WIP for Siggi :)

examples/openldap.yaml

@@ -0,0 +1,68 @@
+# Run on openldap Pod:
+# ldapsearch -H ldap://openldap.default.svc.cluster.local:1389 -D cn=admin,dc=example,dc=org -w admin -b ou=users,dc=example,dc=org
+#
+# cat << 'EOF' | ldapadd -H ldap://openldap.default.svc.cluster.local:1389 -D cn=admin,dc=example,dc=org -w admin
+# dn: cn=superset,ou=users,dc=example,dc=org
+# objectClass: inetOrgPerson
+# objectClass: posixAccount
+# objectClass: shadowAccount
+# cn: superset
+# uid: superset
+# givenName: Apache
+# sn: Superset
+# mail: superset@apache.com
+# uidNumber: 16859
+# gidNumber: 100
+# homeDirectory: /home/superset
+# loginShell: /bin/bash
+# userPassword: {crypt}x
+# shadowLastChange: 0
+# shadowMax: 0
+# shadowWarning: 0
+# EOF
+#
+# ldappasswd -H ldap://openldap.default.svc.cluster.local:1389 -D cn=admin,dc=example,dc=org -w admin -s superset "cn=superset,ou=users,dc=example,dc=org"
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: openldap
+ labels:
+ app.kubernetes.io/name: openldap
+spec:
+ selector:
+ matchLabels:
+ app.kubernetes.io/name: openldap
+ replicas: 1
+ template:
+ metadata:
+ labels:
+ app.kubernetes.io/name: openldap
+ spec:
+ containers:
+ - name: openldap
+ image: docker.io/bitnami/openldap:latest
+ imagePullPolicy: Always
+ env:
+ - name: LDAP_ADMIN_USERNAME
+ value: admin
+ - name: LDAP_ADMIN_PASSWORD
+ value: admin
+ ports:
+ - name: tcp-ldap
+ containerPort: 1389
+---
+apiVersion: v1
+kind: Service
+metadata:
+ name: openldap
+ labels:
+ app.kubernetes.io/name: openldap
+spec:
+ type: ClusterIP
+ ports:
+ - name: tcp-ldap
+ port: 1389
+ targetPort: tcp-ldap
+ selector:
+ app.kubernetes.io/name: openldap

examples/superset-with-ldap.yaml

@@ -25,9 +25,9 @@ metadata:
 spec:
  protocol:
  ldap:
- hostname: ldap.server
- port: 389
- domain: domain.local
+ hostname: openldap.default.svc.cluster.local
+ port: 1389
+ domain: ou=users,dc=example,dc=org
  bindCredentials:
  secretClass: superset-with-ldap-ldap-bind-secret-class
 # scope:
@@ -53,8 +53,8 @@ metadata:
  labels:
  secrets.stackable.tech/class: superset-with-ldap-ldap-bind-secret-class
 stringData:
- user: myLdapUser
- password: myLdapPassword
+ user: cn=admin,dc=example,dc=org
+ password: admin
 ---
 apiVersion: superset.stackable.tech/v1alpha1
 kind: SupersetCluster

rust/operator-binary/src/config.rs

@@ -31,19 +31,24 @@ STATS_LOGGER = StatsdStatsLogger(host='0.0.0.0', port=9125)
  r#"
 # authentication configs
 AUTH_TYPE = AUTH_LDAP
-AUTH_LDAP_SERVER = "ldap://{}"
+AUTH_LDAP_SERVER = "ldap://{}:{}"
 AUTH_LDAP_USE_TLS = False
-# AUTH_USER_REGISTRATION = True
-# AUTH_USER_REGISTRATION_ROLE = "Public"
+
+AUTH_USER_REGISTRATION = True
+AUTH_USER_REGISTRATION_ROLE = "Admin"
+AUTH_ROLES_SYNC_AT_LOGIN = True # If we should replace ALL the user's roles each login, or only on registration
 AUTH_LDAP_FIRSTNAME_FIELD = "givenName"
 AUTH_LDAP_LASTNAME_FIELD = "sn"
 AUTH_LDAP_EMAIL_FIELD = "mail"
-# AUTH_LDAP_SEARCH = "ou=users,dc=example,dc=com"
+
+AUTH_LDAP_SEARCH = "{}"
 AUTH_LDAP_UID_FIELD = "uid"
 AUTH_LDAP_BIND_USER = open('/authentication-config-{authentication_class_name}/user').read()
 AUTH_LDAP_BIND_PASSWORD = open('/authentication-config-{authentication_class_name}/password').read()
 "#,
- ldap.hostname
+ ldap.hostname,
+ ldap.port,
+ ldap.domain,
  )
  }
  }