LDAP configuration

Bind secret

For components that require LDAP, use the lc_bind_secret parameter in the template YAML file to locate a secret that includes the ldapUsername and ldapPassword keys. Specify the secret name that you create in the lc_bind_secret parameter.

ldap_configuration:
  lc_bind_secret: ldap-bind-secret
    ldap<ID>Username:
    ldap<ID>Password:

The following command shows how to create the (ldap-bind-secret) secret with the needed usernames and passwords.

kubectl create secret generic ldap-bind-secret \
    --from-literal=ldapUsername="cn=admin,dc=ibm,dc=edu" --from-literal=ldapPassword="<yourLDAPPassword>" \

If you need multiple LDAP configurations, for example ldap_configuration_xxx and ldap_configuration_yyy use a single secret (by default ldap-bind-secret) to include all your LDAP credentials. The operator looks for a username and password for each LDAP ID. A ldap_configuration_***.lc_ldap_id parameter is required to separate the credentials. You do not need to add an ID for the first ldap_configuration, which uses ldapUsername and ldapPassword.

For example, set the LDAP IDs in the custom resource:

ldap_configuration:

ldap_configuration_abc:
  lc_ldap_id: abc

ldap_configuration_def:
  lc_ldap_id: def

You can then add the credentials to the bind secret for each of the LDAPs. For example, the following secret includes credentials for 3 LDAPs (for the first LDAP, and for LDAP IDs abc and def):

kubectl create secret generic ldap-bind-secret     
  --from-literal=ldapUsername="cn=admin,dc=ibm,dc=edu" 
  --from-literal=ldapPassword="<yourLDAPPassword>"     
  --from-literal=ldapabcUsername="cn=admin,dc=ibm,dc=edu" 
  --from-literal=ldapabcPassword="<yourLDAPPassword>" 
  --from-literal=ldapdefUsername="cn=admin,dc=ibm,dc=edu"
  --from-literal=ldapdefPassword="<yourLDAPPassword>"

LDAP parameters

Example LDAP_configuration YAML for IBM Security Directory Server

ldap_configuration:
    lc_selected_ldap_type: "IBM Security Directory Server"
    lc_ldap_server: "myhost"
    lc_ldap_port: "389"
    lc_ldap_base_dn: "dc=hqpsidcdom,dc=com"
    lc_ldap_ssl_enabled: false
    lc_ldap_ssl_secret_name: ""
    lc_ldap_user_name_attribute: "*:cn"
    lc_ldap_user_display_name_attr: "cn"
    lc_ldap_group_base_dn: "dc=hqpsidcdom,dc=com"
    lc_ldap_group_name_attribute: "*:cn"
    lc_ldap_group_display_name_attr: "cn"
    lc_ldap_group_membership_search_filter: "(|(&(objectclass=groupofnames)(member={0}))(&(objectclass=groupofuniquenames)(uniquemember={0})))"
    lc_ldap_group_member_id_map: "groupofnames:member"
    lc_ldap_max_search_results: 4500
    lc_ldap_recursive_search: false
    tds:
      lc_user_filter: "(&(cn=%v)(objectclass=person))"
      lc_group_filter: "(&(cn=%v)(|(objectclass=groupofnames)(objectclass=groupofuniquenames)(objectclass=groupofurls)))"

Example LDAP_configuration YAML for Microsoft Active Directory

ldap_configuration:
    lc_selected_ldap_type: "Microsoft Active Directory"
    lc_ldap_server: "myhost"
    lc_ldap_port: "636"
    lc_ldap_base_dn: "dc=hqpsidcdom,dc=com"
    lc_ldap_ssl_enabled: true
    lc_ldap_ssl_secret_name: "ldap-ssl-cert-secret"
    lc_ldap_user_name_attribute: "user:sAMAccountName"
    lc_ldap_user_display_name_attr: "cn"
    lc_ldap_group_base_dn: "dc=hqpsidcdom,dc=com"
    lc_ldap_group_name_attribute: "*:cn"
    lc_ldap_group_display_name_attr: "cn"
    lc_ldap_group_membership_search_filter: "(&(cn=%v)(objectcategory=group))"
    lc_ldap_group_member_id_map: "memberOf:member"
    lc_ldap_max_search_results: 4500 
    lc_ldap_recursive_search: false
    ad:
      lc_ad_gc_host: ""
      lc_ad_gc_port: ""
      lc_user_filter: "(&(samAccountName=%v)(objectcategory=user))"
      lc_group_filter: "(&(cn=%v)(objectcategory=group))"

Example LDAP_configuration YAML for a custom LDAP

Adjust the example to match your LDAP configuration.

ldap_configuration:
     lc_selected_ldap_type: "Custom"
     lc_ldap_server: "myhost"
     lc_ldap_port: "636"
     lc_ldap_base_dn: "dc=hqpsidcdom,dc=com"
     lc_ldap_ssl_enabled: true
     lc_ldap_ssl_secret_name: "ldap-ssl-cert-secret"
     lc_ldap_user_name_attribute: "user:sAMAccountName"
     lc_ldap_user_display_name_attr: "cn"
     lc_ldap_group_base_dn: "dc=hqpsidcdom,dc=com"
     lc_ldap_group_name_attribute: "\*:cn"
     lc_ldap_group_display_name_attr: "cn"
     lc_ldap_group_membership_search_filter: "(&(cn=%v)(objectcategory=group))"
     lc_ldap_group_member_id_map: "memberOf:member"
     lc_ldap_max_search_results: 4500
     lc_ldap_recursive_search: false
     lc_enable_pagination: false
     lc_pagination_size: 4500 
     custom:
       lc_user_filter: "(&(objectClass=person)(cn=%v))"
       lc_group_filter: "(&(objectClass=group)(cn=%v))"