Bug 1254061 - [DOCS] Document LDAP Support in OSE
Summary: [DOCS] Document LDAP Support in OSE
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Documentation
Version: 3.0.0
Hardware: Unspecified
OS: Unspecified
high
medium
Target Milestone: ---
: ---
Assignee: Ashley Hardin
QA Contact: Chuan Yu
Vikram Goyal
URL:
Whiteboard:
: 1275687 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-08-17 05:08 UTC by Vikram Goyal
Modified: 2020-05-14 15:00 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-08-04 17:36:10 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description Vikram Goyal 2015-08-17 05:08:15 UTC
Based on the trello card: https://trello.com/c/UC2rGgJ2/442-3-enable-ldap-auth-integration-security and the upstream docs: https://github.com/openshift/openshift-docs/pull/741.

This should be documented from the view of a OSE user. Goes into admin guide.

Comment 2 Vikram Goyal 2015-08-21 11:11:15 UTC
Some more relevant information might be in this card: https://trello.com/c/lZQSxUxn/215-2-design-ldap-sync-manage-team (which seems to be the tracking card for all LDAP related stuff).

Comment 3 Vikram Goyal 2015-10-27 20:43:27 UTC
*** Bug 1275687 has been marked as a duplicate of this bug. ***

Comment 6 Steven Walter 2017-03-30 19:01:14 UTC
Ran into more confusion with the LDAP sync docs. In the RFC2307 specification, it states:

 	The attribute that uniquely identifies a user on the LDAP server. You cannot specify usersQuery filters when using DN for userUIDAttribute. For fine-grained filtering, use the whitelist / blacklist method.

I understand how to do this via whitelist for *groups*, and created a KCS on this at https://access.redhat.com/solutions/2399131 after this bug was originally filed. However what does it mean to require a whitelist for users?

- Do you have to specify every single user? Does this not defeat the purpose of an LDAP sync which is supposed to minimize effort?
- What would the format of a whitelist file for users look like?

Comment 10 Jordan Liggitt 2017-07-17 18:38:52 UTC
the closest thing to whitelisting users for an LDAP integration in openshift would be to use the `lookup` mappingMethod. That would require a cluster admin to create an Identity and User object before a login from LDAP would be allowed.

Comment 11 Ashley Hardin 2017-07-20 17:15:09 UTC
Work in progress: https://github.com/openshift/openshift-docs/pull/4828

Comment 12 Chuan Yu 2017-07-26 00:54:03 UTC
The doc change lgtm, thx

Comment 13 openshift-github-bot 2017-07-26 13:42:49 UTC
Commits pushed to master at https://github.com/openshift/openshift-docs

https://github.com/openshift/openshift-docs/commit/247cadea56418b4ff3394b683bc7df38fdce9b38
Bug 1254061, added note on whitelisting users

https://github.com/openshift/openshift-docs/commit/024a9ad9352c72feb30512c71c5aadc04684ac7b
Merge pull request #4828 from ahardin-rh/ldap-whitelisting

Bug 1254061, added note on whitelisting users


Note You need to log in before you can comment on or make changes to this bug.