Closed ikke-t closed 6 months ago
For comparison, I don't see difference in config from my helm:
╰─➤ oc get -o yaml cm ldap-group-syncer
apiVersion: v1
data:
sync.yaml: |
kind: LDAPSyncConfig
apiVersion: v1
url: 'ldaps://rh-idm-01.cool.lab'
insecure: false
bindDN: 'uid=aap_ldap,cn=sysaccounts,cn=etc,dc=cool,dc=lab'
bindPassword:
file: "/etc/secrets/bindPassword"
ca: /etc/ldap-ca/ca.crt
rfc2307:
groupsQuery:
baseDN: 'cn=groups,cn=accounts,dc=cool,dc=lab'
scope: sub
derefAliases: never
pageSize: 0
filter: (objectClass=ipausergroup)
groupUIDAttribute: dn
groupNameAttributes: [ cn ]
groupMembershipAttributes: [ member ]
usersQuery:
baseDN: 'cn=users,cn=accounts,dc=cool,dc=lab'
# filter: (objectClass=inetOrgPerson)
scope: sub
derefAliases: never
pageSize: 0
userUIDAttribute: dn
userNameAttributes: [ uid ]
tolerateMemberNotFoundErrors: false
tolerateMemberOutOfScopeErrors: false
kind: ConfigMap
comparing to the one I have in group sync operator:
- op: add
path: /spec/providers
value:
- ldap:
credentialsSecret:
name: ldap-secret
namespace: openshift-config
caSecret:
name: ca-config-map
namespace: openshift-config
kind: ConfigMap
key: ca.crt
insecure: false
rfc2307:
groupMembershipAttributes:
- member
groupNameAttributes:
- cn
groupUIDAttribute: dn
groupsQuery:
baseDN: 'cn=groups,cn=accounts,dc=cool,dc=lab'
derefAliases: never
filter: (objectClass=ipausergroup)
scope: sub
tolerateMemberNotFoundErrors: true
tolerateMemberOutOfScopeErrors: true
userUIDAttribute: dn
userNameAttributes:
- uid
usersQuery:
baseDN: 'cn=users,cn=accounts,dc=cool,dc=lab'
derefAliases: never
scope: sub
url: ldaps://rh-idm-01.cool.lab
name: ldap
thanks for Andrew finding my error. I had forgotten to use the right secret. I created group-sync secret in group-sync-operator namespace, but forgot to change the GroupSync object to point to that instead of the openshift-config namespace ldap-secret, which is having different fields (bindPassword instead of password)
Hi,
now that I got group sync going for LDAP, I'm only half there. For some reason it doesn't pull the group members:
So each group shows empty. Now compare this to another cluster with LDAP sync setup following the ocp docs against the same IdM LDAP server:
So some last step to pull the group members is missing from the operator.