LDAP Structure for OpenShift

Setelah 389 Directory Server dan LDAPS aktif, tahap berikutnya adalah membangun Directory Information Tree (DIT) yang akan menjadi sumber identity untuk OpenShift.

Struktur yang digunakan

dc=iqiterate,dc=id
├── ou=users
│   └── uid=iqbal
├── ou=groups
│   ├── cn=openshift-admins
│   └── cn=openshift-users
└── ou=service
    └── cn=openshift-bind

Konsep singkatnya:

OU	Fungsi
ou=users	Akun Pengguna (User Accounts)
ou=groups	Membership dan authorization
ou=service	Service accounts untuk koneksi/bind aplikasi ke LDAP

1. Base DN dan OU

Buat base.ldif:

dn: dc=iqiterate,dc=id
objectClass: top
objectClass: domain
dc: iqiterate

dn: ou=users,dc=iqiterate,dc=id
objectClass: top
objectClass: organizationalUnit
ou: users

dn: ou=groups,dc=iqiterate,dc=id
objectClass: top
objectClass: organizationalUnit
ou: groups

dn: ou=service,dc=iqiterate,dc=id
objectClass: top
objectClass: organizationalUnit
ou: service

Apply:

ldapadd -H ldaps://ldap.iqiterate.id:636 -x \
  -D "cn=Directory Manager" -W -f base.ldif

Verify:

ldapsearch -H ldaps://ldap.iqiterate.id:636 -x \
  -D "cn=Directory Manager" -W \
  -b "dc=iqiterate,dc=id" \
  "(objectClass=organizationalUnit)" dn

2. User LDAP

Buat users.ldif:

dn: uid=iqbal,ou=users,dc=iqiterate,dc=id
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
uid: iqbal
cn: Muhammad Iqbal
sn: Iqbal
mail: iqbal@iqiterate.id
userPassword: PASSWORD_USER

Apply:

ldapadd -H ldaps://ldap.iqiterate.id:636 -x \
  -D "cn=Directory Manager" -W -f users.ldif

Test bind:

ldapwhoami -H ldaps://ldap.iqiterate.id:636 -x \
  -D "uid=iqbal,ou=users,dc=iqiterate,dc=id" -W

Expected output:

dn: uid=iqbal,ou=users,dc=iqiterate,dc=id

3. Group groupOfNames

Group OpenShift menggunakan groupOfNames dengan membership di attribute member.

Buat groups.ldif:

dn: cn=openshift-admins,ou=groups,dc=iqiterate,dc=id
objectClass: top
objectClass: groupOfNames
cn: openshift-admins
member: uid=iqbal,ou=users,dc=iqiterate,dc=id

dn: cn=openshift-users,ou=groups,dc=iqiterate,dc=id
objectClass: top
objectClass: groupOfNames
cn: openshift-users
member: uid=iqbal,ou=users,dc=iqiterate,dc=id

Apply:

ldapadd -H ldaps://ldap.iqiterate.id:636 -x \
  -D "cn=Directory Manager" -W -f groups.ldif

Verify:

ldapsearch -H ldaps://ldap.iqiterate.id:636 -x \
  -D "cn=Directory Manager" -W \
  -b "ou=groups,dc=iqiterate,dc=id" \
  "(objectClass=groupOfNames)" dn cn member

4. Service account untuk OpenShift

Buat service.ldif:

dn: cn=openshift-bind,ou=service,dc=iqiterate,dc=id
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
uid: openshift-bind
cn: openshift-bind
sn: Service
userPassword: PASSWORD_OPENSHIFT_BIND
description: Service Account for OpenShift

Apply:

ldapadd -H ldaps://ldap.iqiterate.id:636 -x \
  -D "cn=Directory Manager" -W -f service.ldif

Test:

ldapwhoami -H ldaps://ldap.iqiterate.id:636 -x \
  -D "cn=openshift-bind,ou=service,dc=iqiterate,dc=id" -W

5. Mengapa service account dipisahkan?

Pemisahan OU memungkinkan setiap aplikasi memiliki bind account sendiri tanpa mencampuradukkan dengan akun pengguna (user accounts):

ou=service
├── cn=openshift-bind
├── cn=jenkins-bind
└── cn=grafana-bind

Sedangkan user tetap satu dan group dapat dipakai lintas platform:

iqbal
├── openshift-admins
├── jenkins-users
└── devops

6. ACI (Access Control Instruction)

Berikan read/search/compare ke OU users agar service account bisa mencari user:

dn: ou=users,dc=iqiterate,dc=id
changetype: modify
add: aci
aci: (targetattr="*")(version 3.0; acl "OpenShift LDAP read users"; allow (read,search,compare) userdn = "ldap:///cn=openshift-bind,ou=service,dc=iqiterate,dc=id";)

Berikan akses yang sama ke OU groups:

dn: ou=groups,dc=iqiterate,dc=id
changetype: modify
add: aci
aci: (targetattr="*")(version 3.0; acl "OpenShift LDAP read groups"; allow (read,search,compare) userdn = "ldap:///cn=openshift-bind,ou=service,dc=iqiterate,dc=id";)

Apply:

ldapmodify -H ldaps://ldap.iqiterate.id:636 -x \
  -D "cn=Directory Manager" -W -f aci.ldif

7. Test service account membaca users dan groups

Test baca users:

ldapsearch -H ldaps://ldap.iqiterate.id:636 -x \
  -D "cn=openshift-bind,ou=service,dc=iqiterate,dc=id" -W \
  -b "ou=users,dc=iqiterate,dc=id" \
  "(uid=iqbal)" dn uid cn mail

Test baca groups:

ldapsearch -H ldaps://ldap.iqiterate.id:636 -x \
  -D "cn=openshift-bind,ou=service,dc=iqiterate,dc=id" -W \
  -b "ou=groups,dc=iqiterate,dc=id" \
  "(cn=openshift-admins)" dn cn member

Jika kedua query berhasil, LDAP sudah siap diintegrasikan dengan OpenShift.

8. Authentication vs Authorization

Konsep	Dijawab oleh
Siapa saya?	LDAP user (authentication)
Saya masuk kelompok apa?	LDAP group (membership)
Kelompok ini punya permission apa?	OpenShift RBAC (authorization)

LDAP group tidak otomatis berarti cluster-admin. Mapping group ke role dilakukan di OpenShift.

9. Hasil akhir

dc=iqiterate,dc=id
├── ou=users
│   └── uid=iqbal
├── ou=groups
│   ├── cn=openshift-admins
│   └── cn=openshift-users
└── ou=service
    └── cn=openshift-bind

Bagian berikutnya menghubungkan struktur ini ke OpenShift 4.18 menggunakan LDAPS, OAuth, RFC2307 group sync, CronJob, dan RBAC.