Revert "website: latest migration to new structure" (#11634)
Revert "website: latest migration to new structure (#11522)"
This reverts commit 9a89a5f94b.
This commit is contained in:
Tana M Berry
@ -1,86 +0,0 @@
|
||||
---
|
||||
title: Create a Remote Access Control (RAC) provider
|
||||
---
|
||||
|
||||
:::info
|
||||
This feature is in technical preview, so please report any bugs on [GitHub](https://github.com/goauthentik/authentik/issues).
|
||||
:::
|
||||
|
||||
The RAC provider is a highly flexible feature for accessing remote machines. This document provides instructions for the basic creation and configuration of a RAC provider within a defined scenario.
|
||||
|
||||
Fow more information about using a RAC provider, see the [Overview](./index.md) documentation. You can also view our video on YouTube for setting up RAC.
|
||||
|
||||
<iframe width="560" height="315" src="https://www.youtube.com/embed/9wahIBRV6Ts;start=22" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe>
|
||||
|
||||
## Prereqisites
|
||||
|
||||
The RAC provider requires the deployment of the [RAC Outpost](../../outposts/index.mdx).
|
||||
|
||||
## Overview workflow to create a RAC provider
|
||||
|
||||
The typical workflow to create and configure a RAC provider is to 1. create app/provider, 2. create property mappings (that define the access credentials to each remote machine), 3. create an endpoint for each remote machine you want to connect to.
|
||||
|
||||
Depending on whether you are connecting using RDP, SSH, or VNC, the exact configuration choices might differ, but the overall workflow applies to all RAC connections.
|
||||
|
||||
### Step 1. Create an application and RAC provider
|
||||
|
||||
The first step is to create the RAC app and provider.
|
||||
|
||||
1. Log in as an admin to authentik, and go to the Admin interface.
|
||||
|
||||
2. In the Admin interface, navigate to **Applications -> Applications**.
|
||||
|
||||
3. Click **Create with Wizard**. Follow the [instructions](../../applications/manage_apps.md#instructions) to create your RAC application and provider.
|
||||
|
||||
### Step 2. Create RAC property mapping
|
||||
|
||||
Next, you need to add a property mapping for each of the remote machines you want to access. Property mappings allow you to pass information to external applications, and with RAC they are used to pass the host name, IP address, and access credentials for the remote machines.
|
||||
|
||||
1. In the Admin interface, navigate to **Customization -> Property Mappings**.
|
||||
|
||||
2. On the **Property Mappings** page, click **Create**.
|
||||
|
||||
3. On the **New property mapping** modal, set the following:
|
||||
|
||||
- **Select Type**: RAC Property Mappings
|
||||
- **Create RAC Property Mapping**:
|
||||
- **Name**s: define a name for the property mapping, perhaps include the type of connection (RDP, SSH, VNC)
|
||||
- **General settings**:
|
||||
- **Username**: the username for the remote machine
|
||||
- **Password**: the password for the remote machine
|
||||
- **RDP settings**:
|
||||
- **Ignore server certificate: select **Enabled\*\* (Depending on the setup of your RDP Server, it might be required to enable this setting.)
|
||||
- **Enable wallpaper**: optional
|
||||
- **Enable font smoothing**: optional
|
||||
- **Enable full window dragging**: optional
|
||||
- Advanced settings:
|
||||
- **Expressions**: optional, using Python you can define custom [expressions](../property-mappings/expression.mdx).
|
||||
|
||||
4. Click **Finish** to save your settings and close the modal.
|
||||
|
||||
### Step 3. Create Endpoints for the Provider
|
||||
|
||||
Finally, you need to create an endpoint for each remote machine. Endpoints are defined within providers; connections between the remote machine and authentik are enabled through communication between the provider's endpoint and the remote machine.
|
||||
|
||||
1. In the Admin interface navigate to **Applications -> Providers**.
|
||||
|
||||
2. Select the RAC provider you created in Step 1 above.
|
||||
|
||||
3. On the Provider page, under **Endpoints**, click **Create**.
|
||||
|
||||
4. On the **Create Endpoint** modal, provide the following settings:
|
||||
|
||||
- **Name**: define a name for the endpoint, perhaps include the type of connection (RDP, SSH, VNC)
|
||||
- **Protocol**: select the appropriate protocol
|
||||
- **Host**: the host name or IP address of the system you are connecting to.
|
||||
- **Maximum concurrent connections**: select a value or use `-1` to disable the limitation.
|
||||
- **Property mapping**: select either the property mapping that you created in Step 2, or use one of the default settings.
|
||||
- **Advance settings**: optional
|
||||
|
||||
5. Click **Create** to save your settings and close the modal.
|
||||
|
||||
### Access the remote machine
|
||||
|
||||
To verify your configuration and access the remote machine, go to the **User interface** of your authentik instance. On the **My applications** page click the **Remote Access** application. authentik connects you to a secure shell on the remote machine, in your web browser.
|
||||
|
||||
If you defined multiple endpoints, they are each displayed; click the endpoint for the remote machine that you want to access.
|
||||
@ -1,65 +0,0 @@
|
||||
---
|
||||
title: Remote Access Control (RAC) Provider
|
||||
---
|
||||
|
||||
<span class="badge badge--primary">Enterprise</span>
|
||||
|
||||
---
|
||||
|
||||
:::info
|
||||
This feature is in technical preview, so please report any bugs on [GitHub](https://github.com/goauthentik/authentik/issues).
|
||||
:::
|
||||
|
||||
:::info
|
||||
This provider requires the deployment of the [RAC Outpost](../../outposts/index.mdx).
|
||||
:::
|
||||
|
||||
## About the Remote Access Control (RAC) Provider
|
||||
|
||||
The RAC provider allows users to access remote Windows, macOS, and Linux machines via [RDP](https://en.wikipedia.org/wiki/Remote_Desktop_Protocol)/[SSH](https://en.wikipedia.org/wiki/Secure_Shell)/[VNC](https://en.wikipedia.org/wiki/Virtual_Network_Computing). Just like other providers in authentik, the RAC provider is associated with an application that appears on a user's **My applications** page.
|
||||
|
||||
:::info
|
||||
Note that with RAC, you create a single application and associated provider that serves to connect with _all remote machines_ that you want to configure for access via RAC.
|
||||
:::
|
||||
|
||||
For instructions on creating a RAC provider, refer to the [Managing RAC providers](./how-to-rac.md) documentation. You can also view our [video on YouTube](https://www.youtube.com/watch?v=9wahIBRV6Ts) for setting up a RAC.
|
||||
|
||||
There are several components used with a RAC provider; let's take a closer look at the high-level configuration layout of these components and how they are managed using endpoints and connections.
|
||||
|
||||
|
||||
|
||||
The provider-application pair, the authentik server, and the authentik API are typical to all configurations. With RAC, there are some new components, namely the endpoints, the outpost, and of course the target remote machines.
|
||||
|
||||
When a user starts the RAC application, the app communicates with the authentik server, which then connects to an instance of the outpost (the exact instance is selected dynamically based on connection load). After the outpost is selected, then the authentik server sends the outpost the instructions (based on the data you defined in the endpoint) required to connect to the remote machine.
|
||||
|
||||
After the connection to the remote machine is made, the outpost sends a message back to the authentik server (via websockets), and the web browser opens the websocket connection to the remote machine.
|
||||
|
||||
### Endpoints
|
||||
|
||||
Unlike other providers, where one provider-application pair must be created for each resource you wish to access, the RAC provider handles this slightly differently. For each remote machine (computer/server) that should be accessible, you create an _Endpoint_ object within a single RAC provider. (And as mentioned above, a single provider-application pair is used for all remote connections.)
|
||||
|
||||
The _Endpoint_ object specifies the hostname/IP of the machine to connect to, as well as the protocol to use. Additionally it is possible to bind policies to _endpoint_ objects to restrict access. Users must have access to both the application that the RAC Provider is using as well as the individual endpoint.
|
||||
|
||||
Configuration details such as credentials can be specified through _settings_, which can be specified on different levels and are all merged together when connecting:
|
||||
|
||||
1. Provider settings
|
||||
2. Endpoint settings
|
||||
3. Connection settings (see [Connections](#connections))
|
||||
4. Provider property mapping settings
|
||||
5. Endpoint property mapping settings
|
||||
|
||||
### Connections
|
||||
|
||||
Each connection is authorized through authentik Policy objects that are bound to the application and the endpoint. Additional verification can be done with the authorization flow.
|
||||
|
||||
Additionally it is possible to modify the connection settings through the authorization flow. Configuration set in `connection_settings` in the flow plan context will be merged with other settings as shown above.
|
||||
|
||||
A new connection is created every time an endpoint is selected in the [User Interface](../../../customize/interfaces/user/customization.mdx). Once the user's authentik session expires, the connection is terminated. Additionally, the connection timeout can be specified in the provider, which applies even if the user is still authenticated. The connection can also be terminated manually.
|
||||
|
||||
## Capabilities
|
||||
|
||||
The following features are currently supported:
|
||||
|
||||
- Bi-directional clipboard
|
||||
- Audio redirection (from remote machine to browser)
|
||||
- Resizing
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 28 KiB |
Reference in New Issue
Block a user