4.2. Creating Global Teams and Synchronizing with LDAP Groups

Procedure 4.1. To Synchronize a Global Team with LDAP Groups:

1. Create an LDAP configuration file in the /etc/openshift/ directory. This file specifies how your instance will connect to the LDAP server and query for LDAP groups and group membership.
2. Create one or more global teams. If you are not using LDAP groups, then the --maps-to option can be specified as anything:

   # oo-admin-ctl-team -c create --name Team_Name --maps-to cn=all,ou=Groups,dc=example,dc=com

   Copy to Clipboard Toggle word wrap
   Alternatively, you can create a global team straight from LDAP groups using the --groups option. In this case, you must indicate your LDAP config file and the LDAP groups to create the global team from:

   # oo-admin-ctl-team --config-file /etc/openshift/File_Name.yml -c create --groups Group_Name1,Group_Name2

   Copy to Clipboard Toggle word wrap

   Example 4.1. Sample LDAP configuration File

   Host: server.example.com
   Port: 389
   Get-Group:
   	Base: dc=example,dc=com
   	Filter: (cn=<group_cn>)
   Get-Group-Users:
   	Base: <group_dn>
   	Attributes: [member]
   Get-User:
   	Base: dc=example,dc=com
   	Filter: (uid=<user_id>)
   	Attributes: [emailAddress]
   Openshift-Username: emailAddress
   

   Copy to Clipboard Toggle word wrap

   Example 4.2. Sample Active Directory based LDAP configuration File

   Host: server.example.com
   Port: 389
   Username: CN=username.gen,OU=Generics,OU=Company Users,DC=company,DC=com
   Password: xxxxxxxxxxxxxx
   
   #get group entry so we can map team to the group distinguished name
   Get-Group: 
   	Base: dc=example,dc=com
   	Filter: (cn=<group_cn>)
   
   #get all the users in the group
   Get-Group-Users:
   	Base: <group_dn>
   	Filter: (memberOf=<group_dn>)
   	Attributes: [emailaddress]
   
   Openshift-Username: emailaddress
   

   Copy to Clipboard Toggle word wrap
3. Next, synchronize global team membership with LDAP:

   # oo-admin-ctl-team --config-file /etc/openshift/File_Name.yml -c sync --create-new-users --remove-old-users

   Copy to Clipboard Toggle word wrap

   This step can be performed in a cron job in order to regularly synchronize OpenShift Enterprise with LDAP.
   Alternatively, use a sync file to synchronize global team membership with LDAP with the following command:

   # oo-admin-ctl-team --config-file /etc/openshift/File_Name.yml -c sync-to-file --out-file teams.sync --create-new-users --remove-old-users

   Copy to Clipboard Toggle word wrap

   This command creates a file you can modify to suit your requirements. The format is the entity to act upon, an action, then the user names.
   The following example sync file adds users to an OpenShift Enterprise instance, then adds them as members to the team named "myteam".

   Example 4.3. Synchronizing Global Team Membership with a Sync File

   USER|ADD|user1
   ...
   USER|ADD|user100
   MEMBER|ADD|myteam|user1,...,user100

   Copy to Clipboard Toggle word wrap
   Alternatively, create this file from any source and sync team members from the specified file with the following command:

   # oo-admin-ctl-team -c sync-from-file --in-file teams.sync

   Copy to Clipboard Toggle word wrap