Red Hat OpenShift Container Platform

Sample LDAP custom resource

Review the sample LDAP custom resource (CR) and acceptable parameter values so you can configure attribute mappings, bind credentials, and connection settings for the LDAP identity provider.

apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
  name: cluster
spec:
  identityProviders:
  - name: ldapidp
    mappingMethod: claim
    type: LDAP
    ldap:
      attributes:
        id:
        - dn
        email:
        - mail
        name:
        - cn
        preferredUsername:
        - uid
      bindDN: ""
      bindPassword:
        name: ldap-secret
      ca:
        name: ca-config-map
      insecure: false
      url: "ldaps://ldaps.example.com/ou=users,dc=acme,dc=com?uid"

where:

spec.identityProviders.name: Specifies the provider name. The provider name is prefixed to the returned user ID to form an identity
spec.identityProviders.mappingMethod: Specifies how mappings are established between the identities of this provider and User objects.
spec.identityProviders.ldap.attributes.id: Specifies the list of attributes to use as the identity. The first non-empty attribute is used. At least one attribute is required. If none of the listed attributes have a value, authentication fails. Defined attributes are retrieved as raw, allowing binary values to be used.
spec.identityProviders.ldap.attributes.email: Specifies the list of attributes to use as the email address. The first non-empty attribute is used.
spec.identityProviders.ldap.attributes.name: Specifies the list of attributes to use as the display name. The first non-empty attribute is used.
spec.identityProviders.ldap.attributes.preferredUsername: Specifies the list of attributes to use as the preferred username when provisioning a user for this identity. The first non-empty attribute is used.
spec.identityProviders.ldap.bindDN: Specifies the optional DN to use to bind during the search phase. Must be set if bindPassword is defined.
spec.identityProviders.ldap.bindPassword: Specifies an optional reference to an Red Hat OpenShift Container Platform Secret object containing the bind password. Must be set if bindDN is defined.
spec.identityProviders.ldap.ca: Specifies an optional reference to an Red Hat OpenShift Container Platform ConfigMap object containing the Privacy-Enhanced Mail (PEM)-encoded certificate authority bundle to use in validating server certificates for the configured URL. Only used when insecure is false.
spec.identityProviders.ldap.insecure: Specifies whether a TLS connection is made to the server. When true, no TLS connection is made to the server. When false, ldaps:// URLs connect using TLS, and ldap:// URLs are upgraded to TLS. This must be set to false when ldaps:// URLs are in use, as these URLs always attempt to connect using TLS.
spec.identityProviders.ldap.url: Specifies an RFC 2255 URL for the LDAP host and search parameters to use.

To allowlist users for an LDAP integration, use the lookup mapping method. Before a login from LDAP is allowed, a cluster administrator must create an Identity object and a User object for each LDAP user.