:_mod-docs-content-type: ASSEMBLY
:context: post-install-preparing-for-users
[id="post-install-preparing-for-users"]
= Preparing for users
include::_attributes/common-attributes.adoc[]

toc::[]

[role="_abstract"]
You can prepare your cluster for users by configuring authentication and permissions, managing initial administrative access, and making Operators available through the software catalog.

After installing {product-title}, you can further expand and customize your cluster to your requirements, including taking steps to prepare for users.

[id="post-install-understanding-identity-provider"]
== Understanding identity provider configuration

The {product-title} control plane includes a built-in OAuth server. Developers and
administrators obtain OAuth access tokens to authenticate themselves to the API.

As an administrator, you can configure OAuth to specify an identity provider
after you install your cluster.

include::modules/identity-provider-overview.adoc[leveloffset=+2]

[id="post-install-supported-identity-providers"]
=== Supported identity providers
// This section is sourced from authentication/understanding-identity-provider.adoc
You can configure the following types of identity providers:

[cols="2a,8a",options="header"]
|===

|Identity provider
|Description

|xref:../authentication/identity_providers/configuring-htpasswd-identity-provider.adoc#configuring-htpasswd-identity-provider[htpasswd]
|Configure the `htpasswd` identity provider to validate user names and passwords
against a flat file generated using
link:http://httpd.apache.org/docs/2.4/programs/htpasswd.html[`htpasswd`].

|xref:../authentication/identity_providers/configuring-keystone-identity-provider.adoc#configuring-keystone-identity-provider[Keystone]
|Configure the `keystone` identity provider to integrate
your {product-title} cluster with Keystone to enable shared authentication with
an OpenStack Keystone v3 server configured to store users in an internal
database.

|xref:../authentication/identity_providers/configuring-ldap-identity-provider.adoc#configuring-ldap-identity-provider[LDAP]
|Configure the `ldap` identity provider to validate user names and passwords
against an LDAPv3 server, using simple bind authentication.

|xref:../authentication/identity_providers/configuring-basic-authentication-identity-provider.adoc#configuring-basic-authentication-identity-provider[Basic authentication]
|Configure a `basic-authentication` identity provider for users to log in to
{product-title} with credentials validated against a remote identity provider.
Basic authentication is a generic backend integration mechanism.

|xref:../authentication/identity_providers/configuring-request-header-identity-provider.adoc#configuring-request-header-identity-provider[Request header]
|Configure a `request-header` identity provider to identify users from request
header values, such as `X-Remote-User`. It is typically used in combination with
an authenticating proxy, which sets the request header value.

|xref:../authentication/identity_providers/configuring-github-identity-provider.adoc#configuring-github-identity-provider[GitHub or GitHub Enterprise]
|Configure a `github` identity provider to validate user names and passwords
against GitHub or GitHub Enterprise's OAuth authentication server.

|xref:../authentication/identity_providers/configuring-gitlab-identity-provider.adoc#configuring-gitlab-identity-provider[GitLab]
|Configure a `gitlab` identity provider to use
link:https://gitlab.com/[GitLab.com] or any other GitLab instance as an identity
provider.

|xref:../authentication/identity_providers/configuring-google-identity-provider.adoc#configuring-google-identity-provider[Google]
|Configure a `google` identity provider using
link:https://developers.google.com/identity/protocols/OpenIDConnect[Google's OpenID Connect integration].

|xref:../authentication/identity_providers/configuring-oidc-identity-provider.adoc#configuring-oidc-identity-provider[OpenID Connect]
|Configure an `oidc` identity provider to integrate with an OpenID Connect
identity provider using an
link:http://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth[Authorization Code Flow].

|===

After you define an identity provider, you can
xref:../authentication/using-rbac.adoc#authorization-overview_using-rbac[use
RBAC to define and apply permissions].

include::modules/identity-provider-parameters.adoc[leveloffset=+2]

include::modules/identity-provider-default-CR.adoc[leveloffset=+2]

[id="post-install-using-rbac-to-define-and-apply-permissions"]
== Using RBAC to define and apply permissions
Understand and apply role-based access control.

include::modules/rbac-overview.adoc[leveloffset=+2]

[role="_additional-resources"]
.Additional resources

* link:https://access.redhat.com/solutions/6989997[RBAC rules allow execution privileges]
* link:https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles[Aggregated ClusterRoles (Kubernetes documentation)]

include::modules/rbac-projects-namespaces.adoc[leveloffset=+2]

[role="_additional-resources"]
.Additional resources

* link:https://kubernetes.io/docs/tasks/administer-cluster/namespaces/[Kubernetes documentation on namespaces]

include::modules/rbac-default-projects.adoc[leveloffset=+2]

[role="_additional-resources"]
.Additional resources

* link:https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/#rescheduler-guaranteed-scheduling-of-critical-add-ons[Guaranteed Scheduling For Critical Add-On Pods (Kubernetes documentation)]

include::modules/rbac-viewing-cluster-roles.adoc[leveloffset=+2]

include::modules/rbac-viewing-local-roles.adoc[leveloffset=+2]

include::modules/rbac-adding-roles.adoc[leveloffset=+2]

include::modules/rbac-creating-local-role.adoc[leveloffset=+2]

ifdef::openshift-enterprise,openshift-webscale,openshift-origin[]
include::modules/rbac-creating-cluster-role.adoc[leveloffset=+2]

endif::[]

include::modules/rbac-local-role-binding-commands.adoc[leveloffset=+2]

ifdef::openshift-enterprise,openshift-webscale,openshift-origin[]
include::modules/rbac-cluster-role-binding-commands.adoc[leveloffset=+2]

include::modules/rbac-creating-cluster-admin.adoc[leveloffset=+2]

endif::[]

include::modules/unauthenticated-users-cluster-role-binding-con.adoc[leveloffset=+2]

include::modules/unauthenticated-users-cluster-role-binding.adoc[leveloffset=+2]

include::modules/authentication-kubeadmin.adoc[leveloffset=+1]

include::modules/authentication-remove-kubeadmin.adoc[leveloffset=+2]

[id="post-install-mirrored-catalogs"]
== Populating the software catalog from mirrored Operator catalogs

If you mirrored Operator catalogs for use with disconnected clusters, you can populate the software catalog with the Operators from your mirrored catalogs. You can use the generated manifests from the mirroring process to create the required `ImageContentSourcePolicy` and `CatalogSource` objects.

[id="prerequisites_post-install-mirrored-catalogs"]
=== Prerequisites

* xref:../disconnected/installing-mirroring-installation-images.adoc#olm-mirror-catalog_installing-mirroring-installation-images[Mirroring Operator catalogs for use with disconnected clusters]

include::modules/olm-mirroring-catalog-icsp.adoc[leveloffset=+3]

include::modules/olm-creating-catalog-from-index.adoc[leveloffset=+3]

[role="_additional-resources"]
.Additional resources
* xref:../operators/admin/olm-managing-custom-catalogs.adoc#olm-accessing-images-private-registries_olm-managing-custom-catalogs[Accessing images for Operators from private registries]
* xref:../operators/understanding/olm/olm-understanding-olm.adoc#olm-catalogsource-image-template_olm-understanding-olm[Image template for custom catalog sources]
* xref:../openshift_images/managing_images/image-pull-policy.adoc#image-pull-policy[Image pull policy]

include::modules/olm-installing-operators-from-software-catalog.adoc[leveloffset=+1]

ifdef::openshift-origin[]
include::modules/olm-installing-operators-from-software-catalog-configure.adoc[leveloffset=+2]

endif::[]
include::modules/olm-installing-from-software-catalog-using-web-console.adoc[leveloffset=+2]

ifdef::openshift-enterprise,openshift-webscale,openshift-origin[]
include::modules/olm-installing-from-software-catalog-using-cli.adoc[leveloffset=+2]

[role="_additional-resources"]
.Additional resources
* xref:../operators/understanding/olm/olm-understanding-operatorgroups.adoc#olm-operatorgroups-about_olm-understanding-operatorgroups[About OperatorGroups]
endif::[]
