Aller au contenu principal

LDAP Security

Aperçu​

Managing user credentials across multiple services can be challenging. LDAP (Lightweight Directory Access Protocol) offers a centralized solution, enabling single sign-on (SSO) and streamlining user management.

Ilum integrates smoothly with LDAP servers. Configuration is handled via Helm, allowing you to set connection details, define authentication queries, and map LDAP attributes to Ilum’s internal user model.

Attribute mapping is flexible: you can link LDAP groups and roles—including relationships such as user-to-group and group-to-role—and map user attributes like email, full name, and description directly to Ilum profiles.

Once LDAP integration is set up, users log in to Ilum using their LDAP credentials. Ilum automatically synchronizes user data from the LDAP server according to your Helm configuration, creating and updating profiles and permissions as needed.

Démarrage rapide​

LDAP is available as a module in Ilum, making the setup straightforward.

Set the following values:

ilum-core:
  sécurité:
    type: LDAP

openLDAP:
  Activé: vrai

This configuration deploys an OpenLDAP server with default settings and connects Ilum Core to it.

The default OpenLDAP server is accessible at ldap://ilum-openldap:389 and includes two sample users:

  • ilumadmin (password: Admin)
  • ilumuser (password: utilisateur)
info

For more details on Ilum’s OpenLDAP usage, visit our Artifact Hub page.

Manual OpenLDAP Setup​

After testing the default configuration, you may wish to set up your own OpenLDAP instance. Here are some configuration options to consider:

global:
  ldapDomain: ilum.cloud # Your LDAP domain (requirement of the OpenLDAP chart, not Ilum)

ilum-core:
  sécurité:
    type: LDAP
    LDAP:
      Urls:
        - LDAP://ilum-openLDAP:389 # OpenLDAP URL
      ilumToLdapSync: faux # More on this below
      base: "dc=ilum,dc=cloud" # Base DN for LDAP
      adminUtilisateurs: # Usernames of users which should be made admins
        - ilumadmin
      mot de passeEncodeur: adaptatif
      userMapping: # Mapping between LDAP and Ilum user attributes
        # The enabled and enabledValue attributes are important for user activation
        Activé: employeeType
        enabledValue: active
        # ...
      groupMapping: # Mapping between LDAP and Ilum group attributes
        # ...
      roleMapping: # Mapping between LDAP and Ilum role attributes
        # ...

Default OpenLDAP LDIF files Ilum uses:

00-root.ldif: |- # This file is used to create the root domain - the first step in the LDAP setup
  Dn: dc=ilum,dc=cloud
  ObjectClass: Retour au début
  ObjectClass: domaine
  o: Ilum

01-organizational-units.ldif: |- # This file is used to create the organizational units in the LDAP
  Dn: ou=groups,dc=ilum,dc=cloud
  ObjectClass: Retour au début
  ObjectClass: organisationnelUnité
  ou: groupe

  Dn: ou=sous-groupes,dc=ilum,dc=cloud
  ObjectClass: Retour au début
  ObjectClass: organisationnelUnité
  ou: Sous-groupes

  Dn: ou=personnes,dc=ilum,dc=cloud
  ObjectClass: Retour au début
  ObjectClass: organisationnelUnité
  ou: gens

02-admin-user.ldif: |- # This file is used to create the admin user in the LDAP
  Dn: uid=ilumadmin,ou=personnes,dc=ilum,dc=cloud
  ObjectClass: Retour au début
  ObjectClass: personne
  ObjectClass: organisationPerson
  ObjectClass: inetOrgPerson
  Cn: Ilum Admin
  Sn: Admin
  Uid: ilumadmin
  courrier: [email protected]
  description: Ilum Admin
  userPassword: Admin
  employeeType: active

03-user.ldif: |- # This file is used to create the user in the LDAP
  Dn: uid=ilumuser,ou=personnes,dc=ilum,dc=cloud
  ObjectClass: Retour au début
  ObjectClass: personne
  ObjectClass: organisationPerson
  ObjectClass: inetOrgPerson
  Cn: Ilum User
  Sn: Utilisateur
  Uid: ilumuser
  courrier: [email protected]
  description: Ilum User
  userPassword: utilisateur
  employeeType: active
note

For more information about the OpenLDAP chart used by Ilum, see its Référentiel GitHub ou Artifact Hub page.

LDAP with SSL​

For secure connections, Ilum fully supports LDAPS (LDAP over SSL).

To enable LDAPS:

  • Provide a truststore containing your LDAP server’s CA certificate. See the Truststore documentation for details.
  • (Optional) Provide a keystore if your LDAP server requires mutual TLS (mTLS) with a client certificate.

Démarrage rapide​

note

This section uses a convenience tool called mkcert to generate a self-signed certificate. You can learn more about it ici.

Let’s begin by generating a TLS certificate for our LDAP server with mkcert:

mkcert ilum-openldap ldap localhost 127.0.0.1

The arguments passed to mkcert are the domains we want our certificate to cover.

This command will output two files:

  • ilum-openldap+3-key.pem: Private key for the certificate
  • ilum-openldap+3.pem: Certificate itself

Now, we need to load-in the certificate into our kubernetes cluster:

kubectl create secret tls openldap-tls --cert=./ilum-openldap+3.pem --key=./ilum-openldap+3-key.pem

This will create a TLS secret named openldap-tls containing the certificate and private key.

Lastly, we need to load the mkcert certificate authority into our cluster as well. You can see where the CA is stored by running mkcert -CAROOT. It should give you a path, where a file named rootCA.pem is located. Point to this file when executing the following command:

kubectl create secret generic mkcert-ca --from-file=ca.crt=/path/to/rootCA.pem

This will create a Kubernetes secret named mkcert-ca containing the CA certificate.

Now, it is enough to adjust your Helm configuration to use the TLS secret and CA secret:

ilum-core:
  sécurité:
    type: LDAP
    LDAP:
      Urls:
        - LDAPS://ilum-openLDAP:636 # Use ldaps:// and the correct port
    
    # Basic configuration for importing the CA certificate to Ilum's trust store
    trustStore:
      Activé: vrai
      mode: single
      secretName: mkcert-ca

openLDAP:
  Activé: vrai
  initTLSSecret:
    tls_enabled: vrai
    secret: "openldap-tls" # Point to the TLS secret created earlier

With this configuration Ilum will use the TLS certificate to connect to LDAPS.

Keystore Configuration​

However, we can go a step further and use a keystore to authenticate our client.

Prepare a PKCS#12 file containing your client certificate and private key:

openssl pkcs12 -export -in ilum-openldap+3.pem -inkey ilum-openldap+3-key.pem -certfile <your-CA-cert> -name "client-cert" -out client.p12 -password pass:yourpassword

Create a Kubernetes secret with the keystore:

kubectl create secret generic ilum-keystore --from-file=magasin de clés.p12=client.p12

Now, add to the values:

ilum-core:
  sécurité:
    # ...
    keyStore:
      Activé: vrai
      secretName: "ilum-keystore" # Name of the Kubernetes secret
      secretFileName: « keystore.p12 » # File name within the secret
      mot de passe: « CHANGE-MOI, S’IL TE PLAÎT » # Keystore password

ILUM ↔ LDAP Synchronization​

Ilum supports bidirectional synchronization with LDAP. When enabled, changes to users, groups, or roles in Ilum are automatically reflected in LDAP.

To enable synchronization, set ilum-core.security.ldap.ilumToLdapSync À vrai in your Helm configuration.

LDAP Sync From in Ilum UI Selecting this checkbox in the UI enables user synchronization with LDAP

Synchronization covers users, groups, and roles, provided attribute mappings are correctly defined in your Helm valeurs.yaml.

Configuration complète​

A complete configuration example:

ilum-core:
    sécurité: 
        type: LDAP
        LDAP: 
            base: «  »
            Urls:
            - LDAP://<domain>:>
            nom d’utilisateur: «  »
            mot de passe: «  »
            mot de passeEncodeur: >
            adminUtilisateurs: 
                - -utilisateur>
            userMapping:
                base: «  »
                filtre: «  »
                mot de passe: «  »
                nom d’utilisateur: «  »
                nom complet: «  »
                description: «  »
                département: «  »
                Messagerie électronique: «  »
                Activé: «  »
                enabledValue: «  »
            groupMapping:
                base: «  »
                filtre: «  »
                memberAttribute: «  »
                roleFilterAttribute: «  »
                nom: «  »
                description: «  »
                Rôles: «  »
                Activé: «  »
                enabledTrue: «  »
            roleMapping:
                base: «  »
                filtre: «  »
                memberAttribute: «  »
                nom: «  »
                description: «  »
                Activé: «  »
                enabledTrue: «  »

Activé, enabledTrue​

These options map the ENABLED/DISABLED state from LDAP to Ilum.

  • Activé: Name of the LDAP attribute containing the state.
  • enabledTrue (ou enabledValue for users): Value representing ENABLED.

Example mapping:

dn : uid=george,ou=people,dc=springframework,dc=org
objectclass : haut
objectclass : personne
objectclass :organizationalPerson
objectclass : inetOrgPerson
cn : George Ardenson
courrier: [email protected]
Description : Datascientist dans la détection des fraudes
UID : George
userPassword : pass
État : ON

Configuration:

userMapping:
    Activé: « statut »
    enabledValue: « sur »

You can similarly map states for roles and groups.

note

By default, vrai et Activé are interpreted as ENABLED.

avertissement

Ensure a valid value is set for the Activé attribute. Otherwise, Ilum will treat users as DISABLED by default.

Rôles et roleFilterAttribute​

These options map group-to-role relationships from LDAP to Ilum.

  • Rôles: Group attribute containing role names.
  • roleFilterAttribute: Optionally binds values from Rôles to an attribute in the LDAP role.

Example mapping:

dn : cn=datascientist,ou=sous-groupes,dc=springframework,dc=org
objectclass : haut
objectclass : groupOfNames
CN : Datascientist
Membre : UID=george
businessCategory : « Analyse globale des données »
ident : « KQ320 »

dn : cn=utilisateurs,ou=sous-groupes,dc=springframework,dc=org
objectclass : haut
objectclass : groupOfNames
CN : Datascientist
Membre : uid=Alice
Membre : uid=bob
Membre : UID=george
businessCategory : « Analyse globale des données »
Rôles : KQ320
Rôles : BR200
Rôles : LL100

Configuration:

groupMapping:
    Rôles: Sous-groupes
    roleFilterAttribute: Ident
note

If roleFilterAttribute is not set, Ilum will match LDAP roles by name or create new ones as needed

mot de passeEncodeur​

Supported values:

  • adaptatif
  • bcrypt
  • MD5
  • sha256

These specify the password encoder used by your LDAP server.

By default, Ilum uses the adaptive encoder, which detects the prefix (e.g., {bcrypt} ou {noop}) and selects the appropriate encoder for credential verification. If no prefix is present, no encoder is applied.

Last updated on