.. SPDX-FileCopyrightText: 2025 Univention GmbH
..
.. SPDX-License-Identifier: AGPL-3.0-only

.. _nubus-authentication:

**************
Authentication
**************

Nubus provides a central login page through the :ref:`nubus-portal`.
You can sign in to the *Management UI* with the credentials of the respective user account.
This section describes the sign-in to Nubus
and covers the following topics:

* :ref:`nubus-authentication-sign-in`
* :ref:`nubus-authentication-sign-out`
* :ref:`nubus-authentication-sso`

.. _nubus-authentication-sign-in:

Sign-in
=======

If a page in the *Management UI*, such as a management module,
requires a login, your browser redirects you to the sign-in page.
When you sign in at Nubus,
the browser session closes after 8 hours of inactivity by default.
To renew the session, you must sign in again.

Depending on the installation, you find the sign-in at the following locations:

.. tab-set::

   .. tab-item:: Nubus for UCS
      :sync: appliance

      In Nubus for UCS, you find the portal to sign in
      at :samp:`https://{FQDN}/univention/portal/`,
      where :samp:`{FQDN}` is the fully qualified domain name of the system.

      Example
         :samp:`https://{ucs.example.com}/univention/portal/`.

   .. tab-item:: Nubus for Kubernetes
      :sync: kubernetes

      In Nubus for Kubernetes,
      you find the portal to sign in at :samp:`https://portal.{global.domain}/univention/portal`.
      If you don't know the URL to the portal, ask your operator.
      The value for :samp:`{global.domain}` locates
      in the :external+uv-nubus-kubernetes-operation:envvar:`global.domain`
      of the Helm Chart.

On the portal you can use the following ways to sign in:

* Click the tile :guilabel:`Login` on the portal page.

* Go to :menuselection:`Menu` and click :guilabel:`Login`.

It opens the login page as shown in :numref:`nubus-authentication-sign-in-figure`.

.. _nubus-authentication-sign-in-figure:

.. figure:: /images/ui_login.*
   :alt: Nubus sign-in page
   :width: 440px

   Nubus sign-in page

.. _nubus-authentication-sign-in-choose-user-account:

Choose the right user account
-----------------------------

To sign in, enter the username and password
of the corresponding user account.

.. _nubus-authentication-sign-in-choose-user-account-administrator:

``Administrator``
   When you sign in with the ``Administrator`` account,
   or a user account that's member of the ``Domain Admins`` user group,
   the *Management UI* shows the management modules
   for the administration and configuration.

.. _nubus-authentication-sign-in-choose-user-account-others:

Other user accounts
   When you sign in with another user account
   that isn't part of the ``Domain Admins`` user group,
   the *Management UI* shows the management modules approved for the user.
   For additional information on allowing further modules, refer to
   :external+uv-ucs-operation:ref:`management-interface-delegated-administration`
   in :cite:t:`uv-ucs-operation`.

.. TODO: Add seealso box after UCS Operation Manual is available and refer to the choose the right user account section there.

   .. seealso::

      :external+uv-ucs-operation:ref:`ucs-operation-auth-sign-in-choose-account`
         in :cite:t:`uv-ucs-operation`
         for additional accounts available by default in Nubus for UCS.

.. _nubus-authentication-sign-out:

Sign-out
========

To sign out of the *Management UI*, click :guilabel:`Logout` in the user menu.

.. _nubus-authentication-sso:

Single sign-on
==============

Nubus supports single sign-on through various protocols.
The protocol in use depends on your installation and the configuration.
After a successful sign-in,
the session is valid for all services connected to Nubus.
The rules about inactivity also apply for single sign-on.
:numref:`nubus-authentication-sso-figure`
shows the sign-in page for single sign-on.

.. _nubus-authentication-sso-figure:

.. figure:: /images/ui_login_sso.*
   :alt: Nubus sign-in page for single sign-on
   :width: 440px

   Nubus sign-in page for single sign-on

.. _nubus-authentication-sso-saml:

SAML for single sign-on
-----------------------

SAML is short for Security Assertion Markup Language,
an open source standard for exchanging authentication and authorization data
between an identity provider and a service provider.
Nubus supports SAML as a protocol for single sign-on.

.. tab-set::

   .. tab-item:: Nubus for UCS
      :sync: appliance

      By default,
      the sign-in page for the portal has single sign-on deactivated
      in Nubus for UCS.
      Nubus for UCS supports single sign-on through SAML
      through the Keycloak App.
      Refer to :external+uv-keycloak-app:ref:`login-portal`
      in :cite:t:`keycloak-app`.

      For further information about activation and configuration of SAML in Nubus for UCS,
      see
      :external+uv-ucs-operation:ref:`management-interface-auth-sso-saml`
      in :cite:t:`uv-ucs-operation`.

   .. tab-item:: Nubus for Kubernetes
      :sync: kubernetes

      Nubus for Kubernetes uses single sign-on by default through the SAML protocol.

.. _nubus-authentication-sso-oidc:

OpenID Connect for single sign-on
---------------------------------

OpenID Connect (OIDC) is a protocol that allows single sign-on.
OIDC is a more lightweight protocol than SAML.
It's one variant for using single sign-on in the *Portal* and the *Management UI*.

.. tab-set::

   .. tab-item:: Nubus for UCS
      :sync: appliance

      For the configuration of OpenID Connect for Nubus for UCS,
      see
      :external+uv-ucs-operation:ref:`management-interface-auth-sso-oidc`
      in :cite:t:`uv-ucs-operation`.

   .. tab-item:: Nubus for Kubernetes
      :sync: kubernetes

      OpenID Connect for sign-in to Nubus for Kubernetes isn't supported.

      .. TODO: It's in the working. Change the statement, after OIDC sign-in is
         available and the respective documentation is in place.