Azure AD doesnt use the Admin fields to authenticate with

[aemneina]

Rancher versions:
rancher/server: v1.6.14

Steps to Reproduce:

• authenticate with bogus admin credentials
• put valid user credentials under 'test and enable' user account

Results:

• Azure AD is enabled and user account is used for admin bindings and group searches.

[loganhz]

@vincent99 I think this is a backend issue?
UI shows enabled as backend returns 20X in this case.

[superseb]

I believe the admin credentials are not used, so they are not needed. @aemneina can clarify on this case.

[loganhz]

@aemneina Can I remove admin credentials from UI side?

[vincent99]

I'm willing to believe that the creds are not tested during enabling auth, but don't think it's correct that they are not ever used at all (e.g. for determining the groups a user is a member of when using an account API key).

[prachidamle]

@vincent99 @loganhz we can remove the Admin credentials field from UI. Azure provider uses an Azure assigned accessToken and refreshToken pair to grab the user's groups - we store these tokens in the account table when the user logs in using his password. Anytime later we need to access the user's groups/details these tokens suffice. If the accessToken has expired, refreshToken helps get a new pair of these tokens that is then stored with the account.

Thus even while using API keys, the tokens stored with the account are used and admin creds are not needed.

[prachidamle]

I will test out the API keys usecase and confirm my understanding noted above.

[prachidamle]

Yes tested with api keys against 1.6 and pulled my user identities correctly, confirmed that AzureAD provider does not need admin creds for any backend functionality

[sangeethah]

Tested with v1.6.19-rc5.

While enabling Azure AD auth , user is not asked to enter admin credentials anymore.

Verify all the existing functionalities continues to work as expected.