docs: LDAP service account setup (#8875)

* updating docs with service account tutorial * minor corrections * Apply suggestions from code review Co-authored-by: Zac Bergquist <[email protected]> * wording changes based on CR * minor changes and fixes and adds updated photos with new naming convention * Updating documentation * updating gpo instructions to actually make sense * nits * adding instructions for exporting ca * removing unhelpful screen shot * Fixes quotes and updates to LDAPS Co-authored-by: Ben Arent <[email protected]> * clarifying comment Co-authored-by: Zac Bergquist <[email protected]> Co-authored-by: Ben Arent <[email protected]>
gravitational · Nov 19, 2021 · f44561d · f44561d
1 parent e8de91c
commit f44561d
Show file tree

Hide file tree

Showing 8 changed files with 267 additions and 73 deletions.
diff --git a/docs/img/desktop-access/ad-new-user.png b/docs/img/desktop-access/ad-new-user.png
diff --git a/docs/img/desktop-access/apply-gpo.png b/docs/img/desktop-access/apply-gpo.png
diff --git a/docs/img/desktop-access/create-and-link-gpo.png b/docs/img/desktop-access/create-and-link-gpo.png
diff --git a/docs/img/desktop-access/deny-interactive-login.png b/docs/img/desktop-access/deny-interactive-login.png
diff --git a/docs/img/desktop-access/remove-authenticated.png b/docs/img/desktop-access/remove-authenticated.png
diff --git a/docs/img/desktop-access/select-desktop.png b/docs/img/desktop-access/select-desktop.png
diff --git a/docs/pages/desktop-access/getting-started.mdx b/docs/pages/desktop-access/getting-started.mdx
diff --git a/docs/pages/desktop-access/reference.mdx b/docs/pages/desktop-access/reference.mdx
@@ -91,10 +91,16 @@ spec:
       environment: ["dev", "stage"]
     
     # Windows user accounts this role can connect as.
-    windows_desktop_logins: ["Administrator"]
+    windows_desktop_logins: ["Administrator", "{{internal.windows_logins}}"]
 ```
 
-It is possible to use wildcards to match all desktop labels.
+It is possible to use wildcards (`"*"`) to match all desktop labels.
+
+Like with SSH access, the `windows_desktop_logins` field supports the special `{{internal.windows_logins}}` variable 
+for local users which will map to any logins that are supplied when the user is created with
+`tctl users add alice --windows-logins=Administrator,DBUser`.
+
+For new clusters, the `"access"` role will have `windows_desktop_logins: ["{{internal.windows_logins}}"]` set by default.
 
 ## CLI