Skip to content

Commit 96f414f

Browse files
bergerhofferbergerhoffer
authored
Merge pull request #36040 from bergerhoffer/OSDOCS-1856
OSDOCS-1856: Adding docs for automatically syncing LDAP groups
2 parents 9a66cca + 44cacb7 commit 96f414f

File tree

2 files changed

+233
-3
lines changed

2 files changed

+233
-3
lines changed

‎authentication/ldap-syncing.adoc‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,10 @@ include::modules/common-attributes.adoc[]
66
toc::[]
77

88
ifdef::openshift-enterprise,openshift-webscale,openshift-origin[]
9-
As an administrator,
9+
As an administrator,
1010
endif::[]
1111
ifdef::openshift-dedicated[]
12-
As a xref:../authentication/understanding-and-creating-service-accounts.html#dedicated-admin-role-overview_{context}[dedicated administrator],
12+
As a xref:../authentication/understanding-and-creating-service-accounts.html#dedicated-admin-role-overview_{context}[dedicated administrator],
1313
endif::[]
1414
you can use groups to manage users, change
1515
their permissions, and enhance collaboration. Your organization may have already
@@ -19,7 +19,7 @@ your groups in one place. {product-title} currently supports group sync with
1919
LDAP servers using three common schemas for defining group membership: RFC 2307,
2020
Active Directory, and augmented Active Directory.
2121

22-
For more information on configuring LDAP, see
22+
For more information on configuring LDAP, see
2323
xref:../authentication/identity_providers/configuring-ldap-identity-provider.adoc#configuring-ldap-identity-provider[Configuring an LDAP identity provider].
2424

2525
ifdef::openshift-enterprise,openshift-webscale,openshift-origin[]
@@ -45,6 +45,15 @@ include::modules/ldap-syncing-running-all-ldap.adoc[leveloffset=+2]
4545
include::modules/ldap-syncing-running-openshift.adoc[leveloffset=+2]
4646
include::modules/ldap-syncing-running-subset.adoc[leveloffset=+2]
4747
include::modules/ldap-syncing-pruning.adoc[leveloffset=+1]
48+
49+
// Automatically syncing LDAP groups
50+
include::modules/ldap-auto-syncing.adoc[leveloffset=+1]
51+
52+
.Additional resources
53+
54+
* xref:../authentication/identity_providers/configuring-ldap-identity-provider.adoc#configuring-ldap-identity-provider[Configuring an LDAP identity provider]
55+
* xref:../nodes/jobs/nodes-nodes-jobs.adoc#nodes-nodes-jobs-creating-cron_nodes-nodes-jobs[Creating cron jobs]
56+
4857
include::modules/ldap-syncing-examples.adoc[leveloffset=+1]
4958
include::modules/ldap-syncing-rfc2307.adoc[leveloffset=+2]
5059
include::modules/ldap-syncing-rfc2307-user-defined.adoc[leveloffset=+2]

‎modules/ldap-auto-syncing.adoc‎

Lines changed: 221 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,221 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * authentication/ldap-syncing.adoc
4+
5+
[id="ldap-auto-syncing_{context}"]
6+
= Automatically syncing LDAP groups
7+
8+
You can automatically sync LDAP groups on a periodic basis by configuring a cron job.
9+
10+
.Prerequisites
11+
12+
* You have access to the cluster as a user with the `cluster-admin` role.
13+
* You have configured an LDAP identity provider (IDP).
14+
+
15+
This procedure assumes that you created an LDAP secret named `ldap-secret` and a config map named `ca-config-map`.
16+
17+
.Procedure
18+
19+
. Create a project where the cron job will run:
20+
+
21+
[source,terminal]
22+
----
23+
$ oc new-project ldap-sync <1>
24+
----
25+
<1> This procedure uses a project called `ldap-sync`.
26+
27+
. Locate the secret and config map that you created when configuring the LDAP identity provider and copy them to this new project.
28+
+
29+
The secret and config map exist in the `openshift-config` project and must be copied to the new `ldap-sync` project.
30+
31+
. Define a service account:
32+
+
33+
.Example `ldap-sync-service-account.yaml`
34+
[source,yaml]
35+
----
36+
kind: ServiceAccount
37+
apiVersion: v1
38+
metadata:
39+
name: ldap-group-syncer
40+
namespace: ldap-sync
41+
----
42+
43+
. Create the service account:
44+
+
45+
[source,terminal]
46+
----
47+
$ oc create -f ldap-sync-service-account.yaml
48+
----
49+
50+
. Define a cluster role:
51+
+
52+
.Example `ldap-sync-cluster-role.yaml`
53+
[source,yaml]
54+
----
55+
apiVersion: rbac.authorization.k8s.io/v1
56+
kind: ClusterRole
57+
metadata:
58+
name: ldap-group-syncer
59+
rules:
60+
- apiGroups:
61+
- ''
62+
- user.openshift.io
63+
resources:
64+
- groups
65+
verbs:
66+
- get
67+
- list
68+
- create
69+
- update
70+
----
71+
72+
. Create the cluster role:
73+
+
74+
[source,terminal]
75+
----
76+
$ oc create -f ldap-sync-cluster-role.yaml
77+
----
78+
79+
. Define a cluster role binding to bind the cluster role to the service account:
80+
+
81+
.Example `ldap-sync-cluster-role-binding.yaml`
82+
[source,yaml]
83+
----
84+
kind: ClusterRoleBinding
85+
apiVersion: rbac.authorization.k8s.io/v1
86+
metadata:
87+
name: ldap-group-syncer
88+
subjects:
89+
- kind: ServiceAccount
90+
name: ldap-group-syncer <1>
91+
namespace: ldap-sync
92+
roleRef:
93+
apiGroup: rbac.authorization.k8s.io
94+
kind: ClusterRole
95+
name: ldap-group-syncer <2>
96+
----
97+
<1> Reference to the service account created earlier in this procedure.
98+
<2> Reference to the cluster role created earlier in this procedure.
99+
100+
. Create the cluster role binding:
101+
+
102+
[source,terminal]
103+
----
104+
$ oc create -f ldap-sync-cluster-role-binding.yaml
105+
----
106+
107+
. Define a config map that specifies the sync configuration file:
108+
+
109+
.Example `ldap-sync-config-map.yaml`
110+
[source,yaml]
111+
----
112+
kind: ConfigMap
113+
apiVersion: v1
114+
metadata:
115+
name: ldap-group-syncer
116+
namespace: ldap-sync
117+
data:
118+
ldap-group-sync.yaml: | <1>
119+
kind: LDAPSyncConfig
120+
apiVersion: v1
121+
url: ldaps://10.0.0.0:389 <2>
122+
insecure: false
123+
bindDN: cn=admin,dc=example,dc=com <3>
124+
bindPassword:
125+
file: "/etc/secrets/bindPassword"
126+
ca: /etc/ldap-ca/ca.crt
127+
rfc2307: <4>
128+
groupsQuery:
129+
baseDN: "ou=groups,dc=example,dc=com" <5>
130+
scope: sub
131+
filter: "(objectClass=groupOfMembers)"
132+
derefAliases: never
133+
pageSize: 0
134+
groupUIDAttribute: dn
135+
groupNameAttributes: [ cn ]
136+
groupMembershipAttributes: [ member ]
137+
usersQuery:
138+
baseDN: "ou=users,dc=example,dc=com" <6>
139+
scope: sub
140+
derefAliases: never
141+
pageSize: 0
142+
userUIDAttribute: dn
143+
userNameAttributes: [ uid ]
144+
tolerateMemberNotFoundErrors: false
145+
tolerateMemberOutOfScopeErrors: false
146+
----
147+
<1> Define the sync configuration file.
148+
<2> Specify the URL.
149+
<3> Specify the `bindDN`.
150+
<4> This example uses the RFC2307 schema; adjust values as necessary. You can also use a different schema.
151+
<5> Specify the `baseDN` for `groupsQuery`.
152+
<6> Specify the `baseDN` for `usersQuery`.
153+
154+
. Create the config map:
155+
+
156+
[source,terminal]
157+
----
158+
$ oc create -f ldap-sync-config-map.yaml
159+
----
160+
161+
. Define a cron job:
162+
+
163+
.Example `ldap-sync-cron-job.yaml`
164+
[source,yaml]
165+
----
166+
kind: CronJob
167+
apiVersion: batch/v1
168+
metadata:
169+
name: ldap-group-syncer
170+
namespace: ldap-sync
171+
spec: <1>
172+
schedule: "*/30 * * * *" <2>
173+
concurrencyPolicy: Forbid
174+
jobTemplate:
175+
spec:
176+
backoffLimit: 0
177+
template:
178+
spec:
179+
containers:
180+
- name: ldap-group-sync
181+
image: "openshift/origin-cli:latest"
182+
command:
183+
- "/bin/bash"
184+
- "-c"
185+
- oc adm groups sync
186+
- --sync-config=/etc/config/ldap-group-sync.yaml --confirm <3>
187+
volumeMounts:
188+
- mountPath: "/etc/config"
189+
name: "ldap-sync-volume"
190+
- mountPath: "/etc/secrets"
191+
name: "ldap-bind-password"
192+
- mountPath: "/etc/ldap-ca"
193+
name: "ldap-ca"
194+
volumes:
195+
- name: "ldap-sync-volume"
196+
configMap:
197+
name: "ldap-group-syncer"
198+
- name: "ldap-bind-password"
199+
secret:
200+
secretName: "ldap-secret" <4>
201+
- name: "ldap-ca"
202+
configMap:
203+
name: "ca-config-map" <5>
204+
restartPolicy: "Never"
205+
terminationGracePeriodSeconds: 30
206+
activeDeadlineSeconds: 500
207+
dnsPolicy: "ClusterFirst"
208+
serviceAccountName: "ldap-group-syncer"
209+
----
210+
<1> Configure the settings for the cron job. See "Creating cron jobs" for more information on cron job settings.
211+
<2> The schedule for the job specified in link:https://en.wikipedia.org/wiki/Cron[cron format]. This example cron job runs every 30 minutes. Adjust the frequency as necessary, making sure to take into account how long the sync takes to run.
212+
<3> The LDAP sync command for the cron job to run. Passes in the sync configuration file that was defined in the config map.
213+
<4> This secret was created when the LDAP IDP was configured.
214+
<5> This config map was created when the LDAP IDP was configured.
215+
216+
. Create the cron job:
217+
+
218+
[source,terminal]
219+
----
220+
$ oc create -f ldap-sync-cron-job.yaml
221+
----

0 commit comments

Comments
 (0)