# OpenLDAP Support
**URL:** https://forums.suse.com/t/openldap-support/843
**Category:** Rancher 1.x
**Created:** [November 2, 2015, 8:43pm UTC](https://forums.suse.com/t/openldap-support/843 "2015-11-02T20:43:21Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@wizardofmath](https://forums.suse.com/u/wizardofmath)
#### Post date: [November 2, 2015, 8:43pm UTC](https://forums.suse.com/t/openldap-support/843/1 "2015-11-02T20:43:21Z")
I am trying to understand how people plan on using OpenLDAP with Rancher.
1. Full DN ex: cn=UserA,dc=example,dc=com
- This seems like a poor UX
1. Username (i.e. userA, [example.com/UserA](http://example.com/UserA), [userA@example.com](mailto:userA@example.com))
- This causes issues with assuming a specific domain and not supporting multiple/ if any OU’s.
Will you want to use multiple OU’s / Domains within rancher concurrently on one install?
I’m trying to see how Rancher users plan to integrate with OpenLDAP.
---
### Author:  [@madhan.dennis](https://forums.suse.com/u/madhan.dennis)
#### Post date: [November 3, 2015, 4:34am UTC](https://forums.suse.com/t/openldap-support/843/2 "2015-11-03T04:34:43Z")
The way we have setup our LDAP structure is something like this:
An example of how we have setup our rundeck access
- dc=company,dc=net
- ou=users (organizationalUnit)
- cn=UserA (inetOrgPerson)
- cn=UserB (inetOrgPerson)
- cn=UserC (inetOrgPerson)
- ou=groups (organizationalUnit)
- ou=rundeck (organizationalUnit)
- cn=admin (groupOfNames)
- cn=live (groupOfNames)
- cn=staging (groupOfNames)
So now in the above the groupOfNames entries act as our rundeck ‘projects’. So user’s who are added into the admin group have admin access, while users in the staging group have access to the staging projects.
It would be great if something similar was possible on rancher. For example:
- dc=company,dc=net
- ou=users (organizationalUnit)
- cn=UserA (inetOrgPerson)
- cn=UserB (inetOrgPerson)
- cn=UserC (inetOrgPerson)
- ou=groups (organizationalUnit)
- ou=rancher (organizationalUnit)
- cn=admin (groupOfNames)
- cn=live (groupOfNames)
- cn=staging (groupOfNames)
where ou=groups,ou=rancher,cn=admin/live/staging were rancher environments.
Here is a sample of how the LDAP is configured on rundeck (using Jaas) for the above layout.
{
providerUrl=“ldap://LDAP\_SERVER\_DNS:389"
bindDn=”“
bindPassword=”"
authenticationMethod="none"
userBaseDn="ou=users,dc=company,dc=net"
userRdnAttribute="uid"
userIdAttribute="uid"
userPasswordAttribute="userPassword"
userObjectClass="inetOrgPerson"
roleBaseDn="ou=rancher,ou=groups,dc=company,dc=net"
roleNameAttribute="cn"
roleMemberAttribute="member"
roleObjectClass=“groupOfNames”
}
---
### Author:  [@jangrewe](https://forums.suse.com/u/jangrewe)
#### Post date: [November 3, 2015, 8:34am UTC](https://forums.suse.com/t/openldap-support/843/3 "2015-11-03T08:34:15Z")
We will be using just a single domain, and preferrably with only the uid as the login name, without any additional domain info.
---
### Author:  [@akafrmn](https://forums.suse.com/u/akafrmn)
#### Post date: [November 3, 2015, 10:24am UTC](https://forums.suse.com/t/openldap-support/843/4 "2015-11-03T10:24:28Z")
As for us we have separate cn for service accounts:
- dc=company,dc=com
- ou=services
- cn=rancher-service-acc(\*)
- cn=UserB(\*)
- cn=UserC(\*)
- ou=rancher-users
- uid=UserA(\*)
- uid=UserB(\*)
- uid=UserC(\*)
We are going to bind to ldap server with service account (dn: cn=rancher-service-acc,ou=services,dc=company,dc=com, we input this string in service account field ) and make search query based on login username.
To make bind to ldap server in right way we have changed LdapIdentitySearchProvider.java:
```
public Set getIdentities(String username, String password) {
if (!isConfigured()) {
return new HashSet<>();
}
LdapContext userContext;
try {
userContext = login(LdapConstants.SERVICE_ACCOUNT_USER.get(), LdapConstants.SERVICE_ACCOUNT_PASSWORD.get());
// userContext = login();
} catch (RuntimeException e) {
throw new ClientVisibleException(ResponseCodes.UNAUTHORIZED);
}
```
From ldap server we see that bind and search operation successful, but identities are null 😞 as a result we have UNAUTHORISED message, without any exception from cattle.
---
### Author:  [@wizardofmath](https://forums.suse.com/u/wizardofmath)
#### Post date: [November 6, 2015, 9:54pm UTC](https://forums.suse.com/t/openldap-support/843/5 "2015-11-06T21:54:27Z")
We have been using OpenLDAP with phpldapadmin to create the users and groups, but it seems that there are two ways that group management of users can occur.
- mapping of groups to users.
- The other is with direct attribute usage.
Which way are you guys using groups? Or do you have groups using both methods?
---
### Author:  [@111](https://forums.suse.com/u/111)
#### Post date: [November 7, 2015, 3:58pm UTC](https://forums.suse.com/t/openldap-support/843/6 "2015-11-07T15:58:41Z")
Guys please advise how to set up the scheme.
Is anyone able to connect OpenLDAP?
What are the fields I need to correctly fill?
1. Configure an LDAP server
\*_HOSTNAME OR IP ADDRESS_ :\*\*111.111.11.111
\*\*PORT :\*\*636 TLS
\*_SERVICE ACCOUNT USERNAME_ :\*_cn=admin,dc=ldap,dc=example,dc=com
SERVICE ACCOUNT PASSWORD :_ \*\*\*\*\*\*\*\*\*\*\*\*
\*_SEARCH BASE_ :\*\*dc=ldap,dc=example,dc=com
\*_DEFAULT LOGIN DOMAIN_ :\*\*[example.com](http://example.com)
2. Customize Schema
Users
\*\*OBJECT CLASS :\*\*person
\*\*LOGIN FIELD :\*\*cn
\*\*NAME FIELD :\*\*name
\*\*SEARCH FIELD :\*\*cn
\*\*STATUS FIELD :\*\*userAccountControl
\*\*DISABLED STATUS BITMASK :\*\*2
Groups
\*\*OBJECT CLASS :\*\*group
\*\*NAME FIELD :\*\*name
\*\*SEARCH FIELD :\*\*cn
3. Test and enable authentication
\*_YOUR USERNAME_ :\*_cn=admin,dc=ldap,dc=example,dc=com
YOUR PASSWORD :_ \*\*\*\*\*\*\*\*\*\*\*\*
---
### Author:  [@wizardofmath](https://forums.suse.com/u/wizardofmath)
#### Post date: [November 9, 2015, 2:07am UTC](https://forums.suse.com/t/openldap-support/843/7 "2015-11-09T02:07:58Z")
@111 Right now Rancher does not support OpenLDAP. The purpose of this thread is to aid in figuring out the Implementation we will use.
---
### Author:  [@111](https://forums.suse.com/u/111)
#### Post date: [November 10, 2015, 7:20pm UTC](https://forums.suse.com/t/openldap-support/843/8 "2015-11-10T19:20:03Z")
> [@wizardofmath](#):
>
> The purpose of this thread is to aid in figuring out the Implementation we will use.
I do not understand the answer. Will you implement? If so then when do you plan to do it? Thank you for your great work!
---
### Author:  [@denise](https://forums.suse.com/u/denise)
#### Post date: [November 10, 2015, 7:24pm UTC](https://forums.suse.com/t/openldap-support/843/9 "2015-11-10T19:24:34Z")
@111 This will be added to Rancher, when the following issue is closed. You can also follow the announcements category to get updates on when we release new versions and it will include the release notes of what’s in the release.
>
>
> Hi,
> Is there any plans to allow OpenLDAP based access control? The current implementation is quite specific to AD since it uses...
---
### Author:  [@111](https://forums.suse.com/u/111)
#### Post date: [November 10, 2015, 7:38pm UTC](https://forums.suse.com/t/openldap-support/843/10 "2015-11-10T19:38:37Z")
💪 It will great!
---
### Author:  [@bill](https://forums.suse.com/u/bill)
#### Post date: [July 10, 2016, 7:00am UTC](https://forums.suse.com/t/openldap-support/843/11 "2016-07-10T07:00:50Z")
If I’d like to automation the ldap setting in Rancher server. What can I do?
For example, I can run ansible-playbook to install rancher sever, then prefer to add it in openldap directly, which config file should I update?
====
Updates:
I got the answer by myself, it is in these documents.
> **[rancher/rancher](https://github.com/rancher/rancher/wiki/LDAP-TLS-Configuration)**
>
> rancher - Complete container management platform
> **[rancher/rancher](https://github.com/rancher/rancher/wiki/Ldap-Auth-Configuration)**
>
> rancher - Complete container management platform