Skip to content

Commit ad3b2c8

Browse files
xekklgill
xek
and
klgill
committed
LDAP adoption documentation
Co-authored-by: Katie Gilligan <[email protected]>
1 parent 3e09afd commit ad3b2c8

File tree

2 files changed

+136
-0
lines changed

2 files changed

+136
-0
lines changed

‎docs_user/assemblies/assembly_adopting-openstack-control-plane-services.adoc‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ Adopt your {rhos_prev_long} {rhos_prev_ver} control plane services to deploy the
1010

1111
include::../modules/proc_adopting-the-identity-service.adoc[leveloffset=+1]
1212

13+
include::../modules/proc_configuring-ldap-with-domain-specific-drivers.adoc[leveloffset=+1]
14+
1315
include::../modules/proc_adopting-key-manager-service.adoc[leveloffset=+1]
1416

1517
include::../modules/proc_adopting-the-networking-service.adoc[leveloffset=+1]

‎docs_user/modules/proc_configuring-ldap-with-domain-specific-drivers.adoc‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
:_mod-docs-content-type: PROCEDURE
2+
[id='configuring-ldap-with-domain-specific-drivers_{context}']
3+
4+
= Configuring LDAP with domain-specific drivers
5+
6+
If you need to integrate the {identity_service_first_ref} with one or more LDAP servers using domain-specific configurations, you can enable domain-specific drivers and provide the necessary LDAP settings.
7+
8+
This involves two main steps:
9+
10+
. Create the secret that holds the domain-specific LDAP configuration files that the {identity_service} uses. Each file within the secret corresponds to an LDAP domain.
11+
. Patch the `OpenStackControlPlane` custom resource (CR) to enable domain-specific drivers for the {identity_service} and mount a secret that contains the LDAP configurations.
12+
13+
14+
.Procedure
15+
16+
. To create the `keystone-domains` secret that stores the actual LDAP configuration files that {identity_service} uses, create a local file that includes your LDAP configuration, for example, `keystone.myldapdomain.conf`:
17+
+
18+
The following example file includes the configuration for a single LDAP domain. If you have multiple LDAP domains, create a configuration file for each, for example, `keystone.DOMAIN_ONE.conf`, `keystone.DOMAIN_TWO.conf`.
19+
+
20+
[source,ini]
21+
----
22+
[identity]
23+
driver = ldap
24+
[ldap]
25+
url = ldap://<ldap_server_host>:<ldap_server_port>
26+
user = <bind_dn_user>
27+
password = <bind_dn_password>
28+
suffix = <user_tree_dn>
29+
query_scope = sub
30+
# User configuration
31+
user_tree_dn = <user_tree_dn>
32+
user_objectclass = <user_object_class>
33+
user_id_attribute = <user_id_attribute>
34+
user_name_attribute = <user_name_attribute>
35+
user_mail_attribute = <user_mail_attribute>
36+
user_enabled_attribute = <user_enabled_attribute>
37+
user_enabled_default = true
38+
# Group configuration
39+
group_tree_dn = <group_tree_dn>
40+
group_objectclass = <group_object_class>
41+
group_id_attribute = <group_id_attribute>
42+
group_name_attribute = <group_name_attribute>
43+
group_member_attribute = <group_member_attribute>
44+
group_members_are_ids = true
45+
----
46+
+
47+
* Replace the values, such as `<ldap_server_host>`, `<bind_dn_user>`, `<user_tree_dn>`, and so on, with your LDAP server details.
48+
49+
. Create the secret from this file:
50+
+
51+
----
52+
$ oc create secret generic keystone-domains --from-file=<keystone.DOMAIN_NAME.conf>
53+
----
54+
+
55+
* Replace `<keystone.DOMAIN_NAME.conf>` with the name of your local configuration file. If applicable, include additional configuration files by using the `--from-file` option. After creating the secret, you can remove the local configuration file if it is no longer needed, or store it securely.
56+
+
57+
[IMPORTANT]
58+
The name of the file that you provide to `--from-file`, for example `keystone.DOMAIN_NAME.conf`, is critical. The {identity_service} uses this filename to map incoming authentication requests for a domain to the correct LDAP configuration. Ensure that `DOMAIN_NAME` matches the name of the domain you are configuring in the {identity_service}.
59+
60+
. Patch the `OpenStackControlPlane` CR:
61+
+
62+
----
63+
$ oc patch openstackcontrolplane <cr_name> --type=merge -p '
64+
spec:
65+
keystone:
66+
template:
67+
customServiceConfig: |
68+
[identity]
69+
domain_specific_drivers_enabled = true
70+
extraMounts:
71+
- name: v1
72+
region: r1
73+
extraVol:
74+
- propagation:
75+
- Keystone
76+
extraVolType: Conf
77+
volumes:
78+
- name: keystone-domains
79+
secret:
80+
secretName: keystone-domains
81+
mounts:
82+
- name: keystone-domains
83+
mountPath: "/etc/keystone/domains"
84+
readOnly: true
85+
----
86+
+
87+
* Replace `<cr_name>` with the name of your `OpenStackControlPlane` CR (for example, `openstack`).
88+
* This patch does the following:
89+
** Sets `spec.keystone.template.customServiceConfig`. Ensure that you do not overwrite any previously defined value.
90+
** Defines `spec.keystone.template.extraMounts` to mount a secret named `keystone-domains` into the {identity_service} pods at `/etc/keystone/domains`. This secret contains your LDAP configuration files.
91+
+
92+
[NOTE]
93+
You might need to wait a few minutes for the changes to propagate and for the {identity_service} pods to be updated.
94+
95+
.Verification
96+
97+
. Verify that users from the LDAP domain are accessible:
98+
+
99+
----
100+
$ oc exec -t openstackclient -- openstack user list --domain <domain_name>
101+
----
102+
+
103+
* Replace `<domain_name>` with your LDAP domain name.
104+
+
105+
This command returns a list of users from your LDAP server.
106+
107+
. Verify that groups from the LDAP domain are accessible:
108+
+
109+
----
110+
$ oc exec -t openstackclient -- openstack group list --domain <domain_name>
111+
----
112+
+
113+
This command returns a list of groups from your LDAP server.
114+
115+
. Test authentication with an LDAP user:
116+
+
117+
----
118+
$ oc exec -t openstackclient -- openstack --os-auth-url <keystone_auth_url> --os-identity-api-version 3 --os-user-domain-name <domain_name> --os-username <ldap_username> --os-password <ldap_password> token issue
119+
----
120+
+
121+
* Replace `<keystone_auth_url>` with the {identity_service} authentication URL.
122+
* Replace `<ldap_username>` and `<ldap_password>` with valid LDAP user credentials.
123+
+
124+
If successful, this command returns a token, confirming that LDAP authentication is working correctly.
125+
126+
. Verify group membership for an LDAP user:
127+
+
128+
----
129+
$ oc exec -t openstackclient -- openstack group contains user --group-domain <domain_name> --user-domain <domain_name> <group_name> <username>
130+
----
131+
+
132+
* Replace `<domain_name>`, `<group_name>`, and `<username>` with the appropriate values from your LDAP server.
133+
+
134+
This command verifies that the user is properly associated with the group through LDAP.

0 commit comments

Comments
 (0)