When your business uses OpenLDAP, you can integrate with your existing LDAP server to manage your users in this domain. This allows the administrators to control access to clusters and projects based on users and groups managed externally in the directory, while allowing end users to authenticate with their LDAP credentials when signing in to EonKube.

Prerequisites

Set up an OpenLDAP server.

Procedure

1. Go to EonKube > Admin > Management > Users & Authentication.
2. On the left navigation panel, click Auth Provider.
3. Click OpenLDAP.
4. To configure an Active Directory account, specify the following settings:
   • Hostname/IP: Specify the hostname or IP address of your AD server.
   • Port: Specify the port at which the AD server is listening for connections. Unencrypted LDAP normally uses the standard port of 389, while LDAPS uses port 636.
   • (Optional) TLS: To use AD over SSL/TLS, click to enable this option.
   • Server Connection Timeout: The duration in number of milliseconds that EonKube waits before considering the AD server unreachable. The default is 5000 milliseconds.
5. To configure a service account, specify the following settings:
   • Service Account Distinguished Name: Specify an AD account with read-only access to your domain. Enter the username of an AD account with read-only access to your domain. The username can be entered in NetBIOS format (e.g. "DOMAIN\serviceaccount") or UPN format (e.g. "serviceaccount@domain.com").
   • Service Account Password: Enter the password.
   • Default Login Domain: Configure this field with a NetBIOS name. If the service account username does not contain a domain name, it will be automatically converted.
   • User Search Base: Specify the distinguished name of the node in your directory tree from which to start searching for user objects. All users must be descendants of this base DN. For example: "ou=user,dc=mycompany,dc=com".
   • (Optional) Group Search Base: If your groups live under a different node than the one configured under User Search Base, specify the Distinguished Name here. For example: "ou=groups,dc=acme,dc=com". Otherwise, leave it empty.
6. Go to the Customize Schema section. Specify a correct mapping of user and group attributes corresponding to the schema used in your directory. The attribute mappings are used to build search filters and resolve group membership.
7. Go to the Test and Enable Authentication section. Specify the username and password for the AD account that is mapped to the local principal account.
8. Click Authenticate with Active Directory.
9. Click Enable.