3 navsection: installguide
4 title: Set up web based login
7 Copyright (C) The Arvados Authors. All rights reserved.
9 SPDX-License-Identifier: CC-BY-SA-3.0
12 Select one of the following login mechanisms for your cluster.
14 # If all users will authenticate with Google, "configure Google login":#google.
15 # If all users will authenticate using PAM as configured on your controller node, "configure PAM":#pam.
16 # If you need to enable multiple authentication methods, or your backend can't be configured as a PAM service on your controller node, "configure a separate single sign-on (SSO) server":#sso.
18 h2(#google). Google login
20 With this configuration, users will sign in with their Google accounts.
22 First, visit "Setting up Google auth.":google-auth.html
24 Next, copy the values of *Client ID* and *Client secret* from the Google Developers Console into @Login.GoogleClientID@ and @Login.GoogleClientSecret@ of @config.yml@:
28 GoogleClientID: "0000000000000-zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz.apps.googleusercontent.com"
29 GoogleClientSecret: "zzzzzzzzzzzzzzzzzzzzzzzz"
32 h2(#pam). PAM (experimental)
34 With this configuration, authentication is done according to the Linux PAM ("Pluggable Authentication Modules") configuration on your controller host.
36 Enable PAM authentication in @config.yml@:
43 Check the "default config file":{{site.baseurl}}/admin/config.html for more PAM configuration options.
45 The default PAM configuration on most Linux systems uses the local password database in @/etc/shadow@ for all logins. In this case, in order to log in to Arvados, users must have a shell account and password on the controller host itself. This can be convenient for a single-user or test cluster.
47 PAM can also be configured to use different backends like LDAP. In a production environment, PAM configuration should use the service name ("arvados" by default) to set a separate policy for Arvados logins: generally, Arvados users should not have shell accounts on the controller node.
49 For information about configuring PAM, refer to the "PAM System Administrator's Guide":http://www.linux-pam.org/Linux-PAM-html/Linux-PAM_SAG.html.
51 h2(#sso). Separate single-sign-on (SSO) server
53 With this configuration, Arvados passes off authentication to a separate SSO server that supports Google, LDAP, and a local password database.
55 See "Install the Single Sign On (SSO) server":install-sso.html