openshift-management icon indicating copy to clipboard operation
openshift-management copied to clipboard

Update LDAP Group Sync Templates for OCP 4.1

Open darthlukan opened this issue 5 years ago • 1 comments

High level steps used on OCP 4.1 to set up LDAP group sync. Adding the steps here as requested via internal chat.

  1. Create Secret named ldap-bind-secret in openshift-config namespace with data.bindPassword containing the base64 encoded bind password.
  2. Create ConfigMap named ldap-ca-config-map in openshift-config namespace with data specced to ca.crt containing the CA Cert.
  3. Create Namespace named infra-cronjobs with label name: infra-cronjobs
  4. Create ConfigMap in the infra-cronjobs namespace containing data with ca.crt defined as well as ldap-group-sync.yaml containing the required data defined in the OCP 4.1 Auth Providers: AD/LDAP docs.
  5. Create CronJob named ldap-group-sync in namespace infra-cronfjobs containing a spec consuming the items created prior.
  6. Create ClusterRole named ldap-group-syncer with rules allowing get, list, create, update, and delete on group resources.
  7. Create ClusterRoleBinding named system:ldap-group-syncers with roleRef set to ldap-group-syncer for ldap-group-syncer service account
  8. Create ServiceAccount named ldap-group-syncer in namespace infra-cronjobs
  9. Create Job named initial-ldap-group-sync in namespace infra-cronjobs which consumes the body of the CronJob created in step 5 in order to kick things off.

darthlukan avatar Jul 16 '19 22:07 darthlukan

How do you map the synced user names to the base64 encoded user names when users are logging in?

dgabrysch avatar Jan 08 '20 12:01 dgabrysch