From 31f91156473d89c926f8b403b40cd6cc1099a638 Mon Sep 17 00:00:00 2001 From: Patrick-LuoYu Date: Tue, 11 May 2021 14:53:21 +0800 Subject: [PATCH 1/2] Add use-an-ldap-service-en. Signed-off-by: Patrick-LuoYu --- .../use-an-ldap-service.md | 101 ++++++++++++++++++ .../use-an-ldap-service/toolbox.png | Bin 0 -> 6267 bytes 2 files changed, 101 insertions(+) create mode 100644 content/zh/docs/access-control-and-account-management/use-an-ldap-service.md create mode 100644 static/images/docs/access-control-and-account-management/external-authentication/use-an-ldap-service/toolbox.png diff --git a/content/zh/docs/access-control-and-account-management/use-an-ldap-service.md b/content/zh/docs/access-control-and-account-management/use-an-ldap-service.md new file mode 100644 index 000000000..862c1a81c --- /dev/null +++ b/content/zh/docs/access-control-and-account-management/use-an-ldap-service.md @@ -0,0 +1,101 @@ +--- +title: "Use an LDAP Service" +keywords: "LDAP, identity provider, external, authentication" +description: "How to use an LDAP service." + +linkTitle: "Use an LDAP Service" +weight: 12220 +--- + +This document describes how to use an LDAP service as an external identity provider, which allows you to authenticate users against the LDAP service. + +## Prerequisites + +* You need to deploy a Kubernetes cluster and install KubeSphere in the cluster. For details, see [Installing on Linux](/docs/installing-on-linux/) and [Installing on Kubernetes](/docs/installing-on-kubernetes/). +* You need to obtain the manager distinguished name (DN) and manager password of an LDAP service. + +### Procedure + +1. Log in to KubeSphere as `admin`, move the cursor to in the bottom-right corner, click **Kubectl**, and run the following command to edit the `kubesphere-config` ConfigMap: + + ```bash + kubectl -n kubesphere-system edit cm kubesphere-config + ``` + + Example: + + ```yaml + apiVersion: v1 + data: + kubesphere.yaml: | + authentication: + authenticateRateLimiterMaxTries: 10 + authenticateRateLimiterDuration: 10m0s + loginHistoryRetentionPeriod: 168h + maximumClockSkew: 10s + multipleLogin: true + jwtSecret: "********" + oauthOptions: + accessTokenMaxAge: 1h + accessTokenInactivityTimeout: 30m + identityProviders: + - name: LDAP + type: LDAPIdentityProvider + mappingMethod: auto + provider: + host: 192.168.0.2:389 + managerDN: uid=root,cn=users,dc=nas + managerPassword: ******** + userSearchBase: cn=users,dc=nas + loginAttribute: uid + mailAttribute: mail + ``` + +2. Configure fields other than `oauthOptions:identityProviders` in the `data:kubesphere.yaml:authentication` section. For details, see [Set Up External Authentication](./set-up-external-authentication/). + +3. Configure fields in `oauthOptions:identityProviders` section. + + * `name`: User-defined LDAP service name. + * `type`: To use an LDAP service as an identity provider, you must set the value to `LDAPIdentityProvider`. + * `mappingMethod`: Account mapping method. The value can be `auto` or `lookup`. + * If the value is `auto` (default), you need to specify a new username. KubeSphere automatically creates a user according to the username and maps the user to an LDAP user. + * If the value is `lookup`, you need to perform step 4 to manually map an existing KubeSphere user to an LDAP user. + * `provider`: + * `host`: Address and port number of the LDAP service. + * `managerDN`: DN used to bind to the LDAP directory. + * `managerPassword`: Password corresponding to `managerDN`. + * `userSearchBase`: User search base. Set the value to the DN of the directory level below which all LDAP users can be found. + * `loginAttribute`: Attribute that identifies LDAP users. + * `mailAttribute`: Attribute that identifies email addresses of LDAP users. + +4. If `mappingMethod` is set to `lookup`, run the following command and add the labels to map a KubeSphere user to an LDAP user. Skip this step if `mappingMethod` is set to `auto`. + + ```bash + kubectl edit user + ``` + + ```yaml + labels: + iam.kubesphere.io/identify-provider: + iam.kubesphere.io/origin-uid: + ``` + +5. After the fields are configured, run the following command to restart ks-apiserver. + + ```bash + kubectl -n kubesphere-system rollout restart deploy/ks-apiserver + ``` + + {{< notice note >}} + + The KubeSphere web console is unavailable during the restart of ks-apiserver. Please wait until the restart is complete. + + {{}} + +6. Go to the KubeSphere login page and enter the username and password of an LDAP user to log in. + + {{< notice note >}} + + The username of an LDAP user is the value of the attribute specified by `loginAttribute`. + + {{}} diff --git a/static/images/docs/access-control-and-account-management/external-authentication/use-an-ldap-service/toolbox.png b/static/images/docs/access-control-and-account-management/external-authentication/use-an-ldap-service/toolbox.png new file mode 100644 index 0000000000000000000000000000000000000000..998dd945c46f1d91c034e96cda68fdfd77d04f37 GIT binary patch literal 6267 zcmX|lWl$Un6XYVnEf2TFCAd3FaCdhIx_Hoqz(Vk_Sa1sxSTwl1JHg%Eod?0Wyt}J! zs(QL>s^{NS|CnzYYVz0^WEcPd09#Q(M(Zz&{e=P=%HLk9o&pB|ka57$(i)D^^3twO zuI}1ymR2_MHZC^qU@I+oDF8qyCPvrPol5+p4w%Fa zm}F;-O=d}EL?GYk>0Ca$pdMIXxNH3LW_MDdA&(Hb7Pk0HXoPm#2JlMQUt=1CEcrBq zzVPWDy-(CBi+cN?-gcyPBkzjy9Jlre`%X5g!>-qN4TmMHo+IE64F(z3w1E*g7mDEt6emzqG zo_T|3VBGfVkm^d}2trP04%wbYB30s<38;@SEoS&*cc||vA(sWdOguF%*x%S9zX*fu z&_3@FZl8BQw|TnJ^WotY(5U0^I&^Y4#U)kvMt3<`+H+yAOV@@4^|deannbsCqnqVc z8_+~p#r$)`?W8rHUsww@AE!r>oGq4lu7X`Y((MWEBl5rnnD4t*pCUhS;Y zHtQz(m2w2}7AF=b97mEDT+BoQT=ZeBa(X$f^BzZ@^mb$p?4Co*vp?J?-g?Xr7OKn- z1dXs>QK3kICo6i5{3m>4dKdvMuEu@xH{xp6AUM0OlVxrGPeXpaM?|VoKtMC370nLC z_<8rwutb96@Sg-K#=xERUC`FJM~-{W=Z&Bt(@hR{b9eL4R316<4zs=&e2(Xp`PCTv z;8e}k94Vtkb}?q_F!7$=9&2UwL&ES-bW2V@Z^1JB7-G{_l))-j>#~4fLBu5gqF&qk4yTcRpcM@~{wL?RDicpR^pdQcM-%)Ti3- z0jj?62=%xszP=Ez_`+>Ga!`bxnMD5>H3;Kw{z963vL6))vfF9D0Q>?KLhiI6Onsj= z5QXMKdb{=2$tKFEPHv4ME)45{MgMlQx2G4sfE%RQ4M0=w8`2vC1he02e)MlZIN2B| z+N!DoSpI4>05Sp@;N4$^@E0Hi^8aZ$1ZDuz|D7WO01;pS^8fd!{pJ5E{xAO9`G1U< zi}*i>ST554w8DSZvm!a&zl83lVCVq=5Hb7*1Vt_SO8@{rQ&C1z2ZHe1*f5TM@N?{W zg|Oebl~07pbQPRwqk#?WQneeAjik&qqZfG`#6xT1&&-1Z4;K zUP9mbDTR2zn2I@X!2J^~Z%s{U*}g$yxO-zE4;>vX9nW=S^hm`irB@NH_H(UubCgN| zk#Jd3wF;lPqGZQBQlV}V<@m#)i8s~RFu0NR52%TgsmS!G97q}w#-G=fGsO@)psb`ju#G zFtIu-n_|?OXDWiSFCv3X;<|%xZ`ZSY0)V;H)$@J8Ni31N81;y?LSDT@b|TzC6K6qN z?2G!{-eK{Fh$rl$yB2qUf2_7|^d2{*i%U!CxoOJ8=rEBofvbA~5@GN<3ljB^S|npG zJ)znF2{C_Z>T5|CmkU%B6EGDjo6>t__jcnUEM!0ASoxCbna6c-fF|8CBdiCD^>T^I z%E@{1UNm4UPuyD$)U}vZBY!v5JmAn4&yE$s;A zH2A^?O0}(J-*~+9fq!01Ld6AkO(O|+PwqL07KT3xJx=sxd`H_`(kZF4va80g)GPiR zutP-4Q1D!=Ys0038%H+X^;4z{XbC_2IOQ=mI%SU~zSia)9{rB%F0`45qVHO^NzTf3 z6NS$@dbX7J!bG$oBA8LLB@!ayJ%n+M?UtFxk6Y!_aXr!qpF34(U7Pk@>II5+A7@t7 zysy>iQJ|QZr5`7x>x0#*jbXY)z2}N>K9tl*o@3Xd=wQ=Y+S*jP!^N@2W#uei0sB}- z&iV3$lOy{5C?e(yfR{%5&x7a587QQ@NIUFG=Ws}gyoc&qW++L^d$$WxoJ(rnt}EXP zJ^tJ`mG}B6;C@5Ck~5=Sxb0HQHY7t!zA!A34pmwf<1)T0t1CGJ=ONo&9s1LwMqoqa zv9Wdp?q+eqx%D@yD`qX-nAPt{cr}qU1rkQ$=*I{qyXSykr zS`w()a4T7M+m>O=8jD1Wo>_S@GHSD_^)-TX_QZ^98n($A$UURpXMK!1UYq|&q$`|O zl-Yd~`L%q4Iqd<1ZEToaRW{i8hxWs~PX}zvKQeE%=O=$WC=27U$IwQ+m)g)I`#X;X zIDC%Vuh0$Mc~b@j$0yvhYuI+RVb@Zu{xVb=H)=(rc4`3lg@aCrrljV3lHYRVXtpNu zh=9HZ&l(0;jLUTxi+mdbw}U|T8y35phC{8=-nu=7D24*xPEDO8o{l9csd9vTH2*BA zuxjT0a@Ce}FZ4v*4`a2;XYX(OStu=FyPu5ZwWMNg`D^4d1&2K15=L&272cB=BSM(^ z+pzxQtbNDtVisQab{nY(64Pj^U4}_K#3~^xdtVT9t1~)&q8C#U({%{dE1Jtr9>vb; zNb<6rH21*-fDF?n7>eQqGqjkRrX)7H^$Q67q;?xwR0M=*`U&Oa73d`WqrSAt5<<>d zg=U$Lq0S@}zD(2a1MorWzqX(Qbpyxpr=eE7QUOa+Wld#AMgAEYJdrjG z@6C&idVq|GmSHA{6OpOH?Sg6)4)?z+kXNXr7KWs&Y!dL2k*9L3)MxBo7%#9tM{+R2z2`DJ6L#tBjta zf!4?Vl84(=(B3kPdCe}Iz(jbO;+x$#eemo02E%pC3c7GtreDlKlbb@H6PjfXD*s_Y z;`yMsP|W1eDKQDf>LvO(RGIGpwUi_}Acl7|(T|qFN+GK(5wFL~8Elm*)?gb&{qy#A z>Dw#vnDB8g4sU%$^qpZQw3%oxm!Qz;z2x+xYKjvLTq!s{Fk!Uk3|S(l#XwL`Z*;qOduzhH|Z<9UZ~Gh3J~1-ZnBx!V^k@Z`Ln%E#k~pg zpa*^!Y4Uh_UHm?xxys7Ert)%mis-9&3|Omy!$)^b+!PU&PI2D`+{~e@tn4OLD$+(S z)Rome>QEo6Tk^xsW#sv}?N?>F6j(EBYw05;Bbn0}4R-c-7vJH!tV>LwpyzF-au`Eq z@CbkfJkW)}$%xmX7j0j#bBj(@?KSfO12ZA!9R}CrE z5@N!;en?_7Ixgsevm<;pCJA*q`O-ph%->M(cn4@o-z2O{HqARP?G{4>cb8T~Ti9Q( zyQRgu#QdIRP&6`7EX&H($XDLq?ZtSNbW3Y5;NSegLV#8OUQ<4U(VXF+Q{c#AymQV` zV?WDjO4Ndiu}!Y6Hv399Y??SZS6HIO%~tN)TY1hlC!~$W$4Gmd^dp9CDfb_xxI-O_ zNv7dhni{ZyGrubYB_WFY&(UR82ujvEv$jnMiYnaNN5<&^noDQp&bLLKcXOTb#*HqA zw6gyH((NwAEKq=g{YqAN zy>>TZ4CUpOBPhRGT3TpXN0l8ua9EfGJ%R|bQd3j1OM@9B+wE2~6b$aP#fY~hn;{D1 z`DGtIEiV0WQs?~i^|7_{h1~bNnUeW5NnFa{{_4ErnV?AEam6H0A}*1u++YwyN@RDE6r4bn^H%cj>-e}5_h zXf?UWAjENGYbuc?)_V1n_rv9Nx(TO^8z&11)#OYIKSWv3?XuI$!?;{5PB%kM;?D}o zr%kcbR(x{wuEoP8lu;G#F-Z!K(G$@)>plaxa1IeM5qy++a4hNo{pR1Vz8$nS6dLi> zd2J0XjOK64`g_d>KGvj|g!-1y>81YqZ$29VR1b^|`K;q>+lAYj)5T$JO!x-mmZ30_*xbEj!lp3Cns3RzluA&vGU5w((D5FNEn5EUQY0nyr0aRDKsiiZNyxt@5gLEOB|2p$e1&=M`w@mg@%rgX1 z;-U}|ZAwiy=hk=#b$%k(bDVZ`*vwYIBoc@_`ls-_N|%l}?Ve{5Lj2|Zw=_oc`|^!G zH{*f1E^&Vv0#X$eF84lqW=tFe3Z87jW@DujNI~n%X|0C0amVxCM)D8iNOMa#h&*-| zXc73kyf9NitaP`Q7eA{f1pL~s$}Zlj;j z{=GjhvO2_WT5w#&hi|3n$pPV`w3zT3`S~-tk(7Gqoy;~FG$^qZt^n4?%H4&TKO@H4 zDN}n}rqtQ7-^IJnnb3GR_PLp+;|vJC9m)E>-tpGN$|~cB+EF}5NIY_%$5L~Iah<-I z_gq!Qo>_uRV$;6EnC*9x$Zx)Kv>Y9*dg1?;R+W&had@*G7Wy5Vi$DO$` zPz3J*53bQ0nC>D`kSXA#)O-2unnraP<8vtcABZboLg>Wbu4#{HIxMfO46AG80=ico zcSJ_~yf1|qYYd9wp5*WGp!BXC4@3kPG|Q9vn5lw}N>7#-FhVBfxZFGER|h5|^>H_Mz^fOtp-gzo zQ(C1bv9Dkva18(>xCoqj1S`E$veX|+7n}d3_?zcMs~eG*0=MiK;=jil_*3wF9kLU< zzLQewObG$1zq z;MT%JC0Gs9u@Vn3fw4TZLD|Ky8)1JwsG4Paf0hR2X8&Qd#QV8G&G=+1DX@YVtGf$0 z)g@==8bU6zA?sD50puMN{5d!=#HDyk^A9vER8G&$&+mb%lZNx97gp2JQ8CyG7Xf{{ z#Ao;hL;jX#mf@ue?=e@>2-@^wDgFS^wD@C@%xI&BwBEb;aWySRcz%9i^PgCF?_-@M)W3fx-7-uXAvr-KJz4h7j`ZCfdM$g&YUwfQ73rj&^q87=p@@4!8CBnn>6@t5=82Punwo|uEkkNBk#R1Egh zulIP;Xb)b4^oHBFUz4RX*b`2F;DYopwI%InF65?1?gh8A_5}(SUhbup$8WgLwR4Um zDqAnsW`b5Teb(nEvhYo0HxDhCnl57$wF@?Xsnp`-+r=EbH|WPe-DJZI0m!nCx$$+@ zkbJB89ImV5Vn}kOP$eE;Dzs3sb=)l#AlV7H-X;;R4Ff*Anjr5@toUMoUHS2nrH9@v zN!(b&(+!k&wcBz=>cM3JA0_cob362h#1{<>}ToSojFqHp`!=V^PYOa9B9Em$eA-^9*5vN61cAiLhH`@}BZiYGA=APIC9pd0?=n9QiiY0n<%g;rZZr0*;)~ zwgo?Gwo$eczPXK0nLn=d@=I`eQJG+1?l9K`Q`5WA98$6MwSMdtnt1?mwY5pc+2?Mg zFV7KfzP?uQsOv)YTujn9XEa+&Adn@i;1@NIYAg?vVA2di5ZkTC@K#u-r#hIH*(~Bj z5y(1~lGb>$D~7&Yr6pK1ZnaMFtvnm_W04->|jf7LMcs inyjbTp=jSxAVOcNbm;y-Q15>~JVjYGnF=Y3;Qs?V@9;SQ literal 0 HcmV?d00001 From 41c1af6676d767152f3c221d09714d2cfc4e3318 Mon Sep 17 00:00:00 2001 From: Patrick-LuoYu Date: Tue, 11 May 2021 14:57:32 +0800 Subject: [PATCH 2/2] Fix issue. Signed-off-by: Patrick-LuoYu --- .../external-authentication}/use-an-ldap-service.md | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename content/{zh/docs/access-control-and-account-management => en/docs/access-control-and-account-management/external-authentication}/use-an-ldap-service.md (100%) diff --git a/content/zh/docs/access-control-and-account-management/use-an-ldap-service.md b/content/en/docs/access-control-and-account-management/external-authentication/use-an-ldap-service.md similarity index 100% rename from content/zh/docs/access-control-and-account-management/use-an-ldap-service.md rename to content/en/docs/access-control-and-account-management/external-authentication/use-an-ldap-service.md