Use an LDAP Service

    • You need to deploy a Kubernetes cluster and install KubeSphere in the cluster. For details, see Installing on Linux and .
    • You need to obtain the manager distinguished name (DN) and manager password of an LDAP service.

    Procedure

    1. Log in to KubeSphere as , move the cursor to in the lower-right corner, click kubectl, and run the following command to edit ks-installer of the CRD ClusterConfiguration:

      Example:

    2. Configure fields other than oauthOptions:identityProviders in the spec:authentication section. For details, see .

    3. Configure fields in oauthOptions:identityProviders section.

      • type: To use an LDAP service as an identity provider, you must set the value to LDAPIdentityProvider.
      • : Account mapping method. The value can be auto or lookup.
        • If the value is auto (default), you need to specify a new username. KubeSphere automatically creates a user according to the username and maps the user to an LDAP user.
        • If the value is lookup, you need to perform step 4 to manually map an existing KubeSphere user to an LDAP user.
      • provider:
        • host: Address and port number of the LDAP service.
        • managerDN: DN used to bind to the LDAP directory.
        • userSearchBase: User search base. Set the value to the DN of the directory level below which all LDAP users can be found.
        • loginAttribute: Attribute that identifies LDAP users.
        • mailAttribute: Attribute that identifies email addresses of LDAP users.

    5. After the fields are configured, save your changes, and wait until the restart of ks-installer is complete.

      Note

      The KubeSphere web console is unavailable during the restart of ks-installer. Please wait until the restart is complete.

    6. If you are using KubeSphere 3.2.0, run the following command after configuring LDAP and wait until ks-installer is up and running:

      This is not required in the next release.

    7. Go to the KubeSphere login page and enter the username and password of an LDAP user to log in.

      Note

      The username of an LDAP user is the value of the attribute specified by .