Ldap ExternalAuth configuration ECS cluster

[hadoopch]

Hello,
in my opinion it should be possible to configure LDAP for ECS using the ansible collection which is using the API (/ControlPlanesResource/installEmbeddedControlPlane)

I set ExternalAuth in the controlplane_config collection for my ECS cluster (see Extract of defintion.yml at the bottom). But the LDAP settings were ignored for any reasons.
All other configurations (e.g. custom Docker repo) were applied.

Because of this problem i configured the LDAP External authentication via Web-UI and then I made a GET query to the API (/controlPlanes).
The API output for ValuesYaml show a none configured LDAP authentication although ECS LDAP authentication is working (see Get /controlPlanes at the bottom)

Who can support? Is the API working correctly?

Thanks in advance for your support.

Best regards

Uli

1. Extract of definition.yml

clusters:
  - name: "{{kunde}}devecs"
    type: ecs
    services: [DOCKER, ECS ]
    datalake: cdpdevbase
    application_domain: "ecs.example.com"
    ecs_database_mode: embedded
    pvc_repository: "https://cdpsoft2.obs.{{ep_suffix}}/parcels/DS/1.5.3-h1"
    controlplane_config:
       ExternalAuth:
         Type: LDAP
         Config:
           ldap_url: ldap://windc-k1.company.local:389
           ldap_bind_dn: "CN={{mitkrb.remote.adbindprinc}},CN=Users,dc={{mitkrb.remote.domain|split('.')|first}},dc={{mitkrb.remote.domain|split('.')|last}}"
           ldap_bind_pw:  "{{ sec_sssd.bindprinc }}"
           ldap_user_search_base: "dc={{mitkrb.remote.domain|split('.')|first}},dc={{mitkrb.remote.domain|split('.')|last}}"
           ldap_user_search_filter: "(sAMAccountName={0})"
           ldap_group_search_base: "OU=Groups,dc={{mitkrb.remote.domain|split('.')|first}},dc={{mitkrb.remote.domain|split('.')|last}}"
           ldap_group_search_filter: "(member={0})"
       Database:
         Mode: embedded
         EmbeddedDbStorage: 200
       ContainerInfo:
         Mode: custom
         CopyDocker: false
         Username:  ***
         Password:  ****
         Registry: myregistry.example.com/cloudera-docker-images

---snip----

2. GET /controlPlanes

ExternalAuth:
  Config:
    ldap_bind_dn: null
    ldap_bind_pw: null
    ldap_group_search_base: null
    ldap_group_search_filter: "(member={0})"
    ldap_url: null
    ldap_user_search_base: null
    ldap_user_search_filter: "(sAMAccountName={0})"
  Type: "PAM"

[hadoopch]

Hi all,

ECS external authentication configuration is done by using a different API.
You can't use the CM API !!!
Instead use the following API
https://console-cdp.app.<apps-domain>/api/v1/iam/createLdapProvider resp. /api/v1/iam/updateLdapProvider

Uli

[wmudge]

Hi @hadoopch,

I believe you are correct - this endpoint is not part of the CM API, rather is is part of the ECS endpoint API. However, I don't believe this endpoint is documented yet, which is why we don't yet have automation for it. I will look into changing that.

Webster

[hadoopch]

Hi Webster,
thank you for answering. Yes i couldn't find any infos at https://cloudera.github.io/cdp-dev-docs/api-docs/. By using F12 in my browser i was able to collect all required infos. . Here is the json:

{
       "ldapProviderName": "{{ldapauth.ldapProviderName}}",
       "skipGroupSyncOnLogin": "{{ldapauth.skipGroupSyncOnLogin}}",
       "url": "{{ldapauth.url}}",
       "bindDn": "{{ldapauth.bindDn}}",
       "bindPassword": "{{ldapauth.bindPassword}}",
       "userSearchBase": "{{ldapauth.userSearchBase}}",
       "userSearchFilter": "{{ldapauth.userSearchFilter}}",
       "groupSearchBase":  "{{ldapauth.groupSearchBase}}",
       "groupSearchFilter": "{{ldapauth.groupSearchFilter}}",
       "emailMappingAttribute": "{{ldapauth.emailMappingAttribute}}",
       "showAdvanced":  "{{ldapauth.showAdvanced}}",
       "tlsCaCertificates": ["{{ mycacontent_decoded | replace('\n', '\\n') }}"]
}

Best regards
Uli