Overview of authentication and authorization

Configuring an identity provider: You can define any supported identity provider in OpenShift Container Platform and add it to your cluster.

Configuring the internal OAuth server: The OpenShift Container Platform control plane includes a built-in OAuth server that determines the user’s identity from the configured identity provider and creates an access token. You can configure the token duration and inactivity timeout.

Registering an OAuth client: OpenShift Container Platform includes several default OAuth clients. You can register and configure additional OAuth clients.

Impersonating a system admin user: You can grant cluster administrator permissions to a user by impersonating a system admin user.

Viewing local and cluster roles and bindings.

Creating a local role and assigning it to a user or group.

Creating a cluster role and assigning it to a user or group: OpenShift Container Platform includes a set of default cluster roles. You can create additional cluster roles and add them to a user or group.

Creating a cluster-admin user: By default, your cluster has only one cluster administrator called kubeadmin. You can create another cluster administrator. Before creating a cluster administrator, ensure that you have configured an identity provider.

Creating service accounts: Service accounts provide a flexible way to control API access without sharing a regular user’s credentials. A user can create and use a service account in applications and also as an OAuth client.

Scoping tokens: A scoped token is a token that identifies as a specific user who can perform only specific operations. You can create scoped tokens to delegate some of your permissions to another user or a service account.

Syncing LDAP groups: You can manage user groups in one place by syncing the groups stored in an LDAP server with the OpenShift Container Platform user groups.