Integrate RADOS Gateway with LDAP

Integrate RADOS Gateway with LDAP

The Ceph RADOS Gateway (RGW) charm (ceph-radosgw) can delegate authentication of

S3 requests to a Lightweight Directory Access Protocol (LDAP) server, in addition to RGW’s local user database. Once LDAP authentication is in place, S3 requests will be validated by looking up the user in the LDAP directory rather than in RGW’s local database.

This guide shows you how to configure LDAP authentication for a deployed ceph-radosgw charm.

Prerequisites

Before configuring LDAP directory settings, ensure you have:

  • An operational Charmed Ceph deployment with the ceph-radosgw charm deployed

  • Administrative access to the Juju model controlling the cluster

  • At least one user account in the LDAP directory

  • Network reachability from the ceph-radosgw units to your LDAP server port (default ports are 389 for unencrypted LDAP and 636 for encrypted LDAP. This number can be set via the config options).

  • Your LDAP directory parameters:

    • LDAP server URI (e.g., ldaps://ldap.example.com)

    • User search base DN (e.g., ou=users,dc=example,dc=com)

    • Bind credentials (if your LDAP server requires authenticated binding; otherwise, for an anonymous bind, ldap-uri and ldap-search-base are sufficient)

WARNING: Do not overlap LDAP and local users: You should not use the same usernames for local users and for users being authenticated by using LDAP. RGW cannot distinguish them and treats them as the same user.

Configure the charm to use LDAP authentication

To enable LDAP authentication on the ceph-radosgw charm, you will need to configure your LDAP directory parameters using the juju config command.

Activate LDAP authentication

LDAP authentication on the ceph-radosgw charm is activated by setting the ldap-uri charm option. Setting this option instructs the charm to collect the remaining LDAP configuration parameters and automatically apply the necessary settings to the underlying RGW daemon.

You must configure the ldap-search-base parameter alongside ldap-uri to activate the LDAP integration.

Caution: ldap-uri requires ldap-search-base*.*

Setting ldap-uri without specifying ldap-search-base will cause the charm unit to enter a blocked status. Always provide both options simultaneously when enabling LDAP integration.

juju config ceph-radosgw \
ldap-uri=‘ldaps://ldap.example.com’ \
ldap-search-base=‘ou=users,dc=example,dc=com’

(Optional) Configure additional parameters

Depending on your directory architecture, configure ldap-uri and ldap-search-base alongside any additional parameters your LDAP server requires, e.g. bind credentials or custom search filters. See our reference section for the list of ceph-radosgw charm configuration options and their intended usage.

Authenticated bind

If your LDAP directory requires a service account to search for users, provide a bind DN and password:

juju config ceph-radosgw \
ldap-uri=‘ldaps://ldap.example.com’ \
ldap-search-base=‘ou=users,dc=example,dc=com’ \
ldap-bind-dn=‘cn=admin,dc=example,dc=com’ \
ldap-bind-password=‘s3cr3t’ \
ldap-user-attr=‘uid’

If ldap-bind-password is set, the charm writes the password to /etc/ceph/ldap.secret with mode 0600 (secure file permissions) and points rgw_ldap_secret at that file. If it is left empty, an anonymous bind is assumed and no secret file is written.

Anonymous bind

If your LDAP server permits anonymous user searches, omit the bind credentials:

juju config ceph-radosgw \
ldap-uri=‘ldaps://ldap.example.com’ \
ldap-search-base=‘ou=users,dc=example,dc=com’ \
ldap-user-attr=‘uid’

Restrict access with additional search filters

By default, any valid user found in the search base can authenticate. You can use the custom LDAP search filter to restrict S3 access to a specific subset of directory users, e.g. members of a security group or accounts matching a specific object class.

For example, to configure authenticated binding while restricting access to standard Linux users, set ldap-search-filter option to objectclass=posixAccount:

juju config ceph-radosgw 
  ldap-uri=‘ldaps://ldap.example.com’   \
  ldap-search-base=‘ou=users,dc=example,dc=com’   \
  ldap-bind-dn=‘cn=admin,dc=example,dc=com’   \
  ldap-bind-password=‘s3cr3t’   \
  ldap-user-attr=‘uid’   \
  ldap-search-filter=‘(objectclass=posixAccount)’   \
Previous Cryptography Previous Report security vulnerabilities Next Explanation Next Ceph architecture

This page was last modified 4 hours ago. Help improve this document in the forum.