Skip to content

Commit 8a56c49

Browse files
srenatussrenatus
authored
Merge pull request dexidp#1390 from okamototk/activedirectory
Add Active Directory and kubelogin integration sample.
2 parents ccf5c95 + 658d7b1 commit 8a56c49

3 files changed

Lines changed: 224 additions & 1 deletion

File tree

‎Documentation/connectors/kubelogin-activedirectory.md‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
# Integration kubelogin and Active Directory
2+
3+
## Overview
4+
5+
kubelogin is helper tool for kubernetes and oidc integration.
6+
It makes easy to login Open ID Provider.
7+
This document describes how dex work with kubelogin and Active Directory.
8+
9+
examples/config-ad-kubelogin.yaml is sample configuration to integrate Active Directory and kubelogin.
10+
11+
## Precondition
12+
13+
1. Active Directory
14+
You should have Active Directory or LDAP has Active Directory compatible schema such as samba ad.
15+
You may have user objects and group objects in AD. Please ensure TLS is enabled.
16+
17+
2. Install kubelogin
18+
Download kubelogin from https://github.com/int128/kubelogin/releases.
19+
Install it to your terminal.
20+
21+
## Getting started
22+
23+
### Generate certificate and private key
24+
25+
Create OpenSSL conf req.conf as follow:
26+
27+
```
28+
[req]
29+
req_extensions = v3_req
30+
distinguished_name = req_distinguished_name
31+
32+
[req_distinguished_name]
33+
34+
[ v3_req ]
35+
basicConstraints = CA:FALSE
36+
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
37+
subjectAltName = @alt_names
38+
39+
[alt_names]
40+
DNS.1 = dex.example.com
41+
```
42+
43+
Please replace dex.example.com to your favorite hostname.
44+
Generate certificate and private key by following command.
45+
46+
```console
47+
$ openssl req -new -x509 -sha256 -days 3650 -newkey rsa:4096 -extensions v3_req -out openid-ca.pem -keyout openid-key.pem -config req.cnf -subj "/CN=kube-ca" -nodes
48+
$ ls openid*
49+
openid-ca.pem openid-key.pem
50+
```
51+
52+
### Modify dex config
53+
54+
Modify following host, bindDN and bindPW in examples/config-ad-kubelogin.yaml.
55+
56+
```yaml
57+
connectors:
58+
- type: ldap
59+
name: OpenLDAP
60+
id: ldap
61+
config:
62+
host: ldap.example.com:636
63+
64+
# No TLS for this setup.
65+
insecureNoSSL: false
66+
insecureSkipVerify: true
67+
68+
# This would normally be a read-only user.
69+
bindDN: cn=Administrator,cn=users,dc=example,dc=com
70+
bindPW: admin0!
71+
```
72+
73+
### Run dex
74+
75+
```
76+
$ bin/dex serve examples/config-ad-kubelogin.yaml
77+
```
78+
79+
### Configure kubernetes with oidc
80+
81+
Copy openid-ca.pem to /etc/ssl/certs/openid-ca.pem on master node.
82+
83+
Use the following flags to point your API server(s) at dex. `dex.example.com` should be replaced by whatever DNS name or IP address dex is running under.
84+
85+
```
86+
--oidc-issuer-url=https://dex.example.com:32000/dex
87+
--oidc-client-id=kubernetes
88+
--oidc-ca-file=/etc/ssl/certs/openid-ca.pem
89+
--oidc-username-claim=email
90+
--oidc-groups-claim=groups
91+
```
92+
93+
Then restart API server(s).
94+
95+
96+
See https://kubernetes.io/docs/reference/access-authn-authz/authentication/ for more detail.
97+
98+
### kubelogin
99+
100+
Create context for dex authentication:
101+
102+
```console
103+
$ kubectl config set-context oidc-ctx --cluster=cluster.local --user=test
104+
$ kubectl config set-credentials test \
105+
--auth-provider=oidc \
106+
--auth-provider-arg=idp-issuer-url=https://dex.example.com:32000/dex \
107+
--auth-provider-arg=client-id=kubernetes \
108+
--auth-provider-arg=client-secret=ZXhhbXBsZS1hcHAtc2VjcmV0 \
109+
--auth-provider-arg=idp-certificate-authority-data=$(base64 -w 0 openid-ca.pem) \
110+
--auth-provider-arg=extra-scopes="offline_access openid profile email group"
111+
$ kubectl config use-context oidc-ctx
112+
```
113+
114+
Please confirm idp-issuer-url, client-id, client-secret and idp-certificate-authority-data value is same as config-ad-kubelogin.yaml's value.
115+
116+
Then run kubelogin:
117+
118+
```console
119+
$ kubelogin
120+
```
121+
122+
Access http://localhost:8000 by web browser and login with your AD account (eg. test@example.com) and password.
123+
After login and grant, you have following token in ~/.kube/config:
124+
125+
```
126+
id-token: eyJhbGciOiJSUzICuU4dCcilDDWlw2lfr8mg...
127+
refresh-token: ChlxY2EzeGhKEB4492EzecdKJOElECK...
128+
```
129+

‎Documentation/connectors/ldap.md‎

Lines changed: 37 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -253,7 +253,6 @@ groupSearch:
253253
The following configuration will allow the LDAP connector to search a FreeIPA directory using an LDAP filter.
254254

255255
```yaml
256-
257256
connectors:
258257
- type: ldap
259258
id: ldap
@@ -284,3 +283,40 @@ connectors:
284283
If the search finds an entry, it will attempt to use the provided password to bind as that user entry.
285284
286285
[openldap]: https://www.openldap.org/
286+
287+
## Example: Searching a Active Directory server with groups
288+
289+
The following configuration will allow the LDAP connector to search a Active Directory using an LDAP filter.
290+
291+
```yaml
292+
connectors:
293+
- type: ldap
294+
name: ActiveDirectory
295+
id: ad
296+
config:
297+
host: ad.example.com:636
298+
299+
insecureNoSSL: false
300+
insecureSkipVerify: true
301+
302+
bindDN: cn=Administrator,cn=users,dc=example,dc=com
303+
bindPW: admin0!
304+
305+
usernamePrompt: Email Address
306+
307+
userSearch:
308+
baseDN: cn=Users,dc=example,dc=com
309+
filter: "(objectClass=person)"
310+
username: userPrincipalName
311+
idAttr: DN
312+
emailAttr: userPrincipalName
313+
nameAttr: cn
314+
315+
groupSearch:
316+
baseDN: cn=Users,dc=example,dc=com
317+
filter: "(objectClass=group)"
318+
userAttr: DN
319+
groupAttr: member
320+
nameAttr: cn
321+
```
322+

‎examples/config-ad-kubelogin.yaml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
# Active Directory and kubelogin Integration sample
2+
issuer: https://dex.example.com:32000/dex
3+
storage:
4+
type: sqlite3
5+
config:
6+
file: examples/dex.db
7+
web:
8+
https: 0.0.0.0:32000
9+
tlsCert: openid-ca.pem
10+
tlsKey: openid-key.pem
11+
12+
connectors:
13+
- type: ldap
14+
name: OpenLDAP
15+
id: ldap
16+
config:
17+
host: localhost:636
18+
19+
# No TLS for this setup.
20+
insecureNoSSL: false
21+
insecureSkipVerify: true
22+
23+
# This would normally be a read-only user.
24+
bindDN: cn=Administrator,cn=users,dc=example,dc=com
25+
bindPW: admin0!
26+
27+
usernamePrompt: Email Address
28+
29+
userSearch:
30+
baseDN: cn=Users,dc=example,dc=com
31+
filter: "(objectClass=person)"
32+
username: userPrincipalName
33+
# "DN" (case sensitive) is a special attribute name. It indicates that
34+
# this value should be taken from the entity's DN not an attribute on
35+
# the entity.
36+
idAttr: DN
37+
emailAttr: userPrincipalName
38+
nameAttr: cn
39+
40+
groupSearch:
41+
baseDN: cn=Users,dc=example,dc=com
42+
filter: "(objectClass=group)"
43+
44+
# A user is a member of a group when their DN matches
45+
# the value of a "member" attribute on the group entity.
46+
userAttr: DN
47+
groupAttr: member
48+
49+
# The group name should be the "cn" value.
50+
nameAttr: cn
51+
52+
staticClients:
53+
- id: kubernetes
54+
redirectURIs:
55+
- 'http://localhost:8000'
56+
name: 'Kubernetes'
57+
secret: ZXhhbXBsZS1hcHAtc2VjcmV0
58+

0 commit comments

Comments
 (0)