Home » Blog » OpenShift Authentication with Active Directory Integration

Information

OpenShift Authentication with Active Directory Integration

Benhcmark Administrator

19/10/2025

2 Views 0

SaveSavedRemoved 0

Streamline OpenShift Authentication with Active Directory: A Comprehensive Guide

For enterprises managing large-scale container platforms, user authentication is a critical pillar of security and operational efficiency. While OpenShift provides its own internal user management system, relying on it exclusively is not scalable or secure for most organizations. The solution lies in integrating OpenShift with a centralized identity provider, and for most businesses, that means Microsoft Active Directory (AD).

Integrating OpenShift with Active Directory allows you to leverage your existing corporate user directory as the single source of truth for authentication and authorization. This approach not only enhances security but also dramatically simplifies user lifecycle management. This guide will walk you through the benefits, mechanics, and best practices for configuring this essential integration.

Why Integrate OpenShift with Active Directory?

Connecting your OpenShift cluster to Active Directory moves you from managing isolated user accounts to a streamlined, enterprise-grade authentication system. The key benefits are undeniable:

• Centralized User Management: Eliminate the need to create and manage separate user accounts within OpenShift. When an employee joins or leaves the company, their access is managed in one place—Active Directory. This significantly reduces administrative overhead and the risk of orphaned accounts.
• Enhanced Security: Enforce your organization’s existing security policies, such as password complexity, expiration, and account lockout rules, directly within OpenShift. You are leveraging a battle-tested directory service to secure your container platform.
• Simplified Onboarding and Offboarding: Granting or revoking access to the OpenShift cluster becomes as simple as adding or removing a user from the appropriate AD group. This ensures that access rights are always in sync with an individual’s current role and employment status.
• Robust Role-Based Access Control (RBAC): Map users in AD security groups directly to specific roles and permissions within OpenShift. For example, you can map the ad-dev-group to have edit access in a development project, while the ad-ops-group has cluster-admin rights.

Understanding the Integration: How It Works

The connection between OpenShift and Active Directory is facilitated by the LDAP (Lightweight Directory Access Protocol). Active Directory is, at its core, an LDAP-compliant directory service. OpenShift can be configured to act as an LDAP client, querying AD to validate user credentials and retrieve group membership information.

The authentication flow is straightforward:

1. A user attempts to log in to the OpenShift cluster using the oc login command or the web console with their AD username and password.
2. OpenShift forwards these credentials to the configured LDAP identity provider (your Active Directory).
3. Active Directory attempts to “bind” (authenticate) the user.
4. If the credentials are valid, AD confirms the authentication and returns user attributes, including group memberships.
5. OpenShift creates a user object for the individual (if one doesn’t already exist) and grants them a session token, allowing them to access the cluster with permissions based on their mapped group memberships.

Configuring the LDAP Identity Provider in OpenShift

Setting up the integration involves configuring an OAuth custom resource within your OpenShift cluster. This resource tells OpenShift how to communicate with your Active Directory server.

1. Prerequisites:
Before you begin, ensure you have the following information:

• The hostname or IP address of your Active Directory Domain Controller.
• The port for LDAP communication (typically 389 for standard LDAP or 636 for LDAPS).
• A dedicated AD service account with permissions to search the directory. This account does not need write access.
• The Distinguished Name (DN) of the service account and its password.
• The Base DN for user and group searches (e.g., OU=Users,DC=example,DC=com).

2. Create the Identity Provider Configuration:
You will define an LDAP identity provider in the spec.identityProviders section of your cluster’s oauth.config.openshift.io resource. The configuration specifies how OpenShift should connect, bind, and query for user attributes.

Here is a sample YAML structure for the LDAP identity provider:

- name: my_ad_provider
  mappingMethod: claim
  type: LDAP
  ldap:
    attributes:
      id:
      - dn
      email:
      - mail
      name:
      - cn
      preferredUsername:
      - sAMAccountName
    bindDN: "CN=openshift-ldap,OU=ServiceAccounts,DC=example,DC=com"
    bindPassword:
      name: ldap-secret
      key: bindPassword
    ca:
      name: ad-ca-cert
    url: "ldaps://ad.example.com:636/OU=Users,DC=example,DC=com?sAMAccountName"

In this configuration:

• attributes: Maps AD attributes like sAMAccountName and mail to OpenShift user properties.
• bindDN: The Distinguished Name of your read-only service account.
• bindPassword: References a Kubernetes secret containing the service account password for security.
• url: The LDAPS URL of your domain controller, specifying the search base and the attribute to use for login (sAMAccountName).

Security Best Practices for Integration

To ensure your integration is secure and robust, follow these critical best practices:

• Use LDAPS for Encrypted Communication: Always connect to Active Directory using LDAP over SSL/TLS (LDAPS) on port 636. This encrypts all authentication traffic between your OpenShift cluster and the domain controller, preventing credentials from being intercepted in transit.
• Employ a Read-Only Service Account: The AD account used for the bindDN should have the minimum required permissions. It only needs to search and read user and group attributes. Never use a domain administrator account for this purpose.
• Implement Granular Group Mappings: Avoid granting broad permissions. Create specific AD groups for different roles (e.g., openshift-project-admins, openshift-developers) and map them to corresponding OpenShift roles. This adheres to the principle of least privilege.
• Regularly Audit and Review Permissions: Periodically review which AD groups are synced to your OpenShift cluster and the permissions they hold. This ensures that access rights remain aligned with your organization’s security policies and personnel changes.

By integrating OpenShift with Active Directory, you establish a secure, scalable, and manageable authentication foundation for your entire container ecosystem. This is a foundational step in running OpenShift in a serious enterprise environment.

Source: https://kifarunix.com/integrate-openshift-with-active-directory-for-authn/