AuthenticationClass

AuthenticationClass is a CRD describing a generic authentication method like LDAP or Kerberos. Multiple operators use this CRD as a way to express the authentication of the product.

At the moment the following Authentication providers are supported:

LDAP

A very simple AuthenticationClass with LDAP Authentication looks like this:

---
apiVersion: authentication.stackable.tech/v1alpha1
kind: AuthenticationClass
metadata:
  name: ldap-simple
spec:
  provider:
    ldap:
      hostname: my.ldap.server (1)
      port: 389 (2)
      searchBase: ou=users,dc=example,dc=org (3)
1 The hostname of the LDAP server without any protocol or port
2 The port of the LDAP server. If TLS is used it defaults to 636 otherwise to 389
3 An optional searchBase where the users should be searched

OpenLDAP

Here is an example that is tuned for an OpenLDAP LDAP server and is configured to read bind user credentials from a secret:

---
apiVersion: authentication.stackable.tech/v1alpha1
kind: AuthenticationClass
metadata:
  name: openldap-simple
spec:
  provider:
    ldap:
      hostname: my.openldap.server
      port: 1389
      searchBase: ou=users,dc=example,dc=org
      bindCredentials:
        secretClass: openldap-simple-bind (1)
---
apiVersion: secrets.stackable.tech/v1alpha1
kind: SecretClass
metadata:
  name: openldap-simple-bind (2)
spec:
  backend:
    k8sSearch:
      searchNamespace:
        pod: {} (3)
---
apiVersion: v1
kind: Secret
metadata:
  name: openldap-simple-bind (4)
  labels:
    secrets.stackable.tech/class: openldap-simple-bind (5)
stringData:
  user: cn=admin,dc=example,dc=org
  password: admin
1 The name of the SecretClass providing the bind credentials (username and password). Must match the name of the SecretClass in this example in ②
2 The name of the SecretClass we are creating that is referred to by ➀. See SecretClass
3 This determines the namespace in which the referenced Secret will be looked for. In this case it searches for a Secret in the same namespace as the product runs in. See the documentation of SecretClass
4 The Secret containing the actual bind credentials. Please keep in mind that the Secret needs to be in the same namespace as the product
5 The name of the SecretClass that wants to refer to this Secret. Must match the name of the SecretClass in this example in ②

The following diagram describes the relationship between the created CRDs

authenticationclass

All possible attributes

The following example shows all possible attributes:

---
apiVersion: authentication.stackable.tech/v1alpha1
kind: AuthenticationClass
metadata:
  name: ldap-full
spec:
  provider:
    ldap:
      hostname: my.ldap.server (1)
      port: 389 (2)
      searchBase: ou=users,dc=example,dc=org (3)
      searchFilter: (memberOf=cn=myTeam,ou=teams,dc=example,dc=org) (4)
      ldapFieldNames: (5)
        uid: uid
        group: memberof
        givenName: givenName
        surname: sn
        email: mail
      bindCredentials:
        secretClass: ldap-full-bind (6)
        scope: (7)
          pod: true
          node: false
          services:
            - ldap-full
      tls: (8)
        verification:
          server:
            caCert:
              secretClass: ldap-full-ca-cert
1 The hostname of the LDAP server without any protocol or port
2 The port of the LDAP server. If TLS is used defaults to 636 otherwise to 389
3 The searchBase where the users should be searched
4 Additional filter that filters the allowed users
5 The name of the corresponding field names in the LDAP objects
6 The name of the SecretClass providing the bind credentials (username and password)
7 The Scope of the SecretClass
8 TLS connection to the LDAP server