OKD4 integration with Active Directory
Tags: okd, kubernetes, ldap, openshift
Published: 2024-01-10 21:57:10

Disclaimer: this article was published originally on Medium, in March 2021 and may not be 100% up to date.

## Quick guide on integrating a OKD4 cluster to login with Active Directory

Before going to OKD, it’s better gather the following information:

*   A dedicated AD service account (for binding purposes) with complete DN;
*   Domain name or AD IP;
*   Complete DN of a “control group” with users allowed to log in;
*   Complete DN of groups you want to sync.

Now to OKD: start by creating a secret for your LDAP Service Account password:

```
oc create secret generic ldap-secret --from-literal=bindPassword=<LDAP SA password> -n openshift-config
```

Next, let’s update the cluster authentication methods. This YAML will change existing OAuth cluster settings existing on openshift-config namespace:

```
apiVersion: config.openshift.io/v1  
kind: OAuth  
metadata:  
  name: cluster  
  namespace: openshift-config  
spec:  
  identityProviders:  
  - name: ldapidp  
    mappingMethod: claim  
    type: LDAP  
    ldap:  
      attributes:  
        id:  
        - sAMAccountName  
        email:  
        - mail  
        name:  
        - displayName  
        preferredUsername:  
        - cn  
      bindDN: "CN=OKD,OU=ServiceAccounts,OU=Users,DC=domain,DC=com"  
      bindPassword:  
        name: ldap-secret  
      insecure: true  
      url: "ldap://<ip-or-ad-domain>:389/OU=Users,DC=domain,DC=com?sAMAccountName?sub?(memberof=CN=okd-users,OU=groups,DC=domain,DC=com)"
```

Fields to change:

*   bindDN: replace with your LDAP Service Account complete DN
*   URL: replace with your server and the OU where your users are located on LDAP server.
*   The last part of the URL sets that only members of the group “okd-users” will be able to log-in. You can remove that if you want.

Then apply the file you generated:

```
oc apply -f path/to/ldap-auth.yaml
```

After applying, wait for the redeploy of authentication pods and you should be able to log in using your LDAP account.

![OKD login screen will show ldapidp provider.](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nrqivl45eboyweolmm60.png)

Group Sync
==========

For the group sync, there’s two needed files: ldap-group-sync.yaml and whitelist.txt

```
kind: LDAPSyncConfig  
apiVersion: v1  
url: ldap://<ip-or-ad-domain>:389  
insecure: true  
bindDN: CN=OKD,OU=ServiceAccounts,OU=Users,DC=domain,DC=com  
bindPassword: '<AD Service Account Password>'  
groupUIDNameMapping:  
  "CN=okd-admins,OU=Groups,DC=domain,DC=com": okd-admins  
  "CN=okd-project1-users,OU=Groups,DC=domain,DC=com": okd-project1-users  
augmentedActiveDirectory:  
    groupsQuery:  
        derefAliases: never  
        pageSize: 0  
    groupUIDAttribute: dn  
    groupNameAttributes: \[ cn \]  
    usersQuery:  
        baseDN: "OU=Users,DC=domain,DC=com"  
        scope: sub  
        derefAliases: never  
        filter: (objectclass=person)  
        pageSize: 0  
    userNameAttributes: \[ cn \]  
    groupMembershipAttributes: \[ "memberOf:1.2.840.113556.1.4.1941:" \]
```

Fields to change:

*   URL: replace with your AD server IP or domain
*   bindDN: replace with previously created service account
*   bindPassword: the service account password
*   groupUIDNameMapping: insert as many groups as you need
*   baseDN: replace with baseDN of your AD users

On the whitelist.txt file, insert the previously mentioned groups, one per line:

```
CN=okd-admins,OU=Groups,DC=domain,DC=com  
CN=okd-project1-users,OU=Groups,DC=domain,DC=com
```

After finishing the files edit, do a dry run to validade:

```
oc adm groups sync --whitelist=whitelist.txt --sync-config=ldap-group-sync.yam
```

If everything goes well, add the “confirm” flag to process the changes:

```
oc adm groups sync --whitelist=whitelist.txt --sync-config=ldap-group-sync.yaml --confirm  

```

Check if your groups appeared on the console and then add the needed RoleBindings to them, accordingly:

Binding cluster-admin role to okd-admins group.

![This step is done.](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zj9wam1munzvxtpw1xaq.png)


Group Sync automation
=====================

You could sync your groups manually whenever you need, or maybe schedule a cron in any host to do that. But there’s a cooler way. Let’s schedule a cronJob inside OKD cluster to constantly check for changes on your groups.

Start by creating a project “ldap-sync” and a Cluster Role that will give the propper permissions for the job to complete the task:

Create a file rbac-ldap-group-sync.yaml:

```
apiVersion: rbac.authorization.k8s.io/v1  
kind: ClusterRole  
metadata:  
  name: ldap-group-sync  
rules:  
\- apiGroups:  
  - user.openshift.io  
  resources:  
  - groups  
  verbs:  
  - create  
  - update  
  - patch  
  - delete  
  - get  
  - list
```

Then run:

```
oc apply rbac-ldap-group-sync.yaml
```

Next, create the cronjob-ldap-group-sync.yaml:

```
apiVersion: batch/v1beta1  
kind: CronJob  
metadata:  
  name: ldap-group-sync  
  namespace: ldap-sync  
spec:  
  schedule: '[@hourly](http://twitter.com/hourly)'  
  suspend: false  
  jobTemplate:  
    spec:  
      template:  
    spec:  
      template:  
        metadata:  
          creationTimestamp: null  
        spec:  
          restartPolicy: Never  
          serviceAccountName: ldap-sync  
          schedulerName: default-scheduler  
          terminationGracePeriodSeconds: 30  
          securityContext: {}  
          containers:  
            - name: oc-cli  
              image: registry.redhat.io/openshift4/ose-cli  
              command:  
                - /bin/oc  
                - adm  
                - groups  
                - sync  
                - '--whitelist=/ldap-sync/whitelist.txt'  
                - '--sync-config=/ldap-sync/ldap\_group\_sync.yaml'  
                - '--confirm'  
              volumeMounts:  
                - name: config  
                  readOnly: true  
                  mountPath: /ldap-sync/  
          serviceAccount: ldap-sync  
          volumes:  
            - name: config  
              secret:  
                secretName: ldap-sync  
                defaultMode: 420  
          dnsPolicy: ClusterFirst
```

And then create the task:

```
oc apply -f cronjob-ldap-group-sync.yaml
```

On OKD console you can see the history of events generated by the job.

![](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5r10j4l2c761ubo8obnw.png)


Tips:

*   You can change the schedule from ‘@hourly’ to any valid Linux cron expression.
*   If you receive any errors on runnin the cron job, check if the serviceAccount line is present on the Cron Job in the OKD UI.