Setting up LDAP

Configure LDAP authentication to integrate with external directory services for centralized user management. LDAP allows you to authenticate with your existing directory credentials.

Overview

To set up LDAP authentication, you create a Kubernetes ConfigMap containing LDAP configuration files, then reference that ConfigMap in your Db2uInstance custom resource. The setup process involves:

  1. Consulting the configuration file schemas to understand required fields.
  2. Creating the configuration files with your LDAP server details.
  3. Creating a ConfigMap containing those files.
  4. Applying the ConfigMap to your cluster.
  5. Referencing the ConfigMap in your Db2uInstance CR.

You can use two authentication methods, each requiring different configuration files:

  • GSS plugin (default): Uses the GSS (Generic Security Services) plugin for LDAP authentication.
  • SSSD (Transparent LDAP): Uses System Security Services Daemon for transparent LDAP integration.

Configuration file schemas

Before creating your ConfigMap, consult the LDAP ConfigMap schema to understand the required and optional fields for each configuration file.

For the GSS plugin method, you need the following fields:

  • ldap.conf: the standard LDAP client configuration.
  • IBMIAMauthldap.ini: IBM-specific LDAP authentication configuration.
  • ldap_user_info.env: LDAP admin and user group information.

For the SSSD (transparent LDAP) method, you need the following fields:

  • ldap.conf: the standard LDAP client configuration.
  • sssd.conf: SSSD daemon configuration.
  • nsswitch.conf: name service switch configuration.
  • ldap_user_info.env: LDAP admin and user group information.
Note: ldap.conf, sssd.conf, and nsswitch.conf are standard Linux configuration files. For more information, see OpenLDAP documentation and SSSD documentation.