Repository: openshift/openshift-ansible

Issue:
LDAP "ca" directive not set in master-config.yml when openshift_master_ldap_ca_file is configured
#### Description

When setting `openshift_master_ldap_ca_file` I found that /etc/origin/master/master-config.yml does not contain the ldap_ca.crt directive.

https://docs.openshift.com/container-platform/3.6/install_config/configuring_authentication.html#LDAPPasswordIdentityProvider

The issue appears to be that openshift_master_ldap_ca_file is mapped to `ldap_ca` variable which is never passed to the [ldap provider generator](https://github.com/openshift/openshift-ansible/blob/release-3.6/roles/openshift_master_facts/filter_plugins/openshift_master.py#L158)

##### Version

```
openshift-ansible-3.6.173.0.31-1
```

##### Steps To Reproduce
1. Configure provider and certificate

openshift_master_identity_providers=[{'name': 'active_directory', 'challenge': 'true', 'login': 'true', 'kind': 'LDAPPasswordIdentityProvider', 'attributes': {'id': ['...'], 'email': ['...'], 'name': ['...'], 'preferredUsername': ['...']}, 'bindDN': '...', 'bindPassword': '...', 'insecure': 'false', 'url': '...'}]

openshift_master_ldap_ca_file=/etc/ansible/ldap-ca-certificates/tls.crt

2. Run installation

##### Expected Results
Expected block in /etc/origin/master/master-config.yml

```
oauthConfig:
   ...
  grantConfig:
    method: auto
  identityProviders:
  - challenge: true
    login: true
    mappingMethod: claim
    name: active_directory
    provider:
      apiVersion: v1
      attributes:
        email:
        - ...
        id:
        - ...
        name:
        - ...
        preferredUsername:
        - ...
      bindDN: ...
      bindPassword: ...
      insecure: false
      ca: ldap_ca.crt
      kind: LDAPPasswordIdentityProvider
      url: ...
```

##### Observed Results

```
oauthConfig:
   ...
  grantConfig:
    method: auto
  identityProviders:
  - challenge: true
    login: true
    mappingMethod: claim
    name: active_directory
    provider:
      apiVersion: v1
      attributes:
        email:
        - ...
        id:
        - ...
        name:
        - ...
        preferredUsername:
        - ...
      bindDN: ...
      bindPassword: ...
      insecure: false
      kind: LDAPPasswordIdentityProvider
      url: ...
```

```
`ca` directive was absent causing validation errors when talking to LDAP server
```


Discussion:
This is an issue with 3.7 as well. a quick and dirty fix was to add `ca: ldap_ca.crt` to the identity provider config which is the default value for LDAPPasswordIdentityProvider in the advanced installer

```
 identityProviders:
  - challenge: true
    login: true
    mappingMethod: claim
    name: active_directory
    ca: ldap_ca.crt
    provider:
      apiVersion: v1
      attributes:
        email:
        - ...
        id:
        - ...
        name:
        - ...
        preferredUsername:
        - ...
      bindDN: ...
      bindPassword: ...
      insecure: false
      kind: LDAPPasswordIdentityProvider
      url: ...
```

Resolving patch:
diff --git a/roles/lib_utils/filter_plugins/openshift_master.py b/roles/lib_utils/filter_plugins/openshift_master.py
--- a/roles/lib_utils/filter_plugins/openshift_master.py
+++ b/roles/lib_utils/filter_plugins/openshift_master.py
@@ -158,6 +158,8 @@ def __init__(self, api_version, idp):
             pref_user = self._idp['attributes'].pop('preferred_username')
             self._idp['attributes']['preferredUsername'] = pref_user
 
+        self._idp['ca'] = '/etc/origin/master/{}_ldap_ca.crt'.format(self._idp['name'])
+
     def validate(self):
         ''' validate this idp instance '''
         if not isinstance(self.provider['attributes'], dict):
@@ -218,6 +220,8 @@ def __init__(self, api_version, idp):
                            ['emailHeaders', 'email_headers'],
                            ['nameHeaders', 'name_headers'],
                            ['preferredUsernameHeaders', 'preferred_username_headers']]
+        self._idp['clientCA'] = \
+            '/etc/origin/master/{}_request_header_ca.crt'.format(self._idp['name'])
 
     def validate(self):
         ''' validate this idp instance '''
@@ -358,6 +362,8 @@ def __init__(self, api_version, idp):
         if 'extra_authorize_parameters' in self._idp:
             self._idp['extraAuthorizeParameters'] = self._idp.pop('extra_authorize_parameters')
 
+        self._idp['ca'] = '/etc/origin/master/{}_openid_ca.crt'.format(self._idp['name'])
+
     def validate(self):
         ''' validate this idp instance '''
         if not isinstance(self.provider['claims'], dict):


Test patch: