CQA for authentication

Author: jc-berger

authentication/assuming-an-aws-iam-role-for-a-service-account.adoc

@@ -1,6 +1,6 @@
 :_mod-docs-content-type: ASSEMBLY
 [id="assuming-an-aws-iam-role-for-a-service-account"]
-= Assuming an AWS IAM role for a service account
+= Assume an AWS IAM role for a service account
 
 include::_attributes/common-attributes.adoc[]
 ifdef::openshift-rosa,openshift-dedicated,openshift-rosa-hcp[]
@@ -34,7 +34,7 @@ include::modules/deploying-a-pod-that-includes-an-aws-sdk.adoc[leveloffset=+2]
 include::modules/verifying-the-assumed-iam-role-in-your-pod.adoc[leveloffset=+2]
 
 [role="_additional-resources"]
-[id="additional-resources_configuring-alert-notifications"]
+[id="additional-resources_assuming-an-aws-iam-role-for-a-service-account"]
 == Additional resources
 
 * link:https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html[AWS documentation on IAM roles for service accounts]

authentication/osd-admin-roles.adoc

@@ -1,6 +1,6 @@
 :_mod-docs-content-type: ASSEMBLY
 [id="osd-admin-roles"]
-= Managing administration roles and users
+= Manage administration roles and users
 include::_attributes/attributes-openshift-dedicated.adoc[]
 
 :context: osd-admin-roles

authentication/osd-revoking-cluster-privileges.adoc

@@ -1,6 +1,6 @@
 :_mod-docs-content-type: ASSEMBLY
 [id="osd-revoking-cluster-privileges"]
-= Revoking privileges and access to an {product-title} cluster
+= Revoke privileges and access to an {product-title} cluster
 
 include::_attributes/attributes-openshift-dedicated.adoc[]
 :context: osd-revoking-cluster-privileges

authentication/sd-configuring-identity-providers.adoc

@@ -26,7 +26,7 @@ include::modules/config-htpasswd-idp-webui.adoc[leveloffset=+2]
 include::modules/config-htpasswd-idp-from-file.adoc[leveloffset=+2]
 ifdef::openshift-rosa-hcp,openshift-rosa[]
 include::modules/rosa-config-htpasswd-idp-cli.adoc[leveloffset=+2]
-include::modules/rosa-config-htpasswd-idp-cli-file.adoc[leveloffset=+3]
+include::modules/rosa-config-htpasswd-idp-cli-file.adoc[leveloffset=+2]
 include::modules/config-htpasswd-idp-terraform.adoc[leveloffset=+2]
 endif::openshift-rosa-hcp,openshift-rosa[]
 ifdef::openshift-dedicated[]
@@ -43,5 +43,5 @@ ifdef::openshift-rosa[]
 * xref:../rosa_getting_started/rosa-sts-getting-started-workflow.adoc#rosa-sts-understanding-the-deployment-workflow[Understanding the ROSA with STS deployment workflow]
 endif::openshift-rosa[]
 * link:https://httpd.apache.org/docs/current/misc/password_encryptions.html[Apache Password Formats]
-* link:https://developers.google.com/identity/protocols/OpenIDConnect[Google's OpenID Connect integration]
-* link:http://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth[Authorization Code Flow]
+* link:https://developers.google.com/identity/protocols/OpenIDConnect[Google OpenID Connect integration]
+* link:https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth[Authorization Code Flow]

modules/assuming-an-aws-iam-role-in-your-own-pods.adoc

@@ -4,7 +4,7 @@
 
 :_mod-docs-content-type: CONCEPT
 [id="assuming-an-aws-iam-role-in-your-own-pods_{context}"]
-= Assuming an AWS IAM role in your own pods
+= Assume an AWS IAM role in your own pods
 
 [role="_abstract"]
 You can enable a service account to assume an AWS Identity and Access Management (IAM) role in a pod deployed in a user-defined project.

modules/config-github-idp.adoc

@@ -5,10 +5,10 @@
 
 :_mod-docs-content-type: PROCEDURE
 [id="config-github-idp_{context}"]
-= Configuring a GitHub identity provider
+= Configure a GitHub identity provider
 
 [role="_abstract"]
-Configure a GitHub identity provider to validate user names and passwords against GitHub or GitHub Enterprise's OAuth authentication server and access your {product-title} cluster. OAuth facilitates a token exchange flow between {product-title} and GitHub or GitHub Enterprise.
+Configure a GitHub identity provider to validate user names and passwords against the GitHub or GitHub Enterprise OAuth authentication server and access your {product-title} cluster. OAuth facilitates a token exchange flow between {product-title} and GitHub or GitHub Enterprise.
 
 [WARNING]
 ====
@@ -17,7 +17,7 @@ Configuring GitHub authentication allows users to log in to {product-title} with
 
 .Prerequisites
 
-* The OAuth application must be created directly within the GitHub link:https://docs.github.com/en/github/setting-up-and-managing-organizations-and-teams/managing-organization-settings[organization settings] by the GitHub organization administrator.
+* The OAuth application is created directly within the GitHub link:https://docs.github.com/en/github/setting-up-and-managing-organizations-and-teams/managing-organization-settings[organization settings] by the GitHub organization administrator.
 * link:https://docs.github.com/en/github/setting-up-and-managing-organizations-and-teams[GitHub organizations or teams] are set up in your GitHub account.
 
 .Procedure
@@ -30,13 +30,13 @@ Configuring GitHub authentication allows users to log in to {product-title} with
 +
 [NOTE]
 ====
-You can also click the *Add Oauth configuration* link in the warning message displayed after cluster creation to configure your identity providers.
+You can also click the *Add OAuth configuration* link in the warning message displayed after cluster creation to configure your identity providers.
 ====
 
 . Select *GitHub* from the drop-down menu.
 
 . Enter a unique name for the identity provider. This name cannot be changed later.
-** An *OAuth callback URL* is automatically generated in the provided field. You will use this to register the GitHub application.
+** An *OAuth callback URL* is automatically generated in the provided field. Use this to register the GitHub application.
 +
 ----
 https://oauth-openshift.apps.<cluster_name>.<cluster_domain>/oauth2callback/<idp_provider_name>

modules/config-gitlab-idp.adoc

@@ -5,14 +5,14 @@
 
 :_mod-docs-content-type: PROCEDURE
 [id="config-gitlab-idp_{context}"]
-= Configuring a GitLab identity provider
+= Configure a GitLab identity provider
 
 [role="_abstract"]
-Configure a GitLab identity provider to use link:https://gitlab.com/[GitLab.com] or any other GitLab instance as an identity provider.
+Configure a GitLab identity provider to use GitLab.com or any other GitLab instance as an identity provider so that users can log in to your cluster with their GitLab credentials.
 
 .Prerequisites
 
-- If you use GitLab version 7.7.0 to 11.0, you connect using the link:http://doc.gitlab.com/ce/integration/oauth_provider.html[OAuth integration]. If you use GitLab version 11.1 or later, you can use link:https://docs.gitlab.com/ce/integration/openid_connect_provider.html[OpenID Connect] (OIDC) to connect instead of OAuth.
+* If you use GitLab version 7.7.0 to 11.0, you connect using the link:https://docs.gitlab.com/ee/integration/oauth_provider.html[OAuth integration]. If you use GitLab version 11.1 or later, you can use link:https://docs.gitlab.com/ee/integration/openid_connect_provider.html[OpenID Connect] (OIDC) to connect instead of OAuth.
 
 .Procedure
 
@@ -24,13 +24,13 @@ Configure a GitLab identity provider to use link:https://gitlab.com/[GitLab.com]
 +
 [NOTE]
 ====
-You can also click the *Add Oauth configuration* link in the warning message displayed after cluster creation to configure your identity providers.
+You can also click the *Add OAuth configuration* link in the warning message displayed after cluster creation to configure your identity providers.
 ====
 
 . Select *GitLab* from the drop-down menu.
 
 . Enter a unique name for the identity provider. This name cannot be changed later.
-** An *OAuth callback URL* is automatically generated in the provided field. You will provide this URL to GitLab.
+** An *OAuth callback URL* is automatically generated in the provided field. Provide this URL to GitLab.
 +
 ifndef::openshift-rosa-hcp[]
 ----

modules/config-google-idp.adoc

@@ -5,15 +5,14 @@
 
 :_mod-docs-content-type: PROCEDURE
 [id="config-google-idp_{context}"]
-= Configuring a Google identity provider
+= Configure a Google identity provider
 
 [role="_abstract"]
 Configure a Google identity provider to allow users to authenticate with their Google credentials.
 
 [WARNING]
 ====
-Using Google as an identity provider allows any Google user to authenticate to your server.
-You can limit authentication to members of a specific hosted domain with the
+Using Google as an identity provider allows any Google user to authenticate to your server. You can limit authentication to members of a specific hosted domain with the
 `hostedDomain` configuration attribute.
 ====
 
@@ -27,13 +26,13 @@ You can limit authentication to members of a specific hosted domain with the
 +
 [NOTE]
 ====
-You can also click the *Add Oauth configuration* link in the warning message displayed after cluster creation to configure your identity providers.
+You can also click the *Add OAuth configuration* link in the warning message displayed after cluster creation to configure your identity providers.
 ====
 
 . Select *Google* from the drop-down menu.
 
 . Enter a unique name for the identity provider. This name cannot be changed later.
-** An *OAuth callback URL* is automatically generated in the provided field. You will provide this URL to Google.
+** An *OAuth callback URL* is automatically generated in the provided field. Provide this URL to Google.
 +
 ifndef::openshift-rosa-hcp[]
 ----
@@ -52,7 +51,7 @@ For example:
 https://oauth-openshift.apps.openshift-cluster.example.com/oauth2callback/google
 ----
 
-. Configure a Google identity provider using link:https://developers.google.com/identity/protocols/OpenIDConnect[Google's OpenID Connect integration].
+. Configure a Google identity provider using link:https://developers.google.com/identity/protocols/OpenIDConnect[Google OpenID Connect integration].
 
 . Return to {product-title} and select a mapping method from the drop-down menu. *Claim* is recommended in most cases.
 

modules/config-htpasswd-idp-terraform.adoc

@@ -9,7 +9,7 @@ ifeval::["{context}" == "rosa-hcp-creating-a-cluster-quickly-terraform"]
 endif::[]
 
 [id="config-htpasswd-idp-terraform_{context}"]
-= Configuring an htpasswd identity provider with Terraform
+= Configure an htpasswd identity provider with Terraform
 
 ifdef::tf-config[]
 [role="_abstract"]
@@ -112,7 +112,7 @@ $ cat<<-EOF>htpasswd_idp.tf
 EOF
 ----
 +
-You must replace the `<cluster_id>` placeholder with the 32-digit ID for your cluster. To find that value, run `rosa list clusters | awk '{print $1}'`. You also must replace the `<user_name>` placeholder with the username you want to create as well as a password for the `<password>` placeholder.
+You must replace the `<cluster_id>` placeholder with the 32-digit ID for your cluster. To find that value, run `rosa list clusters | awk '{print $1}'`. You also must replace the `<user_name>` placeholder with the username you want to create and a password for the `<password>` placeholder.
 
 . Run the following command to configure Terraform to create your resources based on your Terraform files:
 +

modules/config-ldap-idp.adoc

@@ -5,15 +5,14 @@
 
 :_mod-docs-content-type: PROCEDURE
 [id="config-ldap-idp_{context}"]
-= Configuring a LDAP identity provider
+= Configure a LDAP identity provider
 
 [role="_abstract"]
 Configure the LDAP identity provider to validate user names and passwords against an LDAPv3 server, using simple bind authentication.
 
 .Prerequisites
 
-* When configuring a LDAP identity provider, you will need to enter a configured *LDAP URL*. The configured URL is an RFC 2255 URL, which specifies the LDAP host and
-search parameters to use. The syntax of the URL is:
+* When configuring a LDAP identity provider, you need to enter a configured *LDAP URL*. The configured URL is an RFC 2255 URL, which specifies the LDAP host and search parameters to use. The syntax of the URL is:
 +
 ----
 ldap://host:port/basedn?attribute?scope?filter
@@ -26,22 +25,13 @@ ldap://host:port/basedn?attribute?scope?filter
 (LDAPS), use `ldaps` instead.
 .^|`host:port` | The name and port of the LDAP server. Defaults to
 `localhost:389` for ldap and `localhost:636` for LDAPS.
-.^|`basedn`    | The DN of the branch of the directory where all searches should
-start from. At the very least, this must be the top of your directory tree, but
-it could also specify a subtree in the directory.
-.^|`attribute` | The attribute to search for. Although RFC 2255 allows a
-comma-separated list of attributes, only the first attribute will be used, no
-matter how many are provided. If no attributes are provided, the default is to
-use `uid`. It is recommended to choose an attribute that will be unique across
-all entries in the subtree you will be using.
-.^|`scope`     | The scope of the search. Can be either `one` or `sub`.
-If the scope is not provided, the default is to use a scope of `sub`.
-.^|`filter`    | A valid LDAP search filter. If not provided, defaults to
-`(objectClass=*)`
+.^|`basedn`    | The DN of the branch of the directory where all searches should start from. At the very least, this must be the top of your directory tree, but it could also specify a subtree in the directory.
+.^|`attribute` | The attribute to search for. Although RFC 2255 allows a comma-separated list of attributes, only the first attribute is used, no matter how many are provided. If no attributes are provided, the default is to use `uid`. Choose an attribute that is unique across all entries in the subtree you are using.
+.^|`scope`     | The scope of the search. Can be either `one` or `sub`. If the scope is not provided, the default is to use a scope of `sub`.
+.^|`filter`    | A valid LDAP search filter. If not provided, defaults to `(objectClass=*)`
 |===
 +
-When doing searches, the attribute, filter, and provided user name are combined
-to create a search filter that looks like:
+When doing searches, the attribute, filter, and provided user name are combined to create a search filter that looks like:
 +
 ----
 (&(<filter>)(<attribute>=<username>))
@@ -62,7 +52,7 @@ If the LDAP directory requires authentication to search, specify a `bindDN` and
 +
 [NOTE]
 ====
-You can also click the *Add Oauth configuration* link in the warning message displayed after cluster creation to configure your identity providers.
+You can also click the *Add OAuth configuration* link in the warning message displayed after cluster creation to configure your identity providers.
 ====
 
 . Select *LDAP* from the drop-down menu.
@@ -80,7 +70,7 @@ You can also click the *Add Oauth configuration* link in the warning message dis
 ** Optional: Enter a *Preferred username* attribute whose value should be used as the display name. Click *Add more* to add multiple preferred username attributes.
 ** Optional: Enter an *Email* attribute whose value should be used as the email address. Click *Add more* to add multiple email attributes.
 
-. Optional: Click *Show advanced Options* to add a certificate authority (CA) file to your LDAP identity provider to validate server certificates for the configured URL. Click *Browse* to locate and attach a *CA file* to the identity provider.
+. Optional: Click *Show advanced options* to add a certificate authority (CA) file to your LDAP identity provider to validate server certificates for the configured URL. Click *Browse* to locate and attach a *CA file* to the identity provider.
 
 . Optional: Under the advanced options, you can choose to make the LDAP provider *Insecure*. If you select this option, a CA file cannot be used.
 +