Integrate LDAP for enterprise authentication

Integrate Red Hat OpenStack Services on OpenShift (RHOSO) with your LDAP directory so that OpenStack users can authenticate with pre-established enterprise identities.

To configure LDAP integration, complete the following steps:

  1. Use the OpenStack CLI to create the domain.
  2. Use RHOSO to create a secret that contains the required configuration.
  3. Mount the secret to the service by using the OpenStackControlPlane custom resource file.

Configure LDAP for the Identity service
Copy link

Configure LDAP integration for the Identity service (keystone) so that users can authenticate against your existing LDAP directory.

Before you begin
Copy link

  • A pre-established Red Hat Identity server.
  • The CA certificate that issued your LDAP server certificate is trusted by the Identity service (keystone) pods. If your LDAP server uses a certificate issued by a private CA, such as the Red Hat Identity Management CA, add that CA certificate to the RHOSO CA bundle before you begin. For more information, see Add custom CA certificates to the control plane.

Procedure
Copy link

  1. Create an OpenStack domain: 
    $ openstack domain create <name>

    where:

    <name>
    Specifies the name of your OpenStack domain.
  2. Create a keystone-domains secret called keystone-domains.yaml. This secret is mounted into the /etc/keystone/domains configuration directory:
    Important

    The [ldap] url scheme and the [ldap] use_tls parameter configures the following two mutually exclusive encryption mechanisms:

    • By default, the LDAPS or implicit TLS connection method is assumed, which requires you to specify the FQDN of the LDAPS host by using url = ldaps:// and use_tls = False by default. This is the more secure connection because it is encrypted immediately, normally on port 636.
    • However, you can implement the STARTTLS or explicit TLS connection method, which requires you to specify the FQDN of the LDAP host by using url = ldap:// and to set the use_tls = True. This connection is initially unencrypted on port 389 and is then upgraded to TLS by a STARTTLS operation.

    You cannot set url = ldaps:// together with use_tls = True.

     
    apiVersion: v1
kind: Secret
metadata:
  name: keystone-domains
  namespace: openstack
type: Opaque
stringData:
    keystone.<domain_name>.conf: |
        [identity]
        driver = ldap
        [ldap]
        url = ldaps://idm.example.com
        user = cn=openstack,ou=Users,dc=example,dc=com
        password = RedactedComplexPassword
        suffix = dc=example,dc=com
        user_tree_dn = ou=Users,dc=example,dc=com
        user_objectclass = person
        group_tree_dn = ou=Groups,dc=example,dc=com
        group_objectclass = groupOfNames
    • In this example, the FQDN of the LDAPS host is idm.example.com.
    • In this example, the base DN or top-level entry of the directory is dc=example,dc=com.
  3. Create the secret: 
    $ oc apply -f keystone-domains.yaml
  4. Open your OpenStackControlPlane custom resource (CR) file and add the secret by using the extraMounts field: 
    apiVersion: core.openstack.org/v1beta1
kind: OpenStackControlPlane
metadata:
  name: openstack
spec:
  keystone:
    template:
      customServiceConfig: |
        [identity]
        domain_specific_drivers_enabled = True
      extraMounts:
      - name: v1
        region: r1
          extraVol:
            - propagation:
              - Keystone
              extraVolType: Conf
              volumes:
              - name: keystone-domains
                secret:
                  secretName: keystone-domains
              mounts:
              - name: keystone-domains
                mountPath: "/etc/keystone/domains"
                readOnly: true
  5. Apply the changes to your OpenStackControlPlane CR: 
    $ oc apply -f openstack_control_plane.yaml