2.2. Enabling User Login Normalization
You can enforce normalization for user logins by enabling a selection of default or custom methods on the broker. This is helpful when using authentication methods like LDAP or Kerberos that can be case-sensitive or use a domain in the login. Without normalization, logins with different letter cases or domain suffixes are stored by the broker as distinct user accounts.
For example, when normalization is enabled using the
lowercase method, a user logging in as JDoe is authenticated using the configured authentication method, then the login is normalized as jdoe by the broker to access the jdoe user account on OpenShift Enterprise. When normalization is not enabled, a user logging in as JDoe is authenticated using the configured authentication method and accesses the JDoe user account on OpenShift Enterprise, while a user logging in as jdoe ultimately accesses a separate jdoe user account.
Warning
Existing logins are not automatically updated when normalization settings are changed. As a result, it is possible for existing user accounts to no longer be accessible if the login was not previously normalized.
The following default methods are available:
| Method | Function |
|---|---|
strip | Removes any additional spaces on either side of the login. |
lowercase | Changes all characters to lowercase. For example: JDoe --> jdoe |
remove_domain | Removes a domain suffix. For example: jdoe@example.com --> jdoe |
To enable normalization, edit the
/etc/openshift/broker.conf file on the broker host and provide one or more methods in the NORMALIZE_USERNAME_METHOD parameter using a comma-separated list:
Example 2.1. Setting User Login Normalization Methods
NORMALIZE_USERNAME_METHOD="lowercase,remove_domain"
Restart the broker service for any changes to take effect:
service openshift-broker restart