Container Service for Kubernetes:Integrate ACK with an external LDAP authentication source

How it works

The integration process works as follows:

1. In IDaaS, you add an LDAP configuration to sync LDAP accounts to IDaaS. Passwords are not synced. To sign in with an LDAP username, you must reset the password in IDaaS. If you prefer not to manage multiple passwords, you can configure SSO.

2. Add an application in IDaaS:

   • The application requires an AccessKey to connect to a RAM user that has the AliyunRAMFullAccess permission, allowing the application to manage RAM permissions.

   • Associate the application with a RAM role or RAM user to grant permissions to the LDAP accounts used for sign-in.

   • Import the LDAP accounts that are synced to IDaaS into the application, allowing these accounts to use the application and inherit the permissions of the associated RAM role or RAM user.

3. Configure the IDaaS SSO feature to connect to the LDAP service.

4. LDAP users sign in to the Alibaba Cloud console with SSO and gain the permissions of the RAM role or RAM user associated with the application in IDaaS.

5. Grant PaaS-level permissions to the federated accounts on the container platform.

Step 1: Prepare the environment

Follow these steps to simulate an LDAP environment.

1. Deploy OpenLDAP.

   Set up OpenLDAP to simulate an LDAP data source and use php-LDAP-admin as the LDAP management tool.

   1. Run the following command to clone the repository.

      git clone https://github.com/lilongthinker/demo-base-code.git

      Expected output:

      Cloning into 'demo-base-code'...
      remote: Enumerating objects: 12, done.
      remote: Counting objects: 100% (12/12), done.
      remote: Compressing objects: 100% (10/10), done.
      remote: Total 12 (delta 0), reused 9 (delta 0), pack-reused 0
      Unpacking objects: 100% (12/12), done.

   2. Check the directory structure and create a new YAML file.

      cd demo-base-code/01_ldap
      tree ./

      ./
      ├── ingress-phpadmin.yaml
      ├── ldap-deploy.yaml
      ├── ldap-secret.yaml
      ├── ldap-service.yaml
      ├── phpldapadmin-deploy.yaml
      └── phpldapadmin-svc.yaml
      
      0 directories, 6 files
      ################################################ 
      apiVersion: networking.k8s.io/v1
      kind: Ingress
      metadata:
        labels:
          ingress-controller: nginx
        name: ldap-ui
        namespace: public-service
      spec:
        ingressClassName: nginx
        rules:
          - host: phpldap.example.com # Replace with your actual domain name.
            http:
              paths:
                - backend:
                    service:
                      name: phpldapadmin
                      port:
                        number: 8080
                  path: /
                  pathType: ImplementationSpecific
      ################################################

   3. Run the following command to create a namespace.

      kubectl create ns public-service

      Expected output:

      namespace/public-service created

   4. Run the following command to deploy the application.

      kubectl apply -f ./

      Expected output:

      ingress.extensions/ldap-ui created
      deployment.extensions/ldap created
      secret/ldap-secret created
      service/ldap-service created
      deployment.extensions/phpldapadmin created
      service/phpldapadmin created

2. Initialize accounts.

   1. Sign in to php-LDAP-admin.

      1. Run the following command to get the Ingress domain name and address.

         kubectl get ing

         NAME      HOSTS                 ADDRESS          PORTS   AGE 
         ldap-ui   phpldap.example.com   121.xx.xxx.xxx   80      45s

      2. Copy the Ingress domain name to your browser, then sign in to the php-LDAP-admin console with the default distinguished name (DN) and password.

         Note

         • Default DN: cn=admin,dc=example,dc=org.

         • Default password: admin.

         • If you receive a permission error for /var/lib/php/sessions, use the chmod command to modify the path permissions.

   2. Create an organizational unit and user accounts.

      1. In the left-side navigation pane of the php-LDAP-admin console, click Create new entry here. On the Create Object page, click Generic: Organizational Unit, and then click Create Object.

      2. Enter an organization name and click Create Object. In this example, the organization name is dev.

      3. In the left-side navigation pane of the php-LDAP-admin console, click the ou=dev organizational unit that you created. Click Create a child entry, click Courier Mail: Account, configure the user information, and then click Create Object.

         Important

         By default, account names generated in php-LDAP-admin may contain spaces. Make sure to remove them.

Step 2: Configure IDaaS

1. Sign in to the IDaaS console and click Create Instance.

2. In the Create Instance panel, enter an Description, select the agreement checkbox, and then click Create.

3. In the instance list, select the target instance. On the Quick Start page, click Bind OpenLDAP.

4. On the Connect to LDAP page of the Bind OpenLDAP wizard, enter the LDAP configuration information and click Next.

   For more information about binding OpenLDAP, see Bind OpenLDAP - Inbound synchronization.

   Category	Parameter	Description
   Basic Information	Display Name	Enter a custom name.
   Server Configuration	Server Address	The external IP address of the ldap-service service. To obtain the IP address, perform the following steps: Log on to the ACK console. In the left navigation pane, click Clusters. On the Clusters page, click the name of the target cluster. In the left-side navigation pane, choose Network > Services. Find the service named ldap-service and record its external IP address.
   LDAP Domain Configuration	Administrator Account	The default administrator DN is cn=admin,dc=example,dc=org.
   	Administrator Password	The password is admin.

5. On the Select Scenario page, configure the scenario settings, and then click Create. For more information about scenario settings, see Bind OpenLDAP - Inbound synchronization.

6. On the Field Mapping page, configure the field mappings. For this example, you only need to configure the Username and Email Address fields. Then, click Save and Push.

   Note

   • When you configure field mapping, if the mapping rule is Select Field, choose an IDaaS field based on your requirements. For example, this topic maps the account name to the CN attribute in OpenLDAP, but you can map it to other attributes as needed.

   • You can designate a field as a unique identifier for mapping. If the field values match for an unbound account on both sides, the accounts are bound and the data is updated. If the values do not match, a new account is created and bound.

7. After you save and synchronize the settings, choose Account > Accounts and Orgs in the left-side navigation pane. The OpenLDAP organization and user information has been synced.

8. In the left-side navigation pane, choose Sign-In. On the General tab, set the sign-in method. For this example, set the sign-in method for both PC and mobile to ack-ldap.

Step 3: Verification

In the left-side navigation pane, choose IdPs > Delegated Authentication. Copy the delegation link and paste it into your browser. If the Alibaba Cloud IDaaS sign-in page appears and you can sign in, the configuration is successful.

Related operations

For more information about configuring SSO for IDaaS accounts, see Create an application and Configure SSO for an application.