openshift 4.3 using ldap

演示场景如下

部署openlap，并部署web前端
在openlap上配置2个group，一个是admins，一个是users，并给每个group配置一个user
ocp上配置ldap方式的用户认证
在ocp上使用命令行，同步ldap，查看已经生成了group和user
用这个用户登录ocp，发现什么都干不了
在ocp上使用命令行，给admins group授予cluster view的权限，给users group授予demo project view的权限。
重新登录/刷新页面，可以看到admin用户可以看到整个集群的内容，users的用户有了demo project的权限。

video

https://youtu.be/Sg3euS3ip4k
https://www.bilibili.com/video/BV1XA411b7N6/

参考资料：

https://docs.openshift.com/container-platform/4.3/authentication/identity_providers/configuring-ldap-identity-provider.html
https://docs.openshift.com/container-platform/4.3/authentication/ldap-syncing.html
https://www.cnblogs.com/ericnie/p/10063816.html
https://access.redhat.com/solutions/2484371
https://access.redhat.com/solutions/3419841

openldap



skopeo copy docker://docker.io/osixia/openldap:latest docker://registry.redhat.ren:5443/docker.io/osixia/openldap:latest

skopeo copy docker://docker.io/osixia/phpldapadmin:latest docker://registry.redhat.ren:5443/docker.io/osixia/phpldapadmin:latest

# 启动openldap服务
podman run -p 389:389 --name openldap --hostname ldap.redhat.ren --env LDAP_ORGANISATION="redhat" --env LDAP_DOMAIN="redhat.ren" --env LDAP_ADMIN_PASSWORD="ldap123" --detach registry.redhat.ren:5443/docker.io/osixia/openldap:latest
# 默认登录用户名：admin

podman run -d -p 5080:80 --name phpldapadmin --env PHPLDAPADMIN_HTTPS=false --env PHPLDAPADMIN_LDAP_HOSTS=117.177.241.16 --detach registry.redhat.ren:5443/docker.io/osixia/phpldapadmin:latest
# http://helper.hsc.redhat.ren:5080
# Login DN： cn=admin,dc=redhat,dc=ren
# Password： ldap123

podman rm -fv phpldapadmin
podman rm -fv openldap

yum install -y openldap openldap-clients openldap-servers

systemctl status slapd

# 为ldap添加测试用户数据
cat << EOF > base.ldif
dn: ou=users,dc=redhat,dc=ren
objectClass: organizationalUnit
objectClass: top
ou: users

dn: ou=groups,dc=redhat,dc=ren
objectClass: organizationalUnit
objectClass: top
ou: groups  
EOF

ldapadd -x -D "cn=admin,dc=redhat,dc=ren" -w ldap123 -f base.ldif

# 创建用户密码
slappasswd -s redhat
# {SSHA}yiR9306gQWh4mdeOuJ1KUg5cxQ8uoWKK

cat << EOF >users.ldif 
dn: cn=ocpadm,ou=users,dc=redhat,dc=ren
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
cn: ocpadm
sn: ocpadm
uid: ocpadm
displayName: ocpadm
mail: ocpadm@redhat.ren
userPassword: {SSHA}yiR9306gQWh4mdeOuJ1KUg5cxQ8uoWKK

dn: cn=wzh,ou=users,dc=redhat,dc=ren
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
cn: wzh
sn: wzh
uid: wzh
displayName: wzh
mail: wzh@redhat.ren
userPassword: {SSHA}yiR9306gQWh4mdeOuJ1KUg5cxQ8uoWKK

dn: cn=admins,ou=groups,dc=redhat,dc=ren
objectClass: groupOfNames
cn: admins
owner: cn=admin,dc=redhat,dc=ren
member: cn=ocpadm,ou=users,dc=redhat,dc=ren

dn: cn=normals,ou=groups,dc=redhat,dc=ren
objectClass: groupOfNames
cn: normals
owner: cn=admin,dc=redhat,dc=ren
member: cn=wzh,ou=users,dc=redhat,dc=ren

EOF
ldapadd -x -D "cn=admin,dc=redhat,dc=ren" -w ldap123 -f users.ldif 

ldapsearch -x -D "cn=admin,dc=redhat,dc=ren" -w ldap123 -b dc=redhat,dc=ren

ocp operation


oc get user
oc get group
oc get identity

# cleanup 垃圾用户数据
oc get user | grep ldap | awk '{print $1}' | xargs -I DEMO oc delete user DEMO
oc get identity | grep ldap | awk '{print $1}' | xargs -I DEMO oc delete identity DEMO

# 创建登录密码
oc create secret generic ldap-secret --from-literal=bindPassword=ldap123 -n openshift-config

# 创建ldap登录入口
cat << EOF > ldap.yaml
apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
  name: cluster
spec:
  identityProviders:
  - name: "Local Password"
    mappingMethod: claim
    type: HTPasswd
    htpasswd:
      fileData:
        name: htpasswd
  - name: ldapidp 
    mappingMethod: claim 
    type: LDAP
    ldap:
      attributes:
        id: 
        - dn
        email: 
        - mail
        name: 
        - cn
        preferredUsername: 
        - uid
      bindDN: "cn=admin,dc=redhat,dc=ren"
      bindPassword: 
        name: ldap-secret
      insecure: true 
      url: "ldap://registry.redhat.ren:389/ou=users,dc=redhat,dc=ren?uid" 
EOF
oc apply -f ldap.yaml

# 从ldap同步group数据
cat << EOF > ldapsync.yaml
kind: LDAPSyncConfig
apiVersion: v1
url: ldap://registry.redhat.ren:389
insecure: true
bindDN: cn=admin,dc=redhat,dc=ren
bindPassword: ldap123 
groupUIDNameMapping:
  "cn=admins,ou=groups,dc=redhat,dc=ren": Administrators 
  "cn=normals,ou=groups,dc=redhat,dc=ren": NormalUsers 
rfc2307:
    groupsQuery:
        baseDN: "ou=groups,dc=redhat,dc=ren"
        scope: sub
        derefAliases: never
        pageSize: 0
        filter: (objectclass=groupOfNames)
    groupUIDAttribute: dn 
    groupNameAttributes: [ cn ] 
    groupMembershipAttributes: [ member ]
    usersQuery:
        baseDN: "ou=users,dc=redhat,dc=ren"
        scope: sub
        derefAliases: never
        pageSize: 0
    userUIDAttribute: dn 
    userNameAttributes: [ cn ]
    tolerateMemberNotFoundErrors: false
    tolerateMemberOutOfScopeErrors: false
EOF

oc adm groups sync --sync-config=ldapsync.yaml --confirm

# 删除ldap上已经删除的用户组
# oc adm prune groups --sync-config=ldapsync.yaml --confirm

# 在这个时候，可以用wzh/ocpadm登录系统，但是可以看到没有任何project的权限

# 准备为用户组赋权
oc get clusterrole
oc get role 

# 赋予admin和normal组不同的权限
oc adm policy add-cluster-role-to-group cluster-reader Administrators
oc policy add-role-to-group view NormalUsers -n demo 

# 再次登录系统，可以看到用户有了相应的权限

# 撤销用户组权限
oc adm policy remove-cluster-role-from-group cluster-reader Administrators
oc policy remove-role-from-group view NormalUsers -n demo 

# remove ldap 
# cleanup 垃圾用户数据
oc get user | grep ldap | awk '{print $1}' | xargs -I DEMO oc delete user DEMO
oc get identity | grep ldap | awk '{print $1}' | xargs -I DEMO oc delete identity DEMO

cat << EOF > ldap.yaml
apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
  name: cluster
spec:
  identityProviders:
  - name: "Local Password"
    mappingMethod: claim
    type: HTPasswd
    htpasswd:
      fileData:
        name: htpasswd
EOF
oc apply -f ldap.yaml

free ipa


skopeo copy docker://docker.io/freeipa/freeipa-server:latest docker://registry.redhat.ren:5443/docker.io/freeipa/freeipa-server:latest

mkdir -p /data/freeipa
cat << EOF > /data/freeipa/ipa-server-install-options
--realm=redhat.ren
--ds-password=The-directory-server-password
--admin-password=The-admin-password
EOF

# setsebool -P container_manage_cgroup 1

docker run --name freeipa-server-container -ti --privileged   \
    -e IPA_SERVER_IP=10.66.208.240 \
    -p 3080:80 -p 3443:443 -p 389:389 -p 636:636 -p 88:88 -p 464:464 \
    -p 88:88/udp -p 464:464/udp -p 123:123/udp \
   -h ipa.redhat.ren \
   -v /sys/fs/cgroup:/sys/fs/cgroup:ro \
   --tmpfs /run --tmpfs /tmp \
   -v /data/freeipa:/data:Z \
   docker.io/freeipa/freeipa-server ipa-server-install

docker start -ai freeipa-server-container

docker rm -fv $(docker ps -qa)

firewall-cmd --zone=public --add-port=3443/tcp --permanent
firewall-cmd --reload

OpenShift4 慢慢走

openshift 4.3 using ldap

openldap

ocp operation

free ipa