Skip to content

Commit

Permalink
[DOCS-2055] (#333)
Browse files Browse the repository at this point in the history
  • Loading branch information
Michael G. Khmelnitsky, Ph.D authored Mar 8, 2024
1 parent 066de2f commit 78f6a5e
Show file tree
Hide file tree
Showing 44 changed files with 159 additions and 121 deletions.
4 changes: 2 additions & 2 deletions _data/sidebars/administrator_guide_sidebar.yml
Original file line number Diff line number Diff line change
Expand Up @@ -65,8 +65,8 @@ entries:
url: /administrator-guide/upgrading-qumulo-core/mode-reference.html
output: web, pdf

- title: Instant Software and Platform Upgrades
url: /administrator-guide/upgrading-qumulo-core/instant-software-platform.html
- title: Performing Upgrades
url: /administrator-guide/upgrading-qumulo-core/performing-upgrades.html
output: web, pdf

- title: Replication Version Requirements and Upgrade Recommendations
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -95,7 +95,7 @@ This process requires coordination between the cluster administrator and SSO adm
<li>To view the current SAML configuration, the cluster administrator can use the <code>qq saml_get_settings</code> command.</li>
<li>To allow specific changes (for example, correct a typo, update a DNS name or an expired certificate, or temporarily disable SAML SSO without losing any of the other settings), the cluster administrator can use the <code>qq saml_modify_settings</code> command to change individual SAML settings independently.</li>
<li>For first-time SAML configurations, the cluster administrator must provide all of the required settings.</li>
<li>Aside from a basic check of the IdP certificate, Qumulo Core doesn't verify the configuration parameters. It is the cluster administrator's responsibility to ensure that IdP-initiated SAML login works correctly. (This login type initiates when the user clicks <strong>Continue to SSO login</strong> in the Web UI or selects the Qumulo cluster on the SSO portal.)</li>
<li>Aside from a basic check of the IdP certificate, Qumulo Core doesn't verify the configuration parameters. It is the cluster administrator's responsibility to ensure that IdP-initiated SAML login works correctly. (This login type initiates when the user clicks <strong>Continue to SSO login</strong> in the Qumulo Core Web UI or selects the Qumulo cluster on the SSO portal.)</li>
</ul>
{{site.data.alerts.end}}

Expand All @@ -108,10 +108,10 @@ Qumulo Core supports three SAML SSO workflows:

{{site.data.alerts.note}}
<ul>
<li>Members of the built-in Administrators role always have access to the Web UI.</li>
<li>To allow other users to access the Web UI, you must assign the built-in Observers role to individual users or to groups.</li>
<li>Members of the built-in Administrators role always have access to the Qumulo Core Web UI.</li>
<li>To allow other users to access the Qumulo Core Web UI, you must assign the built-in Observers role to individual users or to groups.</li>
<li>Depending on policy, additional verification might be necessary for users. For example, the SSO administrator can enforce mandatory two-factor authentication (2FA) for certain clusters.</li>
<li>If the user accesses the Web UI by connecting to a node physically, the login page doesn't show doesn't show <strong>Continue to SSO login</strong> on the Web UI login page, even if SSO is configured.</li>
<li>If the user accesses the Qumulo Core Web UI by connecting to a node physically, the login page doesn't show doesn't show <strong>Continue to SSO login</strong> on the Qumulo Core Web UI login page, even if SSO is configured.</li>
</ul>
{{site.data.alerts.end}}

Expand All @@ -120,15 +120,15 @@ Qumulo Core supports three SAML SSO workflows:

1. The SSO portal redirects the user to the cluster's endpoint.

If the user has sufficient privileges, the Web UI logs the user in. Otherwise, the Web UI displays an error message.
If the user has sufficient privileges, the Qumulo Core Web UI logs the user in. Otherwise, the Qumulo Core Web UI displays an error message.

<a id="sp-inititated-sso-workflow"></a>
### SP-Initiated SSO Workflow
1. A user navigates to the Qumulo cluster's Web UI endpoint in a browser.

1. If the Qumulo cluster has SAML SSO configured, the user can click **Continue to SSO login** on the Web UI login page.
1. If the Qumulo cluster has SAML SSO configured, the user can click **Continue to SSO login** on the Qumulo Core Web UI login page.

The Web UI redirects the user to the configured SSO portal. Because the authentication request uses HTTP-Redirect Binding, the login URL appears.
the Qumulo Core Web UI redirects the user to the configured SSO portal. Because the authentication request uses HTTP-Redirect Binding, the login URL appears.

```
https://<my-org>.<sso-provider>.com/abc12de34fgAB5CDh6i7/saml?SAMLRequest=abcdefgh1234567890...
Expand Down Expand Up @@ -186,18 +186,18 @@ In Qumulo Core 5.3.0 (and higher), you can use the `qq saml_modify_settings` CLI
qq saml_modify_settings --require-sso true
```

When the cluster requires SSO authentication, your cluster rejects password-based authentication from AD users in the Web UI, the `qq` CLI, and the REST API.
When the cluster requires SSO authentication, your cluster rejects password-based authentication from AD users in the Qumulo Core Web UI, the `qq` CLI, and the REST API.


## Known Issues and Limitations
* Local users (the built-in `admin` user and any additional users) can always use their passwords to authenticate to the Web UI and the `qq` CLI.
* Local users (the built-in `admin` user and any additional users) can always use their passwords to authenticate to the Qumulo Core Web UI and the `qq` CLI.

{% include important.html content="We recommend setting a strong password for the built-in `admin` user and using this account only for emergencies." %}

* If SSO is required for a Qumulo cluster, it isn't possible to log in to the **Interactive API documentation** section of the **APIs & Tools** page in the Web UI.
* If SSO is required for a Qumulo cluster, it isn't possible to log in to the **Interactive API documentation** section of the **APIs & Tools** page in the Qumulo Core Web UI.

* Qumulo Core doesn't support:
* **SAML Single Logout (SLO):** We recommend clicking **Sign out** in the Web UI.
* **SAML Single Logout (SLO):** We recommend clicking **Sign out** in the Qumulo Core Web UI.
* **Automatic Configuration from Metadata XML:** You must specify each parameter by using the `qq` CLI.
* **Returning to Previous Web UI Page:** You can't return to a previous page after re-authenticating (for example, after a timeout).
* **Azure AD SAML Toolkit:** Currently, due to a configuration deficiency in the toolkit, IdP-initiated SSO isn't operational for Qumulo as a Service. Use the [SP-initiated SSO workflow](#sp-inititated-sso-workflow).
Expand All @@ -215,7 +215,7 @@ Typically, if SAML authentication fails, Qumulo Core's in-browser error message

* The `cluster-dns-name` or `idp-entity-id` on the Qumulo cluster aren't configured correctly.

* A user isn't a member of the Observers role that Qumulo Core requires for granting access to the Web UI.
* A user isn't a member of the Observers role that Qumulo Core requires for granting access to the Qumulo Core Web UI.

### Uncommon Issues
In more complex cases, the in-browser errors are less informative for security reasons. For example, if you configure an incorrect IdP certificate on your cluster, the **Signature validation failed. SAML Response rejected.** error appears.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

In Qumulo Core 5.3.0 (and higher), you can use _access tokens_ to let a user authenticate to the Qumulo REST API without having to complete repetitive login procedures.

Access tokens are long-lived. They provide an alternative to session-based authentication that the `qq login` command and the Web UI use. They also support support authentication for services, long-lived automation processes, and programmatic REST API access that doesn't require user input.
Access tokens are long-lived. They provide an alternative to session-based authentication that the `qq login` command and the Qumulo Core Web UI use. They also support support authentication for services, long-lived automation processes, and programmatic REST API access that doesn't require user input.

{{site.data.alerts.important}}
<ul>
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
## To Create a Directory Quota

1. Log in to the Web UI.
1. Log in to the Qumulo Core Web UI.

1. Click **Sharing > Quotas**.

Expand All @@ -17,7 +17,7 @@

## To Modify a Directory Quota

1. Log in to the Web UI.
1. Log in to the Qumulo Core Web UI.

1. Click **Sharing > Quotas**.

Expand All @@ -28,7 +28,7 @@

## To Delete a Directory Quota

1. Log in to the Web UI.
1. Log in to the Qumulo Core Web UI.

1. Click **Sharing > Quotas**.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ Unless you need direct access to a specific node through a DNS fully qualified d

1. Update the list of IP addresses for this host record. Include the IP addresses for all nodes.

To find the IP addresses in the Web UI, click **Cluster > Network Configuration**.
To find the IP addresses in the Qumulo Core Web UI, click **Cluster > Network Configuration**.

1. Configure the DNS resolver to point to the DNS server.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -46,9 +46,9 @@ To be able to use hostnames, you must:


## Adding a Host Access Rule to an Existing NFS Export
This section explains how you can add a host access rule to an existing NFS export by using the Web UI or the `qq` CLI.
This section explains how you can add a host access rule to an existing NFS export by using the Qumulo Core Web UI or the `qq` CLI.

### To Add a Host Access Rule by Using the Web UI
### To Add a Host Access Rule by Using the Qumulo Core Web UI

1. Log in to Qumulo Core.

Expand Down
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
<a id="create-nfs-export"></a>
## To Create an NFS Export

1. Log in to the Web UI.
1. Log in to the Qumulo Core Web UI.

1. Click **Sharing > NFS Exports**.

Expand Down Expand Up @@ -34,7 +34,7 @@

## To Modify an NFS Export

1. Log in to the Web UI.
1. Log in to the Qumulo Core Web UI.

1. Click **Sharing > NFS Exports**.

Expand All @@ -45,7 +45,7 @@

## To Delete an NFS Export

1. Log in to the Web UI.
1. Log in to the Qumulo Core Web UI.

1. Click **Sharing > NFS Exports**.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ The following privileges are required for continuous replication.
## To Create a Replication Relationship
{% include important.html content="A replication job doesn't begin until you authorize the relationship on the target cluster." %}

1. Log in to the Web UI on the source cluster.
1. Log in to the Qumulo Core Web UI on the source cluster.

1. Click **Cluster > Replication**.

Expand Down Expand Up @@ -77,7 +77,7 @@ The following privileges are required for continuous replication.
## To Authorize a Replication Relationship
{% include note.html content="If your cluster is currently in a blackout window or if continuous replication for the replication relationship is disabled, replication doesn't begin. For more information, see [Replication: Blackout Windows](https://care.qumulo.com/hc/en-us/articles/360019101513) on Qumulo Care." %}

1. Log in to the Web UI on the target cluster.
1. Log in to the Qumulo Core Web UI on the target cluster.

A notification banner informing you of a new relationship authorization request appears.

Expand All @@ -88,7 +88,7 @@ The following privileges are required for continuous replication.

## To View the Status of a Replication Relationship

1. Log in to the Web UI on the source cluster.
1. Log in to the Qumulo Core Web UI on the source cluster.

1. Click **Cluster > Replication**.

Expand Down Expand Up @@ -139,7 +139,7 @@ The following privileges are required for continuous replication.
## To Modify a Replication Relationship
{% include note.html content="It isn't possible to edit the source and target directory paths. To make these changes, you must create a new replication relationship." %}

1. Log in to the Web UI.
1. Log in to the Qumulo Core Web UI.

1. Click **Cluster > Replication**.

Expand All @@ -150,7 +150,7 @@ The following privileges are required for continuous replication.

## To Delete a Replication Relationship

1. Log in to the Web UI.
1. Log in to the Qumulo Core Web UI.

1. Click **Cluster > Replication**.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -130,7 +130,7 @@ This section describes how to use the Qumulo Core Web UI 4.2.5 (and higher) to c

1. In the **Create Copy from S3?** dialog box, review the Shift relationship and then click **Yes, Create**.

The copy job begins and Qumulo Core estimates the work to be performed. When the estimation is complete, the Web UI displays a progress bar with a percentage for a relationship on the **Replication Relationships** page. The page also displays the estimated total work, the remaining bytes and files, and the estimated time to completion for a running copy job.
The copy job begins and Qumulo Core estimates the work to be performed. When the estimation is complete, the Qumulo Core Web UI displays a progress bar with a percentage for a relationship on the **Replication Relationships** page. The page also displays the estimated total work, the remaining bytes and files, and the estimated time to completion for a running copy job.

{% include note.html content="For work estimates, Shift-From jobs calculate the total number of files and bytes in a job's bucket prefix. This requires the job to use the [`ListObjectV2` S3 action](https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html) once for every 5,000 objects (or 200 times for every 1 million objects)." %}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ For more information about copying objects from S3 to Qumulo, see [Using Qumulo
## Prerequisites
* A Qumulo cluster with:

* Qumulo Core 3.2.1 (and higher) for the CLI and 3.2.5 (and higher) for the Web UI
* Qumulo Core 3.2.1 (and higher) for the CLI and 3.2.5 (and higher) for the Qumulo Core Web UI

* HTTPS connectivity to `s3.<region>.amazonaws.com` though one of the following means:

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ The Qumulo Core S3 API accepts only HTTPS requests by default. To enable HTTPS s

Every Qumulo cluster is preconfigured with a self-signed SSL certificate. However, because certain applications don't accept the default certificate, we recommend installing your own.

For information about configuring HTTPS for your cluster, see [Installing the Web UI SSL Certificate](https://care.qumulo.com/hc/en-us/articles/17652500917779) on Qumulo Care.
For information about configuring HTTPS for your cluster, see [Installing the Qumulo Core Web UI SSL Certificate](https://care.qumulo.com/hc/en-us/articles/17652500917779) on Qumulo Care.

### Enabling and Disabling Plaintext HTTP Connections
{% include important.html content="If you configure the S3 API service to accept only plaintext HTTP connections, no requests made through the S3 API are encrypted." %}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -231,7 +231,7 @@ Send a `DELETE` request to the `/v1/s3/access-keys/<access-key-id>` Qumulo REST

For users that exist in an AD domain that has a trust relationship with the joined domain, you must append that domain's base DN to the base DN in your Qumulo cluster's AD configuration.

To append the trusted base DN to the base DN in use&mdash;with a semicolon (`;`) separating the two&mdash;use the Web UI or the `qq ad_reconfigure` command. For example:
To append the trusted base DN to the base DN in use&mdash;with a semicolon (`;`) separating the two&mdash;use the Qumulo Core Web UI or the `qq ad_reconfigure` command. For example:

```bash
$ qq ad_reconfigure \
Expand Down
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
<a id="create-smb-share"></a>
## To Create an SMB Share

1. Log in to the Web UI.
1. Log in to the Qumulo Core Web UI.

1. Click **Sharing > SMB Shares**.

Expand Down Expand Up @@ -42,7 +42,7 @@

## To Modify an SMB Share

1. Log in to the Web UI.
1. Log in to the Qumulo Core Web UI.

1. Click **Sharing > SMB Shares**.

Expand All @@ -53,7 +53,7 @@

## To Delete an SMB Share

1. Log in to the Web UI.
1. Log in to the Qumulo Core Web UI.

1. Click **Sharing > SMB Shares**.

Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
## Managing Snapshots by Using the Web UI
This section explains how to create on-demand snapshots and snapshot policies, view and search for existing snapshots, and delete snapshots by using the Web UI.
## Managing Snapshots by Using the Qumulo Core Web UI
This section explains how to create on-demand snapshots and snapshot policies, view and search for existing snapshots, and delete snapshots by using the Qumulo Core Web UI.

### To Create an On-Demand Snapshot
{{page.varLogin}}
Expand Down Expand Up @@ -146,7 +146,7 @@ qq snapshot_create_snapshot \
```

### Modifying a Snapshot's Expiration Time
Use the `qq snapshot_modify_snapshot` command and specify the snapshot ID from the **Saved Snapshots** page in the Web UI (for example, for the `1234567_replication_from_prod` snapshot, the ID is `1234567`).
Use the `qq snapshot_modify_snapshot` command and specify the snapshot ID from the **Saved Snapshots** page in the Qumulo Core Web UI (for example, for the `1234567_replication_from_prod` snapshot, the ID is `1234567`).

In the following example, the snapshot with ID `1234567` never expires.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -214,9 +214,9 @@ To avoid having to resynchronize your clusters after you reconnect the replicati

On clusters that run Qumulo Core 2.12.5 (and lower), this process requires additional time to resynchronize the clusters by running a full-tree scan after you reconnect the replication relationship.

1. To temporarily make the target relationship writable for the duration of the upgrade, use the **Make Target Writable** action in the Web UI.
1. To temporarily make the target relationship writable for the duration of the upgrade, use the **Make Target Writable** action in the Qumulo Core Web UI.

1. Wait for the upgrade to complete.

1. Use the **Reconnect Relationship** action in the Web UI.
1. Use the **Reconnect Relationship** action in the Qumulo Core Web UI.
{% endif %}
Original file line number Diff line number Diff line change
@@ -1,15 +1,15 @@
In Qumulo Core 5.1.0 (and higher), clusters have an optional _inactivity timeout_ that logs users out of the Web UI if they don't interact with it for a specified amount of time.
In Qumulo Core 5.1.0 (and higher), clusters have an optional _inactivity timeout_ that logs users out of the Qumulo Core Web UI if they don't interact with it for a specified amount of time.

{% include note.html content="During the final minute of the timeout period, the **Your Session is About to Expire** dialog box appears. The dialog box shows a countdown and lets the user renew the session or log out immediately. When deciding on the timeout length, take your users' needs into consideration." %}

## To Set the Web UI Inactivity Timeout
## To Set the Qumulo Core Web UI Inactivity Timeout
To set an inactivity timeout, use the `web_ui_modify_settings` command. Specify the timeout in minutes by using the `--inactivity-timeout` flag. For example:

```bash
qq web_ui_modify_settings --inactivity-timeout 15
```

## To Clear the Web UI Inactivity Timeout
## To Clear the Qumulo Core Web UI Inactivity Timeout
To clear an inactivity timeout, use the `web_ui_modify_settings` command with the `--disable-inactivity-timeout` flag.

```bash
Expand Down
6 changes: 3 additions & 3 deletions _includes/content-reuse/admin-guides/web-ui/login-banner.md
Original file line number Diff line number Diff line change
@@ -1,13 +1,13 @@
In Qumulo Core 5.2.1 (and higher), clusters have an optional login banner that users must acknowledge before being they can log in to the Web UI.
In Qumulo Core 5.2.1 (and higher), clusters have an optional login banner that users must acknowledge before being they can log in to the Qumulo Core Web UI.

## To Set the Web UI Login Banner
## To Set the Qumulo Core Web UI Login Banner
To set the login banner, use the `web_ui_modify_settings` command. To specify the Markdown file to use for the banner, use the `--login-banner` flag. For example:

```bash
qq web_ui_modify_settings --login-banner my-banner.html
```

## To Clear the Web UI Login Banner
## To Clear the Qumulo Core Web UI Login Banner
To clear the login banner, use the `web_ui_modify_settings` command with the `--disable-login-banner` flag.

```bash
Expand Down
Loading

0 comments on commit 78f6a5e

Please sign in to comment.