LDAP Authentication

[nightkr]

Description

We want to support LDAP authentication in the given products below.

Products

Tasks

Beta Give feedback

1. LDAP integration for airflow airflow-operator#100
   +0
   
2. Support LDAP authentication druid-operator#144
   type/feature-new +1
   
3. Add LDAP user auth to NiFi nifi-operator#273
   +0
   
4. Support LDAP authentication superset-operator#5
   release-note +1
   
5. Support LDAP authentication trino-operator#38
   release-note release/2022-11 +2
   
6. Make the LDAP documentations self-contained documentation#300
   area/documentation +1
   
7. LDAP refactoring + Trino fix #322
   release-note/action-required release/2023-01 type/bug +3
   
8. Implement authentication with LDAP secured via TLS druid-operator#382
   release/2023-04 type/feature-improvement +2
   

Not in scope:

• HBase -> Kerberos will talk to LDAP
• Hadoop HDFS -> Kerberos will talk to LDAP
• Hive -> not required for metastore
• Kafka -> not supported nativly
• OPA: Will talk to LDAP for authorization (not in scope here for authentication)
• Spark -> not required
• ZooKeeper ->not supported nativly
• Support LDAP authentication without bind credentials druid-operator#383

Acceptance

• LDAP is configurable in the CRD using the LDAP structs from operator-rs
• A user/admin can configure the product to use a LDAP server for authentication
• There is documentation on how to configure the product with LDAP using the Custom Resource
• Optional: There is an example demonstrating the product with LDAP
• There are tests which include:
  • OpenLDAP is installed and accessible via the product
  • Optional: LDAP works encrypted and unencrypted
  • Queries / access to the product works with the LDAP credentials
• It is added to the feature tracker (ask Lars for help)

[maltesander]

I checked and all existing LDAP issues are mentioned here. I checked the unknown / not supported products and this is what i came up with:

Products

• HBase -> Hadoop group mapper maps between LDAP and HBase users https://hbase.apache.org/book.html#hbase.accesscontrol.configuration
• HDFS -> Group level authorization via LDAP possible
• Hive -> Hive server supports LDAP, not sure about the metastore
• Kafka -> Only with plugins. There are some available but not really maintained or just for Kafka 2.x.x (https://github.com/instaclustr/kafka-ldap-integration, https://github.com/insightlake/Kafka-LDAP-Security)
• Spark -> Not needed
• ZooKeeper -> Group permissions can be set up via custom AuthenticationProvider

[fhennig]

I found a ticket and I think it goes well with the acceptance criteria:

There is documentation on how to configure the product with LDAP using the Custom Resource

@siegfriedweber brought this up: the documentation on LDAP is lacking stackabletech/documentation#300

maybe this ticket could be added to the epic?

[lfrancke]

Thank you @fhennig. Is that something we can already get started on?

[fhennig]

The ticket lists a few options, we still have to pick. But we can refine it!

[fhennig]

After we have LDAP authentication everywhere, it would be good to get the LDAP groups into OPA, so support group based authorization. There is already a ticket for it, and I wanted to link it here: stackabletech/opa-operator#237

[lfrancke]

This is all done. I decided to keep the last remaining issue as out-of-scope and I'll close this.

Thank you everyone!