Project: Pinniped (Provisioning / Key Management)
File: configure-supervisor-with-workspace_one_access.md

title: Configure the Pinniped Supervisor to use Workspace ONE Access as an OIDC provider description: Set up the Pinniped Supervisor to use Workspace ONE Access login. cascade: layout: docs menu: docs: name: With Workspace ONE Access weight: 80 parent: howto-configure-supervisor aliases: /docs/howto/configure-supervisor-with-workspaceoneaccess/ The Supervisor is an issuer that supports connecting "upstream" identity providers to many "downstream" cluster clients. This guide shows you how to configure the Supervisor so that users can authenticate to their Kubernetes cluster using their credentials. This how-to guide assumes that you have already with working ingress, and that you have . Follow the Workspace ONE documentation for , including the documentation for . For example, to create an app: In the Workspace ONE Access Console, navigate to Catalog > Web Apps. Create a new app: Click `New`. Enter a name for your app, such as "My Kubernetes Clusters". For `Authentication Type`, select `OpenID Connect`. Enter the Target URL. This value is required but unused and may be set to the `spec.issuer` you configured in your `FederationDomain`. Enter the Redirect URL. This is the `spec.issuer` you configured in your `FederationDomain` appended with `/callback`. Enter the Client ID to a value such as "pinniped-supervisor" (this cannot be changed later). Enter the Client Secret. This should be set to a secure value such as the output of `openssl rand -hex 32`. Set both "Open in Workspace ONE Web" and "Show in User Portal" options to "No" Set the desired Access Policies for the app, such as requiring smart card login. Save and assign the app to the desired users and/or groups. This can be used to restrict which users can log in to Kubernetes using this integration. Configure the token TTLs and scopes. Navigate to Catalog > Settings > Remote App access and click on the "pinniped-supervisor" client. Edit the Client Configuration: `Issue Refresh Token` must be checked Set `Access Token Time-To-Live (TTL)` to 5 minutes Set `Refresh Token Time-To-Live (TTL)` to 9 hours (or shorter if you wish to require more frequent logins) Set `Idle Token Time-to-Live (TTL)` to 9 hours (or shorter if you wish to enforce an inactivity timeout) Edit the Scope configuration: `OpenID` must be checked Check `Email` if you plan to use email as the username claim Check `Group` if you plan to use groups in your Kubernetes environment Uncheck all other scopes Create an in the same namespace as the Supervisor. For example, this OIDCIdentityProvider and corresponding Secret use Workspace ONE Access's `email` claim as the Kubernetes username: ```yaml apiVersion: idp.supervisor.pinniped.dev/v1alpha1 kind: OIDCIdentityProvider metadata: namespace: pinniped-supervisor name: ws1 spec: issuer: https://ws1.my-company.com/SAAS/auth authorizationConfig: additionalScopes: [group, email] claims: username: email groups: group_names client: secretName: ws1-client-credentials apiVersion: v1 kind: Secret metadata: namespace: pinniped-supervisor name: ws1-client-credentials type: secrets.pinniped.dev/oidc-client stringData: clientID: "<your-client-id>" clientSecret: "<your-client-secret>" ``` The following claims are returned by Workspace ONE Access. The `group` scope is required to use the `groupids` and `groupnames` claims. The `email` scope is required to use the `email` claim. The remaining claims are always available. ```json { "acct": "my-username@System Domain", "email": "my-email@my-company.com", "email_verified": true, "group_ids": [ "8cb8d875-4eb5-4d75-af7e-136efb439b6d", "9eb9c163-0677-4fc6-b70f-b4e14600a097" ], "group_names": [ "ALL USERS", "Test Group" ], "iss": "https://ws1.my-company.com/SAAS/auth", "sub": "my-username@WS1-ENV-NAME", } ``` Once your OIDCIdentityProvider has been created, you can validate your configuration by running: ```shell kubectl describe OIDCIdentityProvider -n pinniped-supervisor ws1 ``` Look at the `status` field. If it was configured correctly, you should see `phase: Ready`. Next, ! Then you'll be able to log into those clusters as any of the users from Workspace ONE Access.