LDAP

Question 1

Steps to configure LDAP as IdP

Answer 1

1) Create a secret with the IdM admin user password
2) Create a cm containing the IdM CA’s root certificate
3) Extract oauth cluster and add identity provider

Question 2

Create a secret with LDAP admin user password

Answer 2

oc create secret generic ldap-secret \
–from-literal=bindPassword=${LDAP_ADMIN_PASSWORD} \
-n openshift-config

Question 3

Create a cm containing the IdM CA’s root certificate

Answer 3

oc create configmap ca-config-map –from-file=
ca.crt=<(curl http://idm.ocp-${GUID}.example.com/ipa/config/ca.crt)
-n openshift-config

Question 4

Oauth cluster CR for LDAP

Answer 4

Question 5

Add cluster admin role to admin user

Answer 5

oc adm policy add-cluster-role-to-user cluster-admin admin

Question 6

Steps to check when troubleshooting LDAP

Answer 6

1) Authentication Operator Logs.
2) Oauth Pods status.
3) LDAP server logs.

Question 7

OCP CA crt URL

Answer 7

http://idm.ocp4.example.com/ipa/config/ca.crt

Question 8

How do you sync LDAP groups with OCP

Answer 8

1) Create LDAPSyncConfig CR and run it manually or using a CronJob.
2) Assign cluster admin role to admin group

Question 9

Example LDAPSyncConfig

Answer 9

Question 10

How do you validate LDAPSyncConfig

Answer 10

oc adm groups sync –sync-config tmp/ldap-sync.yml

Question 11

steps to create a CronJob to perform a periodic LDAP group sync

Answer 11

1) Store LDAP bind password in an OCP Secret so the CronJob can access the password in a secure way.

2) Store LDAPSyncConfig and the IdM cert in a ConfigMap so the CronJob can use them.
3) Create cron job

Question 12

Store LDAP bind password in an OCP Secret so the CronJob can access the password in a secure way

Answer 12

oc create secret generic ldap-secret \
–from-literal bindPassword=r3dh4t

Question 13

Store LDAPSyncConfig and the IdM cert in a ConfigMap so the CronJob can use them.

Answer 13

oc create configmap ldap-config –from-file \
ldap-group-sync.yaml=tmp/ldap-sync-config-cronjob.yml,ca.crt=tmp/ca.crt

Question 14

Cron job for LDAP Sync

Answer 14

Question 15

Inspect the CronJob execution

Answer 15

watch oc get cronjobs,jobs,pods

Question 16

Verify a group definition and membership

Answer 16

oc get group admins -o yaml

Question 17

Grand admin permission to admin group

Answer 17

oc adm policy add-cluster-role-to-group cluster-admin admins

Question 18

Review that the user openshift-admin is in the openshift-admins group

Answer 18

oc get group openshift-admins

Question 19

Create an ldap-group-syncer cluster role with permissions to get, list, create, and update groups

Answer 19

oc create clusterrole ldap-group-syncer \
–resource=groups –verb=get,list,create,update