github.com/pachyderm/pachyderm@v1.13.4/doc/docs/master/enterprise/auth/saml/saml_usage.md (about) 1 ## Use SAML 2 3 This section walks you through an example of using Pachyderm's experimental SAML 4 support. We'll describe: 5 6 1. Authenticating via a SAML ID Provider 7 1. Authenticating in the CLI 8 1. Authorizing a user or group to access data 9 10 ## Setup 11 12 Follow the instructions in [Configure SAML](saml_setup.md) to enable auth in a 13 Pachyderm cluster and connect it to a SAML ID provider. Then, we'll authenticate 14 as a cluster admin in one console and set up our [open CV 15 demo](https://github.com/pachyderm/pachyderm/blob/master/examples/opencv/README.md). 16 17 In the CLI, that would look like: 18 19 ``` 20 (admin)$ pachctl auth use-auth-token 21 ``` 22 23 **System response:** 24 25 ```shell 26 Please paste your Pachyderm auth token: 27 <auth token> 28 ``` 29 30 ```shell 31 (admin)$ pachctl auth whoami 32 ``` 33 34 **System response:** 35 36 ```shell 37 You are "robot:admin" 38 You are an administrator of this Pachyderm cluster 39 ``` 40 41 Create a repository, pipelines, and put files into the 42 repository. 43 44 ```shell 45 (admin)$ pachctl create repo images 46 (admin)$ pachctl create pipeline -f examples/opencv/edges.json 47 (admin)$ pachctl create pipeline -f examples/opencv/montage.json 48 (admin)$ pachctl put file images@master -i examples/opencv/images.txt 49 (admin)$ pachctl put file images@master -i examples/opencv/images2.txt 50 ``` 51 52 View the list of existing repositories: 53 54 ```shell 55 (admin)$ pachctl list repo 56 ``` 57 58 **System response:** 59 60 ```shell 61 NAME CREATED SIZE (MASTER) ACCESS LEVEL 62 montage 2 minutes ago 1.653MiB OWNER 63 edges 2 minutes ago 133.6KiB OWNER 64 images 2 minutes ago 238.3KiB OWNER 65 ``` 66 67 View the list of jobs: 68 69 ```shell 70 (admin)$ pachctl list job 71 ``` 72 73 **System response:** 74 75 ```shell 76 ID OUTPUT COMMIT STARTED DURATION RESTART PROGRESS DL UL STATE 77 023a478b16e849b4996c19632fee6782 montage/e3dd7e9cacc5450c92e0e62ab844bd26 2 minutes ago 8 seconds 0 1 + 0 / 1 371.9KiB 1.283MiB success 78 fe8b409e0db54f96bbb757d4d0679186 edges/9cc634a63f794a14a78e931bea47fa73 2 minutes ago 5 seconds 0 2 + 1 / 3 181.1KiB 111.4KiB success 79 152cb8a0b0854d44affb4bf4bd57228f montage/82a49260595246fe8f6a7d381e092650 2 minutes ago 5 seconds 0 1 + 0 / 1 79.49KiB 378.6KiB success 80 86e6eb4ae1e74745b993c2e47eba05e9 edges/ee7ebdddd31d46d1af10cee25f17870b 2 minutes ago 4 seconds 0 1 + 0 / 1 57.27KiB 22.22KiB success 81 ``` 82 83 ## Authenticating via a SAML ID Provider (in the dashboard) 84 Before authenticating, navigating to the dash will yield a blank screen: 85 86  87 88 Even through the dash suggests logging in via GitHub, we will log in using a 89 SAML IdP (which has hopefully already been configured). To see your Pachyderm 90 DAG, navigate to your SAML ID provider and sign in to your Pachyderm cluster 91 there (currently Pachyderm only supports IdP-initiate SAML authentication). 92 93  94 95 Once you've authenticated, you'll be redirected to the Pachyderm dash (the 96 redirect URL is configured in the Pachyderm auth system). You'll be given the 97 opportunity to generate a one-time password (OTP), though you can always do this 98 later from the settings panel. 99 100  101 102 After closing the OTP panel, you'll be able to see the Pachyderm DAG, but you 103 may not have access to any of the repos inside (a repo that you cannot read is 104 indicated by a lock symbol): 105 106  107 108 ## Authenticating in the CLI 109 After authenticating in the dash, you'll be given the opportunity to generate a 110 one-time password (OTP) and sign in on the CLI. You can also generate an OTP 111 from the settings panel: 112 113  114 115 ``` 116 (user)$ pachctl auth login --code auth_code:73db4686e3e142508fa74aae920cc58b 117 (user)$ pachctl auth whoami 118 ``` 119 120 **System response:** 121 122 ```shell 123 You are "saml:msteffen@pachyderm.io" 124 session expires: 14 Sep 18 20:55 PDT 125 ``` 126 127 Note that this session expires after 8 hours. The duration of sessions is 128 configurable in the Pachyderm auth config, but it's important that they be 129 relatively short, as SAML group memberships are only updated when users sign in. 130 If a user is removed from a group, they'll still be able to access the group's 131 resources until their session expires. 132 133 ## Authorizing a user or group to access data 134 135 First, we'll give the example of an admin granting a user access. This can be 136 accomplished on the CLI like so: 137 138 ``` 139 (admin)$ pachctl auth set saml:msteffen@pachyderm.io reader images 140 ``` 141 142 Now, the `images` repo is no longer locked when that user views the DAG: 143 144  145 146 At this point, you can click on the `images` repo and preview data inside: 147 148  149 150 Likewise, you can grant access to repos via groups. You'll need a SAML ID 151 provider that supports group attributes, and you'll need to put the name of that 152 attribute in the Pachyderm auth config. Here, we'll grant access to the Everyone 153 group: 154 155 ``` 156 (admin)$ pachctl auth set group/saml:Everyone owner edges 157 ``` 158 159 Now, the edges repo is also not locked: 160 161  162 163 Also, becase `msteffen@pachyderm.io` has OWNER provileges in the `edges` repo 164 (via the Everyone group), the ACL for `edges` can be edited. 165 `msteffen@pachyderm.io` will use OWNER privileges gained via the Everyone group 166 to add `msteffen@pachyderm.io` (the user principal) directly to that ACL: 167 168  169 170 this change is reflected in the CLI as well: 171 172 ```shell 173 (admin)$ pachctl auth get edges 174 ``` 175 176 **System response:** 177 178 ```shell 179 pipeline:edges: WRITER 180 pipeline:montage: READER 181 group/saml:Everyone: OWNER 182 saml:msteffen@pachyderm.io: READER 183 robot:admin: OWNER 184 ``` 185 186 ## Conclusion 187 188 This is just an example of Pachyderm's auth system, meant to illustrate the 189 general nature of available features. Hopefully, it clarifies whether Pachyderm 190 can meet your requirements.