User and Administrator Portal

Portal URLs

By default the Infra and Portal servers respond to all requests with a self-signed certificate.

If you need to set a specific URL for the User Portal, use the following variable:

all:
    vars:
        API_LICENSE: "ewogICAg ... Uw5NXhGVDF0NFU2TkxOdjQvZU53PT0iCiAgICC9Cn0="
        ...
    infra_manager:
        vars:
            PORTAL_URL: "url.domain.tld"
        hosts:
            infra_manager1:
                ansible_host: "10.0.0.1"
            infra_manager2:
                ansible_host: "10.0.0.2"
            infra_manager3:
                ansible_host: "10.0.0.3"

If you need to set a specific URL for the Administrator Portal, use the following variable:

all:
    vars:
        API_LICENSE: "ewogICAg ... Uw5NXhGVDF0NFU2TkxOdjQvZU53PT0iCiAgICC9Cn0="
        ...
    infra_manager:
        vars:
            PORTAL_URL: "url.domain.tld"
            PORTALADMIN_URL: "urladmin.domain.ltd"
        hosts:
            infra_manager1:
                ansible_host: "10.0.0.1"
            infra_manager2:
                ansible_host: "10.0.0.2"
            infra_manager3:
                ansible_host: "10.0.0.3"

Important

It is recommended not to expose the Administrator Portal to an external network. This portal is intended to be used within your internal network.

Warning

With PORTALADMIN_URL enabled, administrators can no longer log in via the User Portal URL.

IP filtering

You can enable IP filtering on both User and Administrator portals.

all:
    vars:
        API_LICENSE: "ewogICAg ... Uw5NXhGVDF0NFU2TkxOdjQvZU53PT0iCiAgICC9Cn0="
        ...
    infra_manager:
        vars:
            PORTAL_URL: "url.domain.tld"
            PORTAL_URL_RESTRICT_IP: "10.1.1.1,10.2.2.0/24"
            PORTALADMIN_URL: "urladmin.domain.ltd"
            PORTALADMIN_URL_RESTRICT_IP: "10.3.1.2,10.3.2.0/24"
        hosts:
            infra_manager1:
                ansible_host: "10.0.0.1"
            infra_manager2:
                ansible_host: "10.0.0.2"
            infra_manager3:
                ansible_host: "10.0.0.3"

Port management

By default the User Portal listens on port 443 with automatic redirection from port 80 to 443 over SSL.

For the Administrator Portal you can specify the port:

PORTALADMIN_URL_PORT: "8444"

Warning

The port must be different from 80, 443, and 8443 which are already used by other services.

Physical separation of Portals

The reemo-infra Ansible role lets you physically separate the User Portal and the Administrator Portal.

Portal dedicated to instance administrators

To do this, create an inventory by replacing the infra_manager group with two groups: api_manager and portal_manager.

Note

You must set a HMACSECRET in the variables, shared between the two portals and the API. This secret is used to sign requests from the portals to the API.

all:
    vars:
        API_LICENSE: "ewogICAg ... Uw5NXhGVDF0NFU2TkxOdjQvZU53PT0iCiAgICC9Cn0="
        HMACSECRET: "U6US67D70409RFAGQH5ZIWBFV8HX0UCZ"
portal_manager:
        children:
            portaluser_manager:
                vars:
                    PORTAL_URL: "url.domain.tld"
                    TRAEFIK_SSL_CERTS:
                        - cert_file: "/localpath/to/cert.crt"
                          key_file: "/localpath/to/key.key"
                    API_IP:
                        - ip: "10.3.1.1"
                        - ip: "10.3.1.2"
                        - ip: "10.3.1.3"
                hosts:
                    portaluser1:
                        ansible_host: "10.0.0.1"
                    portaluser2:
                        ansible_host: "10.0.0.2"
                    portaluser3:
                        ansible_host: "10.0.0.3"
            portaladmin_manager:
                vars:
                    PORTAL_URL: "admin.domain.tld"
                    TRAEFIK_SSL_CERTS:
                        - cert_file: "/localpath/to/cert.crt"
                          key_file: "/localpath/to/key.key"
                    API_IP:
                        - ip: "10.3.1.1"
                        - ip: "10.3.1.2"
                        - ip: "10.3.1.3"
                hosts:
                    portaladmin1:
                        ansible_host: "10.0.0.4"
                    portaladmin2:
                        ansible_host: "10.0.0.5"
                    portaladmin3:
                        ansible_host: "10.0.0.6"
api_manager:
        hosts:
            api1:
                ansible_host: "10.3.1.1"
            api2:
                ansible_host: "10.3.1.2"
            api3:
                ansible_host: "10.3.1.3"

Warning

Note that in the example above, the URLs use the PORTAL_URL variable, even for the administrator portal. Use this value when only one portal is declared on a specific server.

Portal dedicated to an SSO

In addition to physical separation you can also restrict SSO connectors per portal.

When creating a connector you obtain a GUID which must then be entered in the inventory in the targeted portal section using the variable PORTAL_LDAP_CONNECTORS for LDAP connectors and PORTAL_SAML_CONNECTORS for SAML connectors.

all:
    vars:
        API_LICENSE: "ewogICAg ... Uw5NXhGVDF0NFU2TkxOdjQvZU53PT0iCiAgICC9Cn0="
        HMACSECRET: "..."
portal_manager:
        children:
            portalsso_manager:
                vars:
                    PORTAL_URL: "urlldap.domain.tld"
                    TRAEFIK_SSL_CERTS:
                        - cert_file: "/localpath/to/cert.crt"
                          key_file: "/localpath/to/key.key"
                    PORTAL_LDAP_CONNECTORS:
                        - ldapid: "3182932d-9ee1-4c06-a4cf-c13c25f2ee93"
                    PORTAL_SAML_CONNECTORS:
                        - samlid: "692469bd-cb28-8332-aa65-9c95451c1a0e"
                hosts:
                    portalsso1:
                        ansible_host: "10.0.0.7"
                    portalsso2:
                        ansible_host: "10.0.0.8"
                    portalsso3:
                        ansible_host: "10.0.0.9"

If you have multiple connectors to set on the same portal, add multiple ldapid or samlid lines.

all:
    vars:
        API_LICENSE: "ewogICAg ... Uw5NXhGVDF0NFU2TkxOdjQvZU53PT0iCiAgICC9Cn0="
        HMACSECRET: "..."
portal_manager:
        children:
            portalsso_manager:
                vars:
                    PORTAL_URL: "urlsso.domain.tld"
                    TRAEFIK_SSL_CERTS:
                        - cert_file: "/localpath/to/cert.crt"
                          key_file: "/localpath/to/key.key"
                    PORTAL_LDAP_CONNECTORS:
                        - ldapid: "3182932d-9ee1-4c06-a4cf-c13c25f2ee93"
                        - ldapid: "9c713681-b758-4179-b9a2-13618a7b804e"
                    PORTAL_SAML_CONNECTORS:
                        - samlid: "692469bd-cb28-8332-aa65-9c95451c1a0e"
                        - samlid: "4418cfb9-52c5-4d7c-88d1-7660e7809d23"
                hosts:
                    portalsso1:
                        ansible_host: "10.0.0.7"
                    portalsso2:
                        ansible_host: "10.0.0.8"
                    portalsso3:
                        ansible_host: "10.0.0.9"

Signal Server per Portal

To fully separate the portals, you can assign specific Signal servers to them. These servers will be used by the containers launched from these portals.

portal_manager:
    vars:
        API_IP:
            - ip: "10.0.0.1"
    children:
        portal1_user:
            hosts:
                portal1_user1:
                    ansible_host: "10.0.0.2"
                    PORTAL_URL: "portal1.domain.tld"
                    PROVISION_SIGNAL_IP:
                        - ip: "10.0.0.2"
        portal2_user:
            hosts:
                portal2_user1:
                    ansible_host: "10.0.0.3"
                    PORTAL_URL: "portal2.domain.tld"
                    PROVISION_SIGNAL_IP:
                        - ip: "10.0.0.3"

Filtering user roles on a Portal

You can restrict the type of users allowed to connect to a specific portal. Filtering is based on the user role.

• Instance Administrator

• Organization Administrator

• Organization Member

Main Portal

By default, all users can authenticate on a portal, but with PORTAL_TYPE you can restrict access to a specific user type.

PORTAL_TYPE	default	user	admin	orgadmin	instadmin	orguser
Instance Administrator
Organization Administrator
Organization Member

Admin Portal

The secondary portal is configured by default as a portal dedicated to administrators. You can specify which types of administrators can log in using PORTALADMIN_TYPE.

PORTALADMIN_TYPE	default	orgadmin	instadmin
Instance Administrator
Organization Administrator
Organization Member

Example with a portal dedicated to users and the admin portal dedicated only to instance administrators:

all:
    vars:
        API_LICENSE: "ewogICAg ... Uw5NXhGVDF0NFU2TkxOdjQvZU53PT0iCiAgICC9Cn0="
        HMACSECRET: "..."
portal_manager:
    children:
        portaluser_manager:
            vars:
                PORTAL_URL: "url.domain.tld"
                PORTAL_TYPE: "user"
                TRAEFIK_SSL_CERTS:
                    - cert_file: "/localpath/to/cert.crt"
                        key_file: "/localpath/to/key.key"
            hosts:
                portaluser1:
                    ansible_host: "10.0.0.1"
                portaluser2:
                    ansible_host: "10.0.0.2"
                portaluser3:
                    ansible_host: "10.0.0.3"
        portaladmin_manager:
            vars:
                PORTAL_URL: "admin.domain.tld"
                PORTAL_TYPE: "instadmin"
                TRAEFIK_SSL_CERTS:
                    - cert_file: "/localpath/to/cert.crt"
                        key_file: "/localpath/to/key.key"
            hosts:
                portaladmin1:
                    ansible_host: "10.0.0.4"
                portaladmin2:
                    ansible_host: "10.0.0.5"
                portaladmin3:
                    ansible_host: "10.0.0.6"
api_manager:
    hosts:
        api1:
            ansible_host: "10.3.1.1"
        api2:
            ansible_host: "10.3.1.2"
        api3:
            ansible_host: "10.3.1.3"