From 39779f51dcda8e6c3a4bd6f7d01e5143f894b956 Mon Sep 17 00:00:00 2001 From: William Mantly Date: Thu, 23 Jul 2026 16:18:31 -0400 Subject: [PATCH] docs: cross-link the SSH jump host as a directory consumer MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - directory.md: new "Consumers of the directory" section explaining how the jump host reads the inventory (groups x host resources) to route SSH, and pointing at directory_spec.md §9 for planned consumers - index.md: mention the jump host under Directory & Inventory and in Related projects Co-Authored-By: Claude Opus 4.8 --- docs/directory.md | 8 ++++++++ docs/index.md | 4 +++- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/docs/directory.md b/docs/directory.md index 92f230f..397efea 100644 --- a/docs/directory.md +++ b/docs/directory.md @@ -87,6 +87,14 @@ The seed is idempotent and non-destructive: a resource whose slug already exists The `ldap-client` join script enrolls a Debian/Ubuntu machine for LDAP login (SSSD/PAM), LDAP-backed `sudo`, and SSH keys from the directory — and, when given an SSO API token, registers the machine as a `host_` resource with its IP, MAC, OS, and kernel, parented to the site named by its configured location. +## Consumers of the directory + +The inventory graph isn't just documentation — other components read it to make decisions: + +- **[Jump Host](https://theta42.github.io/jump-host/)** — an SSH jump host that resolves which downstream machines a user may reach from their LDAP groups × the directory's `host` resources (`GET /api/discovery/resources?group=`), then bridges them in. The `host_` slugs and `host__access` groups this directory creates are exactly what it keys off; a host's `metadata.ip` / `metadata.sshPort` tell it where to connect. So a machine registered here (by theta-env or ldap-client) becomes reachable through the jump host the moment a user is in its access group. + +Planned consumers (end-user catalog, firewall/DNS generation) and the model/API gaps they need are tracked in [`directory_spec.md`](https://github.com/theta42/sso-manager-node/blob/master/directory_spec.md) §9. + ## API All of the above uses the same admin API the UI does (group `app_sso_directory_admin` or `app_sso_admin`): diff --git a/docs/index.md b/docs/index.md index b78bf01..5ae11ed 100644 --- a/docs/index.md +++ b/docs/index.md @@ -58,7 +58,7 @@ backend, that's the niche. - **All-in-one Docker image** — app + OpenLDAP + Redis in one container, or run the pieces separately via `app_*` env config. - **Geo-Location Scaling** — built-in support for N-Way Multi-Master OpenLDAP [replication](replication.html) across physical sites. -- **[Directory & Inventory](directory.html)** — map sites, hosts, and services as a graph with rich metadata (IP/MAC, OS/kernel, ports, git repos), auto-provisioned access groups, and automatic registration from theta-env and ldap-client. +- **[Directory & Inventory](directory.html)** — map sites, hosts, and services as a graph with rich metadata (IP/MAC, OS/kernel, ports, git repos), auto-provisioned access groups, and automatic registration from theta-env and ldap-client. Drives directory-aware tools like the [SSH jump host](https://theta42.github.io/jump-host/). ## Get it @@ -78,5 +78,7 @@ That's the standalone quick start. For the full set of install options - **[Proxy](https://theta42.github.io/proxy/)** — an OIDC + LDAP-aware reverse proxy, designed to sit in front of this SSO. +- **[Jump Host](https://theta42.github.io/jump-host/)** — an SSH jump host that + uses this SSO's directory to decide who may reach which machine. - **[theta-env](https://theta42.github.io/theta-env/)** — runs this SSO Manager and the proxy together with one command.