This is a cache of https://docs.openshift.com/enterprise/3.1/install_config/advanced_ldap_configuration/configuring_extended_ldap_attributes.html. It is a snapshot of the page at 2024-11-25T04:37:27.839+0000.
Configuring Extended LDAP Attributes - Advanced LDAP Configuration | Installation and Configuration | OpenShift Enterprise 3.1
    OpenShift docs are moving and will soon only be available at docs.redhat.com, the home of all Red Hat product documentation. Explore the new docs experience today.
  1. Documentation
    2. history
×

Configuring Extended LDAP Attributes

Overview

This topic builds upon Setting up SSSD for LDAP Failover and Configuring Form-Based Authentication and focuses on configuring extended Lightweight Directory Access Protocol (LDAP) attributes.

Prerequisites

  • SSSD 1.12.0 or later. This is available on Red Hat Enterprise Linux 7.0 and later.

  • mod_lookup_identity 0.9.4 or later.

    • The required version is not yet available on any version of Red Hat Enterprise Linux. However, compatible packages (RPMs) are available from upstream until they arrive in Red Hat Enterprise Linux.

Configuring SSSD

You need to ask System Security Services Daemon (SSSD) to look up attributes in LDAP that it normally does not care about for simple system-login use-cases. In the case of OpenShift Enterprise, there is only one such attribute: email. So, you need to:

  1. Modify the [domain/DOMAINNAME] section of /etc/sssd/sssd.conf on the authenticating proxy and add this attribute:

    [domain/example.com]
...
ldap_user_extra_attrs = mail

  2. Tell SSSD that it is acceptable for this attribute to be retrieved by Apache. Add the following two lines to the [ifp] section of /etc/sssd/sssd.conf:

    [ifp]
user_attributes = +mail
allowed_uids = apache, root

  3. Restart SSSD:

    # systemctl restart sssd.service

  4. Test this configuration.

Configuring Apache

Now that SSSD is set up and successfully serving extended attributes, configure the web server to ask for them and to insert them in the correct places.

  1. Enable the module to be loaded by Apache. To do so, modify /etc/httpd/conf.modules.d/55-lookup_identity.conf and uncomment the line:

    LoadModule lookup_identity_module modules/mod_lookup_identity.so

  2. Set an SELinux boolean so that SElinux allows Apache to connect to SSSD over D-BUS:

    # setsebool -P httpd_dbus_sssd on

  3. Edit /etc/httpd/conf.d/openshift-proxy.conf and add the following lines inside the <ProxyMatch /oauth/authorize> section:

    <ProxyMatch /oauth/authorize>
  AuthName openshift

  LookupOutput Headers (1)
  LookupuserAttr mail X-Remote-user-Email (1)
  LookupuserGECOS X-Remote-user-Display-Name (1)

  RequestHeader set X-Remote-user %{REMOTE_user}s env=REMOTE_user
</ProxyMatch>
    1 Added line.

  4. Restart Apache to pick up the changes:

    # systemctl restart httpd.service

Configuring OpenShift Enterprise

Tell OpenShift Enterprise where to find these new attributes during login. To do so:

  1. Edit the /etc/origin/master/master-config.yaml file and add the following lines to the identityProviders section:

    identityProviders:
 - name: sssd
 challenge: true
 login: true
 mappingMethod: claim
 provider:
   apiVersion: v1
   kind: RequestHeaderIdentityProvider
   challengeURL: "https://proxy.example.com/challenging-proxy/oauth/authorize?${query}"
   loginURL: "https://proxy.example.com/login-proxy/oauth/authorize?${query}"
   clientCA: /home/example/workspace/openshift/configs/openshift.example.com/proxy/proxyca.crt
   headers:
   - X-Remote-user
   emailHeaders: (1)
   - X-Remote-user-Email (1)
   nameHeaders: (1)
   - X-Remote-user-Display-Name (1)
    1 Added line.

  2. Launch OpenShift Enterprise with this updated configuration and log in to the web as a new user.

    You should see their full name appear in the upper-right of the screen. You can also verify with oc get identities -o yaml that both email addresses and full names are available.

Debugging Notes

Currently, OpenShift Enterprise only saves these attributes to the user at the time of the first login and does not update them again after that. So, while you are testing (and only while testing), run oc delete users,identities --all to clear the identities out so you can log in again.