►
From YouTube: Smartcard Authentication in Charts -2020-09-03
Description
MR: https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/1510
Related documentation:
https://docs.gitlab.com/ee/administration/auth/smartcard.html
https://gitlab.com/gitlab-org/charts/gitlab/-/blob/master/doc/installation/secrets.md#smartcard-authentication
https://gitlab.com/gitlab-org/charts/gitlab/-/blob/master/doc/charts/globals.md#smartcard-authentication-settings
A
A
So
if
I
jump
over
to
my
project
jump
over
to
my
instance,
I've
set
up
a
very
default
kubernetes
install
using
the
helm
chart
and
it's
very,
very
bones.
All
I've
basically
done
at
this
point
is
log
in
and
upload
an
ee
license
as
the
smart
core
authentication
is
an
ee
premium
feature,
so
I've
done
that
I've
uploaded
my
license.
A
A
A
A
A
A
That
ca
has
been
signed
with
that
and
that's
how
we
will
know
that
we
will
validate
that's
how
the
system
will
validate
against
the
certificate
and
let
you
log
in
so.
In
that
case,
I
am
going
to
I've
already
done
something
similar
without
a
smart
card.
I've
just
replicated
a
ca
search
and
then
my
own.
A
A
A
A
A
And
it
has
one
interesting
point
of
the
the
key
name
that
we
create
needs
to
be
ca.crt
and
so
that's
being
controlled
here
and
that's
a
restriction
placed
on
us
by
the
nginx
ingress.
The
current
support
in
the
version
of
nginx
ingress
we're
using
basically
doesn't
let
you
configure
what
file
path
it's
looking
in,
so
it
only
works
for
that
file
path.
A
Is
the
host
name
that
we'll
be
using
to
authenticate
against.
We
automatically
populate
it
by
default
with,
if
you
provide
the
helm
chart
with
if
you
provided
it
with
like
a
wild
card
domain,
we'll
just
prepend
like
smart
card
of
the
smart
card
subdomain
to
that
wildcard
domain.
Otherwise
you
can
configure
it
manually
here
and
then
there's
a
few
other
options
that
we
won't
be
using
for
the
browser
just
certificate
demo.
A
A
A
B
B
A
That's
a
good
question,
I'm
not
sure.
Actually,
if
we've
enabled
the
alternate
domain
for
omni
west
or
if
we've
just
so
the
rails,
the
rails
code
base
supports
either
one
but
in
omnibus.
In
order
to
support
the
domain,
we
would
have
had
to
provide
an
additional
like
server
configuration
for
an
additional
server
name
address.
A
A
A
A
A
A
A
A
A
A
A
A
A
A
A
A
A
A
A
A
A
I
haven't
added
my
cert
to
this
browser
yet
so,
if
I
try
to
log
in,
I
just
get
a
bad
bad
request,
but
you
can
see
from
here
that
we
have
in
this
case
we
have
this
smart
card
domain,
but
it's
not
on
any
custom
port.
So
that's
that's
the
ability
we
needed
in
order
to
make
this
work
in
the
charts.
So
I'm
going
to
go
ahead
and
open
up
my
preferences
and
add
my
certificate
here
into.
A
A
A
B
A
Yeah
so
for
I
believe
for
the
first
time
you
do
it
like.
If
you
had
a
card,
I
think
you
have
to
add
it
as
a
device
like
under
security
devices,
gotcha.
Okay,
that's
how
it
gets
wired
up
and
okay,
and
so
that's
how
that's
how
a
firefox
would
know
about
it,
and
then
it
would
do
a
very
similar
thing
in
in
that,
like
it
would
ask
where
you
want
to
like,
where
you
want
to
get
that
auth
from
when
you
load
load.
A
The
page
like
firefox
would
ask
you
which
device
you
want:
okay
and
then
how
that
device
works.
I
think
at
that
point
is
up
to
the
device
and
it
depending
on
the
device.
You
might
need
an
additional,
like
extension
to
firefox.
So
if
the
device
is
just
always
there,
I
think
it
works
by
default,
but
I
think
there's
other
other
settings
that
need
to
happen
if
it's
a
device
that
like
is
kind
of
like
a
ubc
where
it
needs
some
capacitance
on
it
or
something
like
that
before
before
it
activates.
A
Yeah,
the
important
thing
is
that
that
device
gives
somehow,
through
a
plug-in
or
otherwise,
that
device
gives
a
firefox
certificate
that
identifies
you.
That
has
that
email
set
and
that's
something
that
has
been
has
been
has
a
a
root
certificate
authority.
That
is
the
same
that
has
been
given
to
gitlab.