LDAP configuration

Bind secret

For components that require LDAP, use the lc_bind_secret parameter in the template YAML file to locate a secret that includes the ldapUsername and ldapPassword keys. Specify the secret name that you create in the lc_bind_secret parameter.

ldap_configuration:
  lc_bind_secret: ldap-bind-secret
    ldap<ID>Username:
    ldap<ID>Password:

The following command shows how to create the (ldap-bind-secret) secret with the needed usernames and passwords.

oc create secret generic ldap-bind-secret \
    --from-literal=ldapUsername="cn=admin,dc=ibm,dc=edu" --from-literal=ldapPassword="<yourLDAPPassword>" \

If you need multiple LDAP configurations, for example ldap_configuration_xxx and ldap_configuration_yyy use a single secret (by default ldap-bind-secret) to include all your LDAP credentials. The operator looks for a username and password for each LDAP ID. A ldap_configuration_***.lc_ldap_id parameter is required to separate the credentials. You do not need to add an ID for the first ldap_configuration, which uses ldapUsername and ldapPassword.

For example, set the LDAP IDs in the custom resource:

ldap_configuration:

ldap_configuration_abc:
  lc_ldap_id: abc

ldap_configuration_def:
  lc_ldap_id: def

You can then add the credentials to the bind secret for each of the LDAPs. For example, the following secret includes credentials for 3 LDAPs (for the first LDAP, and for LDAP IDs abc and def):

kubectl create secret generic ldap-bind-secret     
  --from-literal=ldapUsername="cn=admin,dc=ibm,dc=edu" 
  --from-literal=ldapPassword="<yourLDAPPassword>"     
  --from-literal=ldapabcUsername="cn=admin,dc=ibm,dc=edu" 
  --from-literal=ldapabcPassword="<yourLDAPPassword>" 
  --from-literal=ldapdefUsername="cn=admin,dc=ibm,dc=edu"
  --from-literal=ldapdefPassword="<yourLDAPPassword>"

LDAP parameters

SCIM parameters

The SCIM configuration section of the CR is only processed on the initial CP4BA deployment. If you modify any of these values for an existing CP4BA deployment, they are not changed in IM. Therefore, if you need to change any of your LDAP to IM SCIM attribute mapping, change the SCIM configuration by using the SCIM configuration by using the IM console.

The following table describes the parameters that you need to set in the CR to create the IM SCIM configuration. Specify the attributes from your LDAP in the corresponding CR parameters. The default values shown in the table are the values that IM uses for a TDS/SDS LDAP. The CP4BA operator uses these parameters to construct the SCIM_LDAP_ATTRIBUTES_MAPPING data in the platform-auth-idp configMap. For more information, see Updating SCIM LDAP attributes mapping.

Example LDAP_configuration YAML for IBM Security Directory Server

ldap_configuration:
    lc_selected_ldap_type: "IBM Security Directory Server"
    lc_ldap_server: "myhost"
    lc_ldap_port: "389"
    lc_ldap_base_dn: "dc=hqpsidcdom,dc=com"
    lc_ldap_ssl_enabled: false
    lc_ldap_ssl_secret_name: ""
    lc_ldap_user_name_attribute: "*:cn"
    lc_ldap_user_display_name_attr: "cn"
    lc_ldap_group_base_dn: "dc=hqpsidcdom,dc=com"
    lc_ldap_group_name_attribute: "*:cn"
    lc_ldap_group_display_name_attr: "cn"
    lc_ldap_group_membership_search_filter: "(|(&(objectclass=groupofnames)(member={0}))(&(objectclass=groupofuniquenames)(uniquemember={0})))"
    lc_ldap_group_member_id_map: "groupofnames:member"
    lc_ldap_max_search_results: 4500
    lc_ldap_recursive_search: false
    tds:
      lc_user_filter: "(&(cn=%v)(objectclass=person))"
      lc_group_filter: "(&(cn=%v)(|(objectclass=groupofnames)(objectclass=groupofuniquenames)(objectclass=groupofurls)))"

Example LDAP_configuration YAML for Microsoft Active Directory

ldap_configuration:
    lc_selected_ldap_type: "Microsoft Active Directory"
    lc_ldap_server: "myhost"
    lc_ldap_port: "636"
    lc_ldap_base_dn: "dc=hqpsidcdom,dc=com"
    lc_ldap_ssl_enabled: true
    lc_ldap_ssl_secret_name: "ldap-ssl-cert-secret"
    lc_ldap_user_name_attribute: "user:sAMAccountName"
    lc_ldap_user_display_name_attr: "cn"
    lc_ldap_group_base_dn: "dc=hqpsidcdom,dc=com"
    lc_ldap_group_name_attribute: "*:cn"
    lc_ldap_group_display_name_attr: "cn"
    lc_ldap_group_membership_search_filter: "(&(cn=%v)(objectcategory=group))"
    lc_ldap_group_member_id_map: "memberOf:member"
    lc_ldap_max_search_results: 4500 
    lc_ldap_recursive_search: false
    ad:
      lc_ad_gc_host: ""
      lc_ad_gc_port: ""
      lc_user_filter: "(&(samAccountName=%v)(objectcategory=user))"
      lc_group_filter: "(&(cn=%v)(objectcategory=group))"

Example LDAP_configuration YAML for a custom LDAP

Adjust the example to match your LDAP configuration.

ldap_configuration:
     lc_selected_ldap_type: "Custom"
     lc_ldap_server: "myhost"
     lc_ldap_port: "636"
     lc_ldap_base_dn: "dc=hqpsidcdom,dc=com"
     lc_ldap_ssl_enabled: true
     lc_ldap_ssl_secret_name: "ldap-ssl-cert-secret"
     lc_ldap_user_name_attribute: "user:sAMAccountName"
     lc_ldap_user_display_name_attr: "cn"
     lc_ldap_group_base_dn: "dc=hqpsidcdom,dc=com"
     lc_ldap_group_name_attribute: "\*:cn"
     lc_ldap_group_display_name_attr: "cn"
     lc_ldap_group_membership_search_filter: "(&(cn=%v)(objectcategory=group))"
     lc_ldap_group_member_id_map: "memberOf:member"
     lc_ldap_max_search_results: 4500
     lc_ldap_recursive_search: false
     lc_enable_pagination: false
     lc_pagination_size: 4500 
     custom:
       lc_user_filter: "(&(objectClass=person)(cn=%v))"
       lc_group_filter: "(&(objectClass=group)(cn=%v))"

Database tuning

If your IBM Security Directory Server LDAP has 200,000+ users, 100+ groups, and multiple group search filters the LDAP might fail to integrate with IAM. You can remove group search filters to see whether it resolves the problem. For more information about tuning, see Advanced tuning mode and How to run REORG, REORGCHK and RUNSTAT on all tables in a database.