Red Hat Summit Red Hat SummitSupportKonsoleEntwicklerDemo startenKontakt

Dieser Inhalt ist in der von Ihnen ausgewählten Sprache nicht verfügbar.

Chapter 6. Understanding identity provider configuration

The OpenShift Container Platform master includes a built-in OAuth server. Developers and administrators obtain OAuth access tokens to authenticate themselves to the API.

As an administrator, you can configure OAuth to specify an identity provider after you install your cluster.

6.1. About identity providers in OpenShift Container Platform
Link kopieren

By default, only a 

kubeadmin
user exists on your cluster. To specify an identity provider, you must create a custom resource (CR) that describes that identity provider and add it to the cluster.

Note

OpenShift Container Platform user names containing 

/
, 
:
, and 
%
are not supported.

6.2. Supported identity providers
Link kopieren

You can configure the following types of identity providers:

Expand
Identity providerDescription

htpasswd

Configure the 

htpasswd
identity provider to validate user names and passwords against a flat file generated using htpasswd.

Keystone

Configure the 

keystone
identity provider to integrate your OpenShift Container Platform cluster with Keystone to enable shared authentication with an OpenStack Keystone v3 server configured to store users in an internal database.

LDAP

Configure the 

ldap
identity provider to validate user names and passwords against an LDAPv3 server, using simple bind authentication.

Basic authentication

Configure a 

basic-authentication
identity provider for users to log in to OpenShift Container Platform with credentials validated against a remote identity provider. Basic authentication is a generic backend integration mechanism.

Request header

Configure a 

request-header
identity provider to identify users from request header values, such as 
X-Remote-User
. It is typically used in combination with an authenticating proxy, which sets the request header value.

GitHub or GitHub Enterprise

Configure a 

github
identity provider to validate user names and passwords against GitHub or GitHub Enterprise’s OAuth authentication server.

GitLab

Configure a 

gitlab
identity provider to use GitLab.com or any other GitLab instance as an identity provider.

Google

Configure a 

google
identity provider using Google’s OpenID Connect integration.

OpenID Connect

Configure an 

oidc
identity provider to integrate with an OpenID Connect identity provider using an Authorization Code Flow.

Once an identity provider has been defined, you can use RBAC to define and apply permissions.

6.3. Removing the kubeadmin user
Link kopieren

After you define an identity provider and create a new 

cluster-admin
user, you can remove the 
kubeadmin
to improve cluster security.

Warning

If you follow this procedure before another user is a 

cluster-admin
, then OpenShift Container Platform must be reinstalled. It is not possible to undo this command.

Prerequisites

  • You must have configured at least one identity provider.
  • You must have added the 
    cluster-admin
    role to a user.
  • You must be logged in as an administrator.

Procedure

  • Remove the 

    kubeadmin
    secrets: 

    $ oc delete secrets kubeadmin -n kube-system

6.4. Identity provider parameters
Link kopieren

The following parameters are common to all identity providers:

Expand
ParameterDescription

name

The provider name is prefixed to provider user names to form an identity name. 

mappingMethod

Defines how new identities are mapped to users when they log in. Enter one of the following values:

claim
The default value. Provisions a user with the identity’s preferred user name. Fails if a user with that user name is already mapped to another identity.
lookup
Looks up an existing identity, user identity mapping, and user, but does not automatically provision users or identities. This allows cluster administrators to set up identities and users manually, or using an external process. Using this method requires you to manually provision users.
add
Provisions a user with the identity’s preferred user name. If a user with that user name already exists, the identity is mapped to the existing user, adding to any existing identity mappings for the user. Required when multiple identity providers are configured that identify the same set of users and map to the same user names.
Note

When adding or changing identity providers, you can map identities from the new provider to existing users by setting the 

mappingMethod
parameter to 
add
.

6.5. Sample identity provider CR
Link kopieren

The following custom resource (CR) shows the parameters and default values that you use to configure an identity provider. This example uses the htpasswd identity provider.

Sample identity provider CR

apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
  name: cluster
spec:
  identityProviders:
  - name: my_identity_provider
1 

    mappingMethod: claim
2 

    type: HTPasswd
    htpasswd:
      fileData:
        name: htpass-secret
3

1
This provider name is prefixed to provider user names to form an identity name.
2
Controls how mappings are established between this provider’s identities and User objects.
3
An existing secret containing a file generated using htpasswd.

6.6. Manually provisioning a user when using the lookup mapping method
Link kopieren

Typically, identities are automatically mapped to users during login. The 

lookup
mapping method disables this automatic mapping, which requires you to provision users manually. If you are using the 
lookup
mapping method, use the following procedure for each user after configuring the identity provider.

Prerequisites

  • You have installed the OpenShift CLI (
    oc
    ).

Procedure

  1. Create an OpenShift Container Platform user: 

    $ oc create user <username>

  2. Create an OpenShift Container Platform identity: 

    $ oc create identity <identity_provider>:<identity_provider_user_id>

    Where 

    <identity_provider_user_id>
    is a name that uniquely represents the user in the identity provider.

  3. Create a user identity mapping for the created user and identity: 

    $ oc create useridentitymapping <identity_provider>:<identity_provider_user_id> <username>
Red Hat logoGithubredditYoutubeTwitter

Lernen

Testen, kaufen und verkaufen

Communitys

Über Red Hat Dokumentation

Wir helfen Red Hat Benutzern, mit unseren Produkten und Diensten innovativ zu sein und ihre Ziele zu erreichen – mit Inhalten, denen sie vertrauen können. Entdecken Sie unsere neuesten Updates.

Mehr Inklusion in Open Source

Red Hat hat sich verpflichtet, problematische Sprache in unserem Code, unserer Dokumentation und unseren Web-Eigenschaften zu ersetzen. Weitere Einzelheiten finden Sie in Red Hat Blog.

Über Red Hat

Wir liefern gehärtete Lösungen, die es Unternehmen leichter machen, plattform- und umgebungsübergreifend zu arbeiten, vom zentralen Rechenzentrum bis zum Netzwerkrand.

Theme

© 2026 Red HatNach oben