Integrate the Rados gateway with LDAP

LDAP Authentication

The Ceph RADOS gateway charm (ceph-radosgw) can delegate authentication of
S3 requests to an LDAP server in addition to RGW’s local user database.
This is enabled by setting the ldap-uri charm option.

How it works

When ldap-uri is set, the charm collects the rest of the LDAP configuration
and applies the necessary settings to the underlying gateway. The list of options
and their intended usage is described below. Once this authentication method is
in place, requests will be authenticated by looking up the user in the LDAP
directory rather than in the RGW’s local database.

Configuration options

  • ldap-uri (string, default: empty)
    URI of the LDAP server, e.g. ldaps://ldap.example.com. Setting this
    enables LDAP authentication. This is the only option required to enable
    the feature.

  • ldap-search-base (string, default: empty)
    Base DN used when searching for users, e.g.
    ou=users,dc=example,dc=com. Required whenever ldap-uri is set.

  • ldap-bind-dn (string, default: empty)
    DN used to bind to the directory before performing user searches, e.g.
    cn=admin,dc=example,dc=com. Leave empty for anonymous binding.

  • ldap-bind-password (string, default: empty)
    Password for ldap-bind-dn. Written to /etc/ceph/ldap.secret (mode
    0600) and referenced from rgw ldap secret. Leave empty for anonymous
    binding.

  • ldap-user-attr (string, default: uid)
    LDAP attribute whose value must match the S3 access key / uid presented
    by the client (rendered as rgw ldap dnattr).

  • ldap-search-filter (string, default: empty)
    Additional LDAP search filter applied when looking up users, e.g.
    (objectclass=posixAccount).

Notes

  • If ldap-bind-password is set, the charm writes the password to
    /etc/ceph/ldap.secret with mode 0600 and points rgw ldap secret at
    that file. If it is left empty, an anonymous bind is assumed and no secret
    file is written.
  • The charm blocks (unit status blocked) if ldap-uri is set without
    ldap-search-base (see hooks/utils.py:293).

Example

juju config ceph-radosgw \
    ldap-uri='ldaps://ldap.example.com' \
    ldap-search-base='ou=users,dc=example,dc=com' \
    ldap-bind-dn='cn=admin,dc=example,dc=com' \
    ldap-bind-password='s3cr3t' \
    ldap-search-filter='(objectclass=posixAccount)'
Previous Cryptography Next Ceph architecture

This page was last modified 6 hours ago. Help improve this document in the forum.