Rancher OIDC scope docs

[rb3ckers]

Document Rancher OIDC scope configuration, upgrade ordering, and known authentication issues, including the latest troubleshooting updates.

Tracks https://github.com/StackVista/helm-charts-internal/issues/233 and accompanies https://github.com/StackVista/helm-charts-internal/pull/236. Replaces #432 using a branch in this repository; targets staging.

Validation: English link syntax and navigation checks passed.

[netlify]

✅ Deploy Preview for suse-obs ready!

Name	Link
🔨 Latest commit	b8972ed
🔍 Latest deploy log	https://app.netlify.com/projects/suse-obs/deploys/6ab61e2789b3260008933c3e
😎 Deploy Preview	https://deploy-preview-433--suse-obs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[LouisLotter]

Four findings from the review:

• P2 — Preserve session lifetime (troubleshooting.adoc:55). Switching from rancher to generic oidc changes the default from 16 hours to seven days, confirmed with a focused render of the template from #236. Set stackstate.authentication.sessionLifetime: 16h when no explicit value exists; retain custom values.
• P2 — Preserve provider settings (troubleshooting.adoc:49). The replacement example drops custom redirect URIs, logout options and custom parameters. A registered custom callback can then fail login. Carry over the preservation instructions from Document Rancher group permissions workaround #434.
• P3 — Repair list continuations (oidc.adoc:118–128). In the deploy preview, the final upgrade steps render as a literal block, including an unsubstituted {next-release-version}. Add AsciiDoc continuations around the patch example and following paragraph so the list resumes correctly.
• P3 — Fix both troubleshooting anchors (oidc.adoc:18,80). Use _known_issues; the current _known-issues does not match the generated heading. Document Rancher group permissions workaround #434 already uses the correct fragment.

Validation: source review, focused authentication-template rendering and the docs preview. No live Rancher login test.

[rb3ckers]

Adding the session lifetime, but I have no clue why I would be adding a custom redirect uri. That only makes sense if someone had that for Rancher. I'll only add a line saying to take any of the other custom Rancher settings and copy them over (although I don't expect anyone to have any custom settings at all).

For the P3s: adoc is hard 😢