---
title: Openshift LDAP authentication
url: https://devopstales.github.io/kubernetes/openshift-ldap/
date: 2019-04-12
keywords: ansible, openshift 3.11, openshift okd, openshift tutorial, openshift container platform, rad hat openshift, open ldap
---


Configure Openshift Cluster to use LDAP as a user backend for login with Ansible-openshift

&lt;!--more--&gt;

{{&lt; content &#34;/filedir/openshift.html&#34; &gt;}}

In the last post I used the basic htpasswd authentication method for the installatipn.&lt;br&gt;
But I can use Ansible-openshift to configure an LDAP backed at the install for the authentication.

### Environment
```
192.168.1.40    deployer
192.168.1.41    openshift01 # master node
192.168.1.42    openshift02 # infra node
192.168.1.43    openshift03 # worker node
```

With Ansible-openshift you can not change the authetication method after Install !! If you installed the cluster with htpasswd, then change to LDAP the playbook trys to add a second authentication methot for the config. It is forbidden to add a second type of identity provider in the version 3.11 of Ansible-openshift so choose wisely.

### Configurate Installer
```
# deployer
nano /etc/ansible/ansible.cfg
# use HTPasswd for authentication
#openshift_master_identity_providers=[{&#39;name&#39;: &#39;htpasswd_auth&#39;, &#39;login&#39;: &#39;true&#39;, &#39;challenge&#39;: &#39;true&#39;, &#39;kind&#39;: &#39;HTPasswdPasswordIdentityProvider&#39;}]

# LDAP
openshift_master_identity_providers=[{&#39;name&#39;: &#39;email_jira_ldap&#39;, &#39;challenge&#39;: &#39;true&#39;, &#39;login&#39;: &#39;true&#39;, &#39;kind&#39;: &#39;LDAPPasswordIdentityProvider&#39;, &#39;attributes&#39;: {&#39;id&#39;: [&#39;mail&#39;], &#39;email&#39;: [&#39;mail&#39;], &#39;name&#39;: [&#39;displayName&#39;], &#39;preferredUsername&#39;: [&#39;mail&#39;]}, &#39;bindDN&#39;: &#39;CN=ldapbrowser,DC=mydomain,DC=myintra&#39;, &#39;bindPassword&#39;: &#39;*******&#39;, &#39;insecure&#39;: &#39;true&#39;, &#39;url&#39;: &#39;ldap://ldap01.mydomain.myintra/dc=mydomain,dc=myintra?mail?sub?(objectClass=*)&#39;}]
```

### Run the Installer
```
# deployer
cd /usr/share/ansible/openshift-ansible/
sudo ansible-playbook -i inventory/hosts.localhost playbooks/prerequisites.yml
sudo ansible-playbook -i inventory/hosts.localhost playbooks/deploy_cluster.yml
```