deployments. Remove those keys and configure Basic Auth (`auth.basic.*`) instead. +If the migrated configuration includes `auth.sso.*` keys, note that Ubuntu SSO authentication has been removed. Remove those keys and configure Basic Auth (`auth.basic.*`) instead. ``` The whole output for the action can also be taken and the new configuration portion written into a new YAML file with: diff --git a/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md b/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md index b4c0b00..a941aa9 100644 --- a/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md +++ b/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md @@ -79,9 +79,9 @@ The script creates or overwrites the output file specified by the `-o` parameter | event_bus_client_key | machine-reports.event-bus.client-key | | | event_bus_ca_cert | machine-reports.event-bus.ca-cert | | | event_bus_brokers | machine-reports.event-bus.brokers | | -| auth_lp_teams | auth.sso.teams | **Deprecated.** Ubuntu SSO authentication is no longer available for on-premises deployments. Use `auth.basic.*` instead. | -| auth_sso_public_key | auth.sso.public-key | **Deprecated.** See above. | -| auth_sso_location | auth.sso.url | **Deprecated.** See above. | +| auth_lp_teams | auth.sso.teams | **Removed.** Ubuntu SSO authentication is no longer available for on-premises deployments. Use `auth.basic.*` instead. | +| auth_sso_public_key | auth.sso.public-key | **Removed.** See above. | +| auth_sso_location | auth.sso.url | **Removed.** See above. | | auth_basic_users | auth.basic.users | Make sure that auth.basic.enable is set to true | | | | | | swift_container_name | patch-storage.swift-container | | diff --git a/docs/server/how-to-guides/security/setup-administration-tool.md b/docs/server/how-to-guides/security/setup-administration-tool.md index 26efabf..d93ac98 100644 --- a/docs/server/how-to-guides/security/setup-administration-tool.md +++ b/docs/server/how-to-guides/security/setup-administration-tool.md @@ -25,7 +25,7 @@ sudo snap alias canonical-livepatch-server-admin.livepatch-admin livepatch-admin The Livepatch administration tool can authenticate with the Livepatch Server in two ways: * Username and password -* Ubuntu SSO (deprecated) +* Ubuntu SSO (removed) (server-how-to-guides-password-authentication)= @@ -63,10 +63,10 @@ export LIVEPATCH_URL={haproxy URL or unit IP} livepatch-admin login --auth : ``` -## Ubuntu SSO authentication (deprecated) +## Ubuntu SSO authentication (removed) ```{note} -Ubuntu SSO authentication is deprecated and is no longer available for on-premises deployments. Use password (Basic Auth) authentication instead. +Ubuntu SSO authentication has been removed. Use password (Basic Auth) authentication instead. ``` Ubuntu SSO authentication uses membership in public Launchpad groups to gate access. The Launchpad groups that have administrator privileges are specified using charmed operator configuration: diff --git a/docs/server/reference/platform/configuration.md b/docs/server/reference/platform/configuration.md index 960960f..0b62659 100644 --- a/docs/server/reference/platform/configuration.md +++ b/docs/server/reference/platform/configuration.md @@ -66,7 +66,7 @@ The following sections describe the available configuration values. ### Admin authentication -The following values configure authentication to the server's admin endpoints. Ubuntu SSO authentication is deprecated and is no longer available for on-premises deployments. Only Basic Auth is supported. +The following values configure authentication to the server's admin endpoints. Ubuntu SSO authentication has been removed. Only Basic Auth is supported. - Basic Auth configuration accepts a comma-separated list of users. See the [admin tool setup guide](/server/how-to-guides/security/setup-administration-tool.md#password-authentication) for details. - Basic Auth passwords must be bcrypt hashed. @@ -76,10 +76,10 @@ The following values configure authentication to the server's admin endpoints. U | `auth.basic.enabled` | Enable Basic Auth. | `bool` | | `auth.basic.users` | Comma-separated list of user objects. | `:, :` | -#### Ubuntu SSO authentication (deprecated) +#### Ubuntu SSO authentication (removed) ```{note} -Ubuntu SSO authentication is deprecated and is no longer available for on-premises deployments. Use Basic Auth instead. +Ubuntu SSO authentication has been removed. Use Basic Auth instead. ``` | Name | Description | Values | From 48640c2099d1fe9f3f7841915bdd79d8b7daa04e Mon Sep 17 00:00:00 2001 From: Kunal Mohan Date: Wed, 8 Jul 2026 12:14:08 +0530 Subject: [PATCH 3/6] address review comments --- ...om-reactive-charm-to-k8s-operator-charm.md | 4 +--- ...e-from-reactive-charm-to-operator-charm.md | 2 +- .../security/setup-administration-tool.md | 23 ++----------------- 3 files changed, 4 insertions(+), 25 deletions(-) diff --git a/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-k8s-operator-charm.md b/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-k8s-operator-charm.md index 4a261a5..a7e5654 100644 --- a/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-k8s-operator-charm.md +++ b/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-k8s-operator-charm.md @@ -63,7 +63,6 @@ The output for this action will look like the following: result: new-config: |- canonical-livepatch-server-k8s: - auth.sso.url: login.ubuntu.com database.connection-lifetime-max: 30m database.connection-pool-max: 15 machine-reports.database.cleanup-interval: 6h @@ -91,7 +90,7 @@ result: The K8s charm compatible configuration is in the `new-config` field, with deprecated and unknown configuration keys listed in `removed-keys` and `unrecognized-keys` respectively. ```{note} -If the migrated configuration includes `auth.sso.*` keys, note that Ubuntu SSO authentication has been removed. Remove those keys and configure Basic Auth (`auth.basic.*`) instead. +The action output may include `auth.sso.*` keys if your reactive charm had SSO configured. Ubuntu SSO authentication has been removed; remove any such keys before applying the configuration. ``` The whole output for the action can also be taken and the new configuration portion written into a new YAML file with: @@ -104,7 +103,6 @@ With the above example, the resulting configuration file will contain: ```yaml canonical-livepatch-server-k8s: - auth.sso.url: login.ubuntu.com database.connection-lifetime-max: 30m database.connection-pool-max: 15 machine-reports.database.cleanup-interval: 6h diff --git a/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md b/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md index a941aa9..d2111aa 100644 --- a/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md +++ b/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md @@ -82,7 +82,7 @@ The script creates or overwrites the output file specified by the `-o` parameter | auth_lp_teams | auth.sso.teams | **Removed.** Ubuntu SSO authentication is no longer available for on-premises deployments. Use `auth.basic.*` instead. | | auth_sso_public_key | auth.sso.public-key | **Removed.** See above. | | auth_sso_location | auth.sso.url | **Removed.** See above. | -| auth_basic_users | auth.basic.users | Make sure that auth.basic.enable is set to true | +| auth_basic_users | auth.basic.users | Make sure that auth.basic.enabled is set to true | | | | | | swift_container_name | patch-storage.swift-container | | | swift_auth_url | patch-storage.swift-auth-url | | diff --git a/docs/server/how-to-guides/security/setup-administration-tool.md b/docs/server/how-to-guides/security/setup-administration-tool.md index d93ac98..fbc068a 100644 --- a/docs/server/how-to-guides/security/setup-administration-tool.md +++ b/docs/server/how-to-guides/security/setup-administration-tool.md @@ -22,10 +22,7 @@ sudo snap alias canonical-livepatch-server-admin.livepatch-admin livepatch-admin ## Authentication -The Livepatch administration tool can authenticate with the Livepatch Server in two ways: - -* Username and password -* Ubuntu SSO (removed) +The Livepatch administration tool authenticates with the Livepatch Server using username and password. (server-how-to-guides-password-authentication)= @@ -69,20 +66,4 @@ livepatch-admin login --auth : Ubuntu SSO authentication has been removed. Use password (Basic Auth) authentication instead. ``` -Ubuntu SSO authentication uses membership in public Launchpad groups to gate access. The Launchpad groups that have administrator privileges are specified using charmed operator configuration: - -``` -juju config livepatch auth_lp_teams='https://launchpad.net/~' -``` - -Multiple teams can be specified as a comma-separated list. - -When logging in, user interaction is required: - -``` -export LIVEPATCH_URL={haproxy URL} - -livepatch-admin login - -To login please visit http://127.0.0.1:44035 -``` \ No newline at end of file +Ubuntu SSO authentication was previously supported but has been removed and is no longer available for on-premises deployments. \ No newline at end of file From 008a8544536840ef80609354eeb0b44e4c0bc466 Mon Sep 17 00:00:00 2001 From: kunalmohan-work Date: Wed, 8 Jul 2026 12:17:50 +0530 Subject: [PATCH 4/6] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: kunalmohan-work --- docs/server/how-to-guides/security/setup-administration-tool.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/server/how-to-guides/security/setup-administration-tool.md b/docs/server/how-to-guides/security/setup-administration-tool.md index fbc068a..54cd83c 100644 --- a/docs/server/how-to-guides/security/setup-administration-tool.md +++ b/docs/server/how-to-guides/security/setup-administration-tool.md @@ -22,7 +22,7 @@ sudo snap alias canonical-livepatch-server-admin.livepatch-admin livepatch-admin ## Authentication -The Livepatch administration tool authenticates with the Livepatch Server using username and password. +The Livepatch administration tool authenticates with the Livepatch Server using Basic Auth (username and password). (server-how-to-guides-password-authentication)= From 926ef134bf41424bf4b11145eb2b78cf818c8d32 Mon Sep 17 00:00:00 2001 From: kunalmohan-work Date: Wed, 8 Jul 2026 12:22:01 +0530 Subject: [PATCH 5/6] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: kunalmohan-work --- docs/server/reference/platform/configuration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/server/reference/platform/configuration.md b/docs/server/reference/platform/configuration.md index 0b62659..1aa28b8 100644 --- a/docs/server/reference/platform/configuration.md +++ b/docs/server/reference/platform/configuration.md @@ -66,7 +66,7 @@ The following sections describe the available configuration values. ### Admin authentication -The following values configure authentication to the server's admin endpoints. Ubuntu SSO authentication has been removed. Only Basic Auth is supported. +The following values configure authentication to the server's admin endpoints. Ubuntu SSO authentication has been removed; only Basic Auth is supported. The `auth.sso.*` keys below are retained for legacy configuration/migration reference and are ignored by the server. - Basic Auth configuration accepts a comma-separated list of users. See the [admin tool setup guide](/server/how-to-guides/security/setup-administration-tool.md#password-authentication) for details. - Basic Auth passwords must be bcrypt hashed. From b6655aa9fbf2ccc37ffb514cf981a770e1b00b71 Mon Sep 17 00:00:00 2001 From: kunalmohan-work Date: Wed, 8 Jul 2026 12:27:26 +0530 Subject: [PATCH 6/6] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: kunalmohan-work --- .../migrate-from-reactive-charm-to-operator-charm.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md b/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md index d2111aa..0f583df 100644 --- a/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md +++ b/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md @@ -79,9 +79,9 @@ The script creates or overwrites the output file specified by the `-o` parameter | event_bus_client_key | machine-reports.event-bus.client-key | | | event_bus_ca_cert | machine-reports.event-bus.ca-cert | | | event_bus_brokers | machine-reports.event-bus.brokers | | -| auth_lp_teams | auth.sso.teams | **Removed.** Ubuntu SSO authentication is no longer available for on-premises deployments. Use `auth.basic.*` instead. | -| auth_sso_public_key | auth.sso.public-key | **Removed.** See above. | -| auth_sso_location | auth.sso.url | **Removed.** See above. | +| auth_lp_teams | **Removed** | **Removed.** Ubuntu SSO authentication is no longer available for on-premises deployments. Use `auth.basic.*` instead. | +| auth_sso_public_key | **Removed** | **Removed.** See above. | +| auth_sso_location | **Removed** | **Removed.** See above. | | auth_basic_users | auth.basic.users | Make sure that auth.basic.enabled is set to true | | | | | | swift_container_name | patch-storage.swift-container | |