Container Service for Kubernetes:Set up an LDAP authentication source for ACK

Install OpenLDAP and phpLDAPadmin

1. Clone the demo repository, which contains the Kubernetes manifests for OpenLDAP and phpLDAPadmin:

   git clone https://github.com/lilongthinker/demo-base-code.git

   Expected output:

   Cloning to 'demo-base-code'...
   remote: Enumerating objects: 12, done.
   remote: Counting objects: 100% (12/12), done.
   remote: Compressing objects: 100% (10/10), done.
   remote: Total 12 (delta 0), reused 9 (delta 0), pack-reused 0
   Unpacking objects: 100% (12/12), done.

2. Switch to the LDAP directory and review the included manifests:

   cd demo-base-code/01_ldap
   tree ./

   ./
   ├── ingress-phpadmin.yaml
   ├── ldap-deploy.yaml
   ├── ldap-secret.yaml
   ├── ldap-service.yaml
   ├── phpldapadmin-deploy.yaml
   └── phpldapadmin-svc.yaml
   
   0 directories, 6 files
   ################################################
   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     labels:
       ingress-controller: nginx
     name: ldap-ui
     namespace: public-service
   spec:
     ingressClassName: nginx
     rules:
       - host: phpldap.example.com # Replace with the domain name you want to use.
         http:
           paths:
             - backend:
                 service:
                   name: phpldapadmin
                   port:
                     number: 8080
               path: /
               pathType: ImplementationSpecific
   ################################################

   Before deploying, open ingress-phpadmin.yaml and replace phpldap.example.com with the domain name you want to use for the phpLDAPadmin UI.

3. Create the namespace:

   kubectl create ns public-service

   Expected output:

   namespace/public-service created

4. Deploy all manifests:

   kubectl apply -f ./

   Expected output:

   ingress.extensions/ldap-ui created
   deployment.extensions/ldap created
   secret/ldap-secret created
   service/ldap-service created
   deployment.extensions/phpldapadmin created
   service/phpldapadmin created

Initialize LDAP accounts

1. Get the external IP address assigned to the Ingress:

   kubectl get ing

   NAME      HOSTS                 ADDRESS          PORTS   AGE
   ldap-ui   phpldap.example.com   121.xx.xxx.xxx   80      45s

2. Open the phpLDAPadmin console in your browser using the Ingress domain name. Log in with the default credentials:

   Field	Default value
   Distinguished name (DN)	cn=admin,dc=example,dc=org
   Password	admin

   If the browser reports that you are unauthorized to access /var/lib/php/sessions, run the chmod command to fix the session directory permissions.

3. Create an organizational unit: In the left-side navigation pane, click Create new entry here. On the Create Object page, click Generic: Organisational Unit, then click Create Object. Enter a name for the organizational unit (for example, dev) and click Create Object.

   

4. Create user accounts under the organizational unit: In the left-side navigation pane, click Create a child entry. Click Courier Mail:Account, fill in the user information, and click Create Object.

   Important

   The default account name may include trailing space characters. Delete them before saving.

   

Create an IDaaS instance and bind OpenLDAP

1. Log in to the IDaaS console and click Create Instance.

2. In the Create Instance dialog box, enter a description, accept the service agreement, and click Create.

3. In the instance list, click the instance you created to open the Quick Start page, then click Bind OpenLDAP.

4. On the Connect to LDAP step, fill in the LDAP connection details and click Next. For the full list of parameters, see Bind IDaaS to OpenLDAP - inbound.

   Section	Parameter	Value
   Basic information	Display name	Enter a name for this LDAP source
   Server configuration	Server address	External IP address of the ldap-service Service. To find it: log in to the ACK console, click Clusters, click the cluster name, choose Network > Services in the left-side navigation pane, and record the external IP address of ldap-service.
   LDAP domain configuration	Administrator account	cn=admin,dc=example,dc=org
   LDAP domain configuration	Administrator password	admin

5. On the Select scenario step, configure the scenario settings and click Next. For guidance, see Bind IDaaS to OpenLDAP - inbound.

6. On the Field mapping step, map the following fields and click Save and Push:

   IDaaS field	Notes
   Username	Map to the CN field in OpenLDAP. If the mapping rule is Select field, choose the IDaaS field that matches your directory schema.
   Email address	Map to the corresponding field in OpenLDAP.

   When you designate a field as a unique mapping identifier, IDaaS automatically binds matching accounts between IDaaS and OpenLDAP and keeps them in sync. If no match is found, IDaaS creates a new account and binds it.

Verify account synchronization and configure sign-in

1. After saving, navigate to Accounts > Accounts and Orgs in the left-side navigation pane. Confirm that the organization and account data from OpenLDAP appears in IDaaS.

2. In the left-side navigation pane, click Sign-in. On the General tab, set the sign-in method to ack-ldap for both computers and mobile platforms.

Troubleshooting

If the logon page does not appear or authentication fails, check the following: