Before You Start #

• You must have an Enterprise Server set up.
• This guide assumes you are using the embedded proxy.
• This guide uses Auth0 as an example; if you do not have an Auth0 account, sign up for one and create your Pool of Users.

1. Register With Your IdP #

1. Log in to your Auth0 account.
2. In Applications, click Create Application.
3. Type the name of your application, such as Pachyderm.
4. In the application type, select Regular Web Application.
5. Click Create.
6. Go to the application settings.
7. Scroll down to Application URIs.
8. In the Allowed Callback URLs, add the Pachyderm callback link in the following format:

# Dex's issuer URL + "/callback"
http(s)://<insert-external-ip-or-dns-name>/dex/callback

9. Scroll down to Show Advanced Settings.
10. Select Grant Types.
11. Verify that Authorization Code and Refresh Token are selected.

2. Set Up Connector #

1. Create a JSON or YAML connector config file that matches your IdP.

Syntax:

json

yaml

{
"type": "oidc",
"id": "auth0",
"name": "Auth0",
"version": 1,
"config":{
  "issuer": "https://dev-k34x5yjn.us.auth0.com/",
  "clientID": "hegmOc5rTotLPu5ByRDXOvBAzgs3wuw5",
  "clientSecret": "7xk8O71Uhp5T-bJp_aP2Squwlh4zZTJs65URPma-2UT7n1iigDaMUD9ArhUR-2aL",
  "redirectURI": "http(s)://<insert-external-ip-or-dns-name>/dex/callback",
  "insecureEnableGroups": true,
  "insecureSkipEmailVerified": true,
  "insecureSkipIssuerCallbackDomainCheck": false,
  "forwardedLoginParams": ["login_hint"] 
  }
}

  type: oidc
  id: auth0
  name: Auth0
  version: 1
  config:
      issuer: https://dev-k34x5yjn.us.auth0.com/
      clientID: hegmOc5rTotLPu5ByRDXOvBAzgs3wuw5
      clientSecret: 7xk8O71Uhp5T-bJp_aP2Squwlh4zZTJs65URPma-2UT7n1iigDaMUD9ArhUR-2aL
      redirectURI: http(s)://<insert-external-ip-or-dns-name>/dex/callback
      insecureEnableGroups: true
      insecureSkipEmailVerified: true
      insecureSkipIssuerCallbackDomainCheck: false,
      forwardedLoginParams:
      - login_hint

ℹ️

Note that Pachyderm’s YAML format is a simplified version of Dex’s sample config.

2. Update the following attributes:

3. Open your Helm values.yml file.
4. Find the oidc.upstreamIDPs section.
5. Input your connector info; Pachyderm stores this value in the platform secret pachyderm-identity in the key upstream-idps.

stringData:
upstream-idps: |
    - type: github
    id: github
    name: GitHub
    jsonConfig: >-
        {
        "clientID": "xxx",
        "clientSecret": "xxx",
        "redirectURI": "https://pach.pachdemo.cloud/dex/callback",
        "loadAllGroups": true
        }    

Alternatively, you can create a secret containing your dex connectors (Key: upstream-idps) and reference its name in the field oidc.upstreamIDPsSecretName.

3. Login #

The users registered with your IdP are now ready to Log in to Pachyderm

Considerations #

Ingress #

When using an ingress:

• redirect_uri must be changed to point to https://domain-name/dex/callback. (Note the additional /dex/)
• TLS requires all non-localhost redirectURIs to be HTTPS.
• AZURE USERS:
  • You must use TLS when deploying on Azure.
  • When using Azure Active Directory, add the following to the oidc config:

  "config":{
      "claimMapping": {
          "email": "preferred_username"
      } 
  }