GitHub SSO Setup
Integrating Redpanda Console with GitHub allows your users to use their GitHub identities to sign-in to Console. This guide assumes you already have a GitHub account and permissions to create Applications within your organization.
Follow this GitHub guide to create an OAuth application at GitHub. You can create the OAuth application either under your personal account or under any organization you have admin access to. As you follow the guide to create the GitHub OAuth app, use the following inputs when you are asked for it:
Below configurations assume that you want to host Redpanda Console so that it would be accessible via
Application name: Any descriptive name for your specific Console deployment (for example Console Analytics Prod)
Authorization callback URL:
Enable device flow: False / Not selected
login: enabled: true # jwtSecret is the secret key you must use to sign and encrypt the JSON # web token used to store user sessions. This secret key is # critical for the security of Redpanda Console's authentication and # authorization system. Use a long, complex key with a combination of # numbers, letters, and special characters. While you must use a minimum of # 10 characters, Redpanda recommends using more than 32 # characters. For additional security, use a different secret key for # each environment. jwtSecret can be securely generated with the following # command: LC_ALL=C tr -dc '[:alnum:]' < /dev/random | head -c32 # # If you update this secret key, any users who are # already logged into Redpanda Console will be logged out and will have # to log in again. jwtSecret: "" github: enabled: true clientId: "" # ClientSecret is sensitive. You can provide this config also via the # the environment variable LOGIN_GITHUB_CLIENTSECRET clientSecret: "" # The directory config is only required if you want to use GitHub # teams in your role bindings. Described further in the next section. # directory: # personalAccessToken: ""
If you want to bind roles to GitHub teams from an organization you have to setup a personal access token in GitHub, so that Redpanda console can retrieve groups
and their memberships using the GitHub API. The personal access token has to be created on an account that has permissions to view groups in your desired
GitHub organization. Follow this guide
to create the personal access token. When you select the scopes and permissions make sure to include
login: github: # The directory config is only required if you want to use GitHub # teams in your role bindings. directory: personalAccessToken: ""
When you set up the GitHub login configuration, you can bind GitHub users or groups to roles. Following is a sample role binding:
roleBindings: - metadata: name: Developers subjects: - kind: group provider: GitHub name: console-developers # GitHub team name organization: redpanda-data # GitHub organization name - kind: user provider: GitHub name: weeco # GitHub handle roleName: editor