Authenticating to the Storagegrid when Azure AD SSO is enabled

[santosh725]

Hello,

We were able to integrate Storagegrid with harvest with local users in our lab. But with SSO enabled we are unable to do so. Are there any instructions or guidelines with SSO enabled ?
The authentication methods provided here are basic auth and certificate. not sure if a token can be used or added ?

https://netapp.github.io/harvest/23.05/configure-harvest-basic/#authentication

[cgrinds]

hi @santosh725 Harvest does not currently support StorageGRID SSO.

Reading the StorageGRID documentation for SSO, I'm wondering if it make sense for a tool like Harvest? Sounds like SSO may be intended for humans, not tools (like Harvest) since StorageGRID redirects SSO logins to a different web page. I'm not sure how a command line tool like Harvest would display a webpage.

[santosh725]

hi @cgrinds

1. Can we raise it as a feature request to Support it using it as reference ? https://docs.netapp.com/us-en/storagegrid-116/admin/use-api-if-sso-is-enabled-azure.html#sign-in-to-the-api-if-azure-single-sign-on-is-enabled

But lets say if SSO is not enabled and we use local users wouldn't harvest use APIs to collect the metrics and one of the steps wouldn't it be to get a token ?

[cgrinds]

Can we raise it as a feature request?

Yes! For sure, thanks for that SG link. I'll turn this discussion into an issue for that.

But lets say if SSO is not enabled and we use local users wouldn't harvest use APIs to collect the metrics and one of the steps wouldn't it be to get a token ?

Yes, that's exactly what Harvest does when SSO is not enabled. Are you not seeing that work? Maybe I misunderstood, but I thought that's what your first sentence about it working with local users in the lab meant.

I'm guessing you saw the documentation on StorageGRID permissions and already have that setup.

[santosh725]

hello @cgrinds

Thanks a ton for your quick response. Apologies if my last question was confusing. So when the SSO was disabled we were able to make it work using local users but with the new security standard we need to use SSO on our Storagegrid System.

The link I provided helps us get a "token" which we can use for the api operations. So was hoping once you get the token rest of the harvest related operations should be same.

Do I need to raise it as an issue for the feature request ?

[cgrinds]

I created the issue from this discussion. #2049

We'll take a look at the storagegrid-ssoauth-azure.py script and see if this is something we can add.

Do you have MFA also enabled? If so, I don't think this workflow will work very well for you since every time a token expires (hours to days), even if Harvest implements a SAML workflow with SG and Azure, it will require a human needing to enter two factor auth every few hours/days. That doesn't work well with headless monitoring tools.

[santosh725]

No we are not using MFA.

[santosh725]

Hello @cgrinds

Was wondering if you had a chance to discuss with your team and any possibility to include it in 23.0,.8

[cgrinds]

hi @santosh725 we're still investigating what makes the most sense.

Not sure if you saw that we added support for credential scripts in Harvest in 23.05. I think you can use a credential script + the single sign-on scripts you shared above to achieve what you want.

Can you give that a try and see if that works for you?

[cgrinds]

Hi @santosh725 were you able to try the credentials script suggestion in comment?

[cgrinds]

hi @santosh725 we've got a standalone script working for StorageGRID Azure SSO. Would you be willing to try it out and make sure it works for your usecase? If that works well for you, we'll add to Harvest proper.

Email us at ng-harvest-files@netapp.com and I'll reply with the standalone program.