Project: Pinniped (Provisioning / Key Management)
File: configure-supervisor-with-jumpcloudldap.md

title: Configure the Pinniped Supervisor to use JumpCloud as an LDAP provider description: Set up the Pinniped Supervisor to use JumpCloud LDAP cascade: layout: docs menu: docs: name: With JumpCloud LDAP weight: 110 parent: howto-configure-supervisor aliases: /docs/howto/configure-supervisor-with-jumpcloudldap/ The Supervisor is an issuer that supports connecting "upstream" identity providers to many "downstream" cluster clients. is a cloud-based service which bills itself as "a comprehensive and flexible cloud directory platform". It includes the capability to act as an LDAP identity provider. This guide shows you how to configure the Supervisor so that users can authenticate to their Kubernetes cluster using their identity from JumpCloud's LDAP service. This how-to guide assumes that you have already with working ingress, and that you have . If you don't already have a JumpCloud account, you can create one for free with up to 10 users in the account. You will need to create two types of users in your JumpCloud account using the JumpCloud console UI: Users who can use `kubectl` to authenticate into the cluster You may want to specify passwords for these users at the time of creation, unless you prefer to use JumpCloud's email invitation feature. Make sure these users are part of the LDAP Directory in which the LDAP searches will occur by checking the option to add the directory for the user in the JumpCloud console under the User->Directory tab. An LDAP service account to be used by the Pinniped Supervisor to perform LDAP searches and binds Specify a password for this user at the time of creation. Also click the "Enable as LDAP Bind DN" option for this user. Here are some good resources to review while setting up and using JumpCloud's LDAP service: Create an in the same namespace as the Supervisor. For example, this LDAPIdentityProvider configures the LDAP entry's `uid` as the Kubernetes username, and the `cn` (common name) of each group to which the user belongs as the Kubernetes group names. ```yaml apiVersion: idp.supervisor.pinniped.dev/v1alpha1 kind: LDAPIdentityProvider metadata: name: jumpcloudldap namespace: pinniped-supervisor spec: host: "ldap.jumpcloud.com:636" userSearch: base: "ou=Users,o=YOURORGID,dc=jumpcloud,dc=com" filter: "&(objectClass=inetOrgPerson)(uid={})" attributes: username: "uid" uid: "uidNumber" groupSearch: base: "ou=Users,o=YOURORGID,dc=jumpcloud,dc=com" filter: "&(objectClass=groupOfNames)(member={})" userAttributeForFilter: "dn" attributes: groupName: "cn" bind: secretName: "jumpcloudldap-bind-account" apiVersion: v1 kind: Secret metadata: name: jumpcloudldap-bind-account namespace: pinniped-supervisor type: kubernetes.io/basic-auth stringData: username: "uid=YOURUSERNAME,ou=Users,o=YOURORG_ID,dc=jumpcloud,dc=com" password: "YOUR_PASSWORD" ``` Note that the `metadata.name` of the LDAPIdentityProvider resource may be visible to end users at login prompts, so choose a name which will be understood by your end users. For example, if you work at Acme Corp, choose something like `acme-corporate-ldap` over `my-idp`. If you've saved this into a file `jumpcloud.yaml`, then install it into your cluster using: ```sh kubectl apply -f jumpcloud.yaml ``` Once your LDAPIdentityProvider has been created, you can validate your configuration by running: ```sh kubectl describe LDAPIdentityProvider -n pinniped-supervisor jumpcloudldap ``` Look at the `status` field. If it was configured correctly, you should see `phase: Ready`. Next, ! Then you'll be able to log into those clusters as any of the users from the JumpCloud directory.