confluentinc / confluentinc/confluent-kubernetes-examples
LDAP authentication into control center not working when bindDn and bindPassword are configured using secrets
- Dominant language
- Shell
- Stars
- 72
- Forks
- 201
- Avg merge
- 10h 2m
- Merged PRs (30d)
- 2
Description
We tried to configure the `bindDn` and `bindPassword` using secrets as shown [here](https://github.com/confluentinc/confluent-kubernetes-examples/blob/master/security/plaintext-ldaps-auth-control-center/confluent-platform-ccc-ldaps.yaml#L105) for control center. However it doesn't work as expected. When we configure the `bindDn` and `bindPassword` in-line (as shown [here](https://github.com/confluentinc/confluent-kubernetes-examples/blob/master/security/plaintext-ldap-auth-control-Center/confluent-platform-ccc-ldap.yaml#L82)) it works as expected.
Upon further investigation, we noticed that the jaas-config.file on the pod is malformed when the configuration is via secrets. See below (the `bindDn` appears to have a double quote at the beginning of the line)
```
bash-4.4$ cat /mnt/config/shared/jaas-config.file
ldap {
org.eclipse.jetty.jaas.spi.LdapLoginModule required
debug="false"
authenticationMethod="simple"
" bindDn="CN=sa_confluentldapbind,OU=RBAC,DC=xx,DC=xx,DC=com
bindPassword="xxx"
contextFactory="com.sun.jndi.ldap.LdapCtxFactory"
forceBindingLogin="true"
hostname="xx.xx.com"
port="389"
roleBaseDn="ou=RBAC,dc=xx,dc=xx,dc=com"
roleMemberAttribute="member"
roleNameAttribute="cn"
roleObjectClass="group"
useLdaps="false"
userBaseDn="dc=xx,dc=xx,dc=com"
userIdAttribute="sAMAccountName"
userObjectClass="user"
userPasswordAttribute="Password"
userRdnAttribute="sAMAccountName";
};
```
Our environment is on GCP. We tried to replicate this locally on a minikube using the exact same configuration, but the jaas-config.file rendered correctly on minikube. So wondering if this could be a bug specific to a particular platform?
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.