Use an LDAP Service

This document describes how to use an LDAP service as an external identity provider, which allows you to authenticate users against the LDAP service.

Prerequisites

  • You need to deploy a Kubernetes cluster and install KubeSphere in the cluster. For details, see Installing on Linux and Installing on Kubernetes.
  • You need to obtain the manager distinguished name (DN) and manager password of an LDAP service.

Procedure

  1. Log in to KubeSphere as admin, move the cursor to Use an LDAP Service - 图1 in the bottom-right corner, click Kubectl, and run the following command to edit the kubesphere-config ConfigMap:

    1. kubectl -n kubesphere-system edit cm kubesphere-config

    Example:

    1. apiVersion: v1
    2. data:
    3.   kubesphere.yaml: |
    4.     authentication:
    5.       authenticateRateLimiterMaxTries: 10
    6.       authenticateRateLimiterDuration: 10m0s
    7.       loginHistoryRetentionPeriod: 168h
    8.       maximumClockSkew: 10s
    9.       multipleLogin: true
    10.       jwtSecret: "********"
    11.       oauthOptions:
    12.         accessTokenMaxAge: 1h
    13.         accessTokenInactivityTimeout: 30m
    14.         identityProviders:
    15.         - name: LDAP
    16.           type: LDAPIdentityProvider
    17.           mappingMethod: auto
    18.           provider:
    19.             host: 192.168.0.2:389
    20.             managerDN: uid=root,cn=users,dc=nas
    21.             managerPassword: ********
    22.             userSearchBase: cn=users,dc=nas
    23.             loginAttribute: uid
    24.             mailAttribute: mail

  2. Configure fields other than oauthOptions:identityProviders in the data:kubesphere.yaml:authentication section. For details, see Set Up External Authentication.

  3. Configure fields in oauthOptions:identityProviders section.

    • name: User-defined LDAP service name.
    • type: To use an LDAP service as an identity provider, you must set the value to LDAPIdentityProvider.
    • mappingMethod: Account mapping method. The value can be auto or lookup.
      • If the value is auto (default), you need to specify a new username. KubeSphere automatically creates a user according to the username and maps the user to an LDAP user.
      • If the value is lookup, you need to perform step 4 to manually map an existing KubeSphere user to an LDAP user.
    • provider:
      • host: Address and port number of the LDAP service.
      • managerDN: DN used to bind to the LDAP directory.
      • managerPassword: Password corresponding to managerDN.
      • userSearchBase: User search base. Set the value to the DN of the directory level below which all LDAP users can be found.
      • loginAttribute: Attribute that identifies LDAP users.
      • mailAttribute: Attribute that identifies email addresses of LDAP users.

  4. If mappingMethod is set to lookup, run the following command and add the labels to map a KubeSphere user to an LDAP user. Skip this step if mappingMethod is set to auto.

    1. kubectl edit user <KubeSphere username>
    1. labels:
    2.   iam.kubesphere.io/identify-provider: <LDAP service name>
    3.   iam.kubesphere.io/origin-uid: <LDAP username>

  5. After the fields are configured, run the following command to restart ks-apiserver.

    1. kubectl -n kubesphere-system rollout restart deploy/ks-apiserver

    Note

    The KubeSphere web console is unavailable during the restart of ks-apiserver. Please wait until the restart is complete.

  6. Go to the KubeSphere login page and enter the username and password of an LDAP user to log in.

    Note

    The username of an LDAP user is the value of the attribute specified by loginAttribute.