<commit_before>---
title: UAA Integration
---

<p class="note">Note: This feature is available with bosh-release v209+ (1.3088.0) colocated with uaa v1+.</p>

In this configuration the Director is configured to delegate user management to the [UAA](https://github.com/cloudfoundry/uaa) server. The UAA server can be configured to manage its own list of users or work with an LDAP server, or a SAML provider. Regardless how the UAA server is configured the BOSH CLI will ask appropriate credentials and forward them to the UAA to request a token.

---
## <a id="configure"></a> Configuring the Director

1. Change deployment manifest for the Director and add UAA release:

    ```yaml
    releases:
    - name: bosh
      url: https://bosh.io/d/github.com/cloudfoundry/bosh?v=209
      sha1: a96833b6c68abda5aaa5d05ebdd0a5d394e6c15f
    # ...
    - name: uaa # <---
      url: https://bosh.io/d/github.com/cloudfoundry/uaa-release?v=1
      sha1: 477289da17ffe105d0b6bde1bc10f61b1cb50fb4
    ```

1. Colocate UAA next to the Director:

    ```yaml
    jobs:
    - name: bosh
      instances: 1
      templates:
      - {name: nats, release: bosh}
      - {name: redis, release: bosh}
      - {name: postgres, release: bosh}
      - {name: blobstore, release: bosh}
      - {name: director, release: bosh}
      - {name: health_monitor, release: bosh}
      - {name: uaa, release: uaa} # <---
      resource_pool: default
      # ...
    ```

1. Add `uaa` section to the deployment manifest:

    ```yaml
    properties:
      uaa:
        url: "https://172.16.58.3:8443"

        scim:
          users:
          - admin|admin-password|scim.write,scim.read,bosh.admin

        clients:
          bosh_cli:
            override: true
            authorized-grant-types: password,refresh_token
            # scopes the client may receive
            scope: openid,bosh.admin,bosh.read,bosh.*.admin,bosh.*.read
            authorities: uaa.none
            access-token-validity: 60 # 1 min
            refresh-token-validity: 86400 # re-login required once a day
            secret: ""

        admin: {client_secret: admin-password}
        login: {client_secret: login-password}
        zones: {internal: {hostnames: []}}
    ```

    To configure UAA to use LDAP, SAML, etc. see [uaa release job properties](http://bosh.io/jobs/uaa?source=github.com/cloudfoundry/uaa-release&version=1).

1. Configure the Director Postgres server to have an additional database called `uaa`:

    ```yaml
    properties:
      postgres: &db
        host: 127.0.0.1
        port: 5432
        user: postgres
        password: <PASSWORD>
        database: bosh
        additional_databases: [uaa] # <---
        adapter: postgres
    ```<commit_msg>always point to latest uaa<commit_after>---
title: UAA Integration
---

<p class="note">Note: This feature is available with bosh-release v209+ (1.3088.0) colocated with uaa v1+.</p>

In this configuration the Director is configured to delegate user management to the [UAA](https://github.com/cloudfoundry/uaa) server. The UAA server can be configured to manage its own list of users or work with an LDAP server, or a SAML provider. Regardless how the UAA server is configured the BOSH CLI will ask appropriate credentials and forward them to the UAA to request a token.

---
## <a id="configure"></a> Configuring the Director

1. Change deployment manifest for the Director and add UAA release:

    ```yaml
    releases:
    - name: bosh
      url: https://bosh.io/d/github.com/cloudfoundry/bosh?v=209
      sha1: a96833b6c68abda5aaa5d05ebdd0a5d394e6c15f
    # ...
    - name: uaa # <---
      url: https://bosh.io/d/github.com/cloudfoundry/uaa-release?v=1
      sha1: 477289da17ffe105d0b6bde1bc10f61b1cb50fb4
    ```

1. Colocate UAA next to the Director:

    ```yaml
    jobs:
    - name: bosh
      instances: 1
      templates:
      - {name: nats, release: bosh}
      - {name: redis, release: bosh}
      - {name: postgres, release: bosh}
      - {name: blobstore, release: bosh}
      - {name: director, release: bosh}
      - {name: health_monitor, release: bosh}
      - {name: uaa, release: uaa} # <---
      resource_pool: default
      # ...
    ```

1. Add `uaa` section to the deployment manifest:

    ```yaml
    properties:
      uaa:
        url: "https://172.16.58.3:8443"

        scim:
          users:
          - admin|admin-password|scim.write,scim.read,bosh.admin

        clients:
          bosh_cli:
            override: true
            authorized-grant-types: password,refresh_token
            # scopes the client may receive
            scope: openid,bosh.admin,bosh.read,bosh.*.admin,bosh.*.read
            authorities: uaa.none
            access-token-validity: 60 # 1 min
            refresh-token-validity: 86400 # re-login required once a day
            secret: ""

        admin: {client_secret: admin-password}
        login: {client_secret: login-password}
        zones: {internal: {hostnames: []}}
    ```

    To configure UAA to use LDAP, SAML, etc. see [uaa release job properties](http://bosh.io/jobs/uaa?source=github.com/cloudfoundry/uaa-release).

1. Configure the Director Postgres server to have an additional database called `uaa`:

    ```yaml
    properties:
      postgres: &db
        host: 127.0.0.1
        port: 5432
        user: postgres
        password: <PASSWORD>
        database: bosh
        additional_databases: [uaa] # <---
        adapter: postgres
    ```
{'fraction_non_alphanumeric': 0.11275855756910122, 'fraction_numerical': 0.03423027640490573, 'mean_word_length': 2.3790970933828075, 'pattern_counts': {'":': 0, '<': 19, '<?xml version=': 0, '>': 13, 'https://': 8, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 4, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4126711', 'n_tokens_mistral': 1856, 'n_tokens_neox': 1739, 'n_words': 504}