Project: Pinniped (Provisioning / Key Management)
File: configure-supervisor-with-azuread.md

title: Configure the Pinniped Supervisor to use Azure Active Directory as an OIDC provider description: Set up the Pinniped Supervisor to use Azure Active Directory login. cascade: layout: docs menu: docs: name: With Azure AD weight: 80 parent: howto-configure-supervisor The Supervisor is an issuer that supports connecting a single "upstream" identity provider to many "downstream" cluster clients. This guide shows you how to configure the Supervisor so that users can authenticate to their Kubernetes cluster using their Azure Active Directory credentials. This how-to guide assumes that you have already with working ingress, and that you have . If you don't already have an Azure subscription, . Next, in Azure Active Directory. This tenant represents your organization. For example, to create a tenant: In the , navigate to Home > Azure Active Directory. Create a new tenant: Click `Manage Tenants`. Click `Create`. Fill out your organization details. Optionally, just use the `Default Directory` that is already created. Users can be added to the directory via the `Manage` > `Users` link. Create a new app: Click `App Registrations`. Click `New Registration`. Enter a `user-facing display name`. Choose supported account types. Enter the `Redirect URI`. Choose `Web` from the dropdown menu. The redirect uri will be the `spec.issuer` you configured in your `FederationDomain` appended with `/callback`. Click `Register`. Create an in the same namespace as the Supervisor. In the , navigate to Home > Azure Active Directory > App Registrations. Copy the `Application (client) ID)` for use in your OIDCIdentityProvider CR later. Select your application, and then click `Add a certificate or secret`. Click `New client secret`, provide a name, an expiration time, and click `create`. Copy the secret `Value` for use later with your `OIDCIdentityProvider`. Select your application, and then click `Endpoints`. Under `Endpoints`, find the `OpenID Connect Metadata Document` URL. Perform a curl with this URL and find the issuer value (`curl https://<openid.connect.metadata.document.url> | jq ".issuer"`). Copy the `issuer` value to use in your `OIDCIdentityProvider`. For example, this OIDCIdentityProvider and corresponding Secret use Azure AD's `email` claim as the Kubernetes username: ```yaml apiVersion: idp.supervisor.pinniped.dev/v1alpha1 kind: OIDCIdentityProvider metadata: namespace: pinniped-supervisor name: azuread spec: issuer: <issuer.from.OpenID.connect.metadata.document> authorizationConfig: additionalScopes: [offline_access, groups, email] allowPasswordGrant: false claims: username: email groups: groups client: secretName: azuread-client-credentials apiVersion: v1 kind: Secret metadata: namespace: pinniped-supervisor name: azuread-client-credentials type: secrets.pinniped.dev/oidc-client stringData: clientID: "<your-client-id>" clientSecret: "<your-client-secret>" ``` Note that the `metadata.name` of the OIDCIdentityProvider resource may be visible to end users at login prompts if you choose to enable `allowPasswordGrant`, so choose a name which will be understood by your end users. For example, if you work at Acme Corp, choose something like `acme-corporate-azuread` over `my-idp`. Once your OIDCIdentityProvider has been created, you can validate your configuration by running: ```shell kubectl describe OIDCIdentityProvider -n pinniped-supervisor azuread ``` Look at the `status` field. If it was configured correctly, you should see `phase: Ready`. Next, ! Then you'll be able to log into those clusters as any of the users from the Azure AD directory.