►
Description
In previous episodes we’ve brushed up against the topic of authentication and authorization, but today we’re going to go in-depth and answer your questions about how the mechanisms work and how to customize them for your organization.
Have you ever wondered how LDAP groups are synced? How do you determine what verbs need to be allowed for a ClusterRole or Role? Are there benefits to using one authentication method over another? Bring all your questions about managing permissions in OpenShift, we’re here to answer them!
About Ask an OpenShift Admin:
Do you have questions? We want to answer them! Every Wednesday at 11am ET, hosts Andrew Sullivan and Chris Short sit down to answer your questions about Red Hat OpenShift.
Follow us:
Andrew Sullivan https://twitter.com/practicalandrew
Chris Short https://twitter.com/chrisshort
Subscribe to Red Hat's YouTube channel: https://www.youtube.com/redhat/?sub_confirmation=1
About OpenShift:
Red Hat OpenShift is an open source container application platform based on the Kubernetes container orchestrator for enterprise application development and deployment.
Openshift.com https://red.ht/33Fh6uV
OpenShift on github https://github.com/openshift/
OpenShift on redhat.com https://red.ht/2o4ccDk
#RedHat #OpenShift #ContainerPlatform
A
A
A
B
Definitely
so
I
I
wanna
yes,
authentication
authorization
is
today's
topic,
and
my
goal
here
and
chris-
and
I
were
talking
about
this
before
the
stream
went-
live-
is
more
or
less
to
convey
that
this
is
pretty
straightforward.
You
know,
I've
got
some
things
planned,
you'll
notice
that
it's
just
chris
and
I
you
know
the
first
time
in
a
while
that
we
haven't.
C
A
C
B
B
This
is
you
know,
this
is
the
office
hours
so
ask
questions.
Ask
us
to
dive
into
things.
You
know.
If,
if
we,
if
I
can,
if
I
have
the
resources,
I
will
go
through
and
try
and
explore
that
but
yeah.
I
want
to
look
at
setting
up
both
ht
password,
httpd
authentication,
as
well
as
ldap
with
active
directory,
and
I
chose
those
two
simply
because
hd
password
is
usually
my
default,
because
it's
just
super
duper
simple
like
it's.
B
B
B
A
B
A
B
Know
well
it
and
it's
funny,
because
again
you
and
I
were
talking
before
the
show
of
I
think
a
lot
of
organizations
are
starting
to
adopt
azure
active
directory.
You
know
kind
of
goes
along
with
the
whole
office
online
office
365.
You
know,
a
lot
of
folks
are
adopting
the
software
as
a
service
aspect,
and
you
know
why
not
offload
something
else.
That's
just
you
know.
Active
directory
is
not
exciting.
C
B
B
B
B
That
is
in
many
ways
contradictory
to
the
type
of
experience
that
you
know.
I
think
many
people
are
used
to
right
of
I
deploy
a
cluster.
My
cluster
is,
you
know,
mine,
I
log
into
it
right.
I
administer
it.
I
go
in
and
I
edit
things
and
manage
things
and
configure
things
as
needed.
Maybe
we
have
some
sort
of
change,
control
process
right,
the
infamous
itil
for
anybody
who's
worked
in
and
around
especially
government.
You
know,
government
loves
itil,
so
you
know
I
I
think
it's
important
to
have
this
conversation
around.
B
Is
there
a
recommended
way?
Is
there
a
best
way?
Is
there
something
that
red
hat
recommends?
You
know
for
an
open
shift
cluster
right,
so
you
know
chris,
of
course
I
I
would
love
to
have
your
opinion
audience.
You
know,
please
contribute
your
opinion
as
well,
but,
from
my
perspective,
andrew
is
very
much
the
the
switzerland
of
these
things
right.
I
I
take
the
approach
of
you.
B
Do
what
works
best
for
you
and
my
response
to
the
red
hatter
who
who
was
asking
this
question
was
more
or
less
along
the
lines
of
you
know.
Every
organization
has
different
skill
sets,
has
different
personalities
and
those
personalities.
You
know
some
of
them
are
big.
Some
of
them
are
small,
we're
all
affected
by
what
I
call
the
burn
factor.
B
Shapes
your
willingness,
your
tolerance
for
adopting
you
know
different
different
things,
so
openshift
is
flexible
enough
that
you
can
do
many
of
these
multiple
of
these.
At
the
same
time,
right
you
can
tell,
for
example,
if
you're
using
getups
for
application
deployment,
you
can
have
it
ignore
aspects
of
cluster
configuration.
B
A
A
With
john
willis
for
a
while,
as
you
know,
like
devops
consultants
kind
of
deal-
and
we
tried
to
stay
away
from
like
specific
tooling,
because
it
was
always
like
every
organization
had
their
thing
right,
yeah
and
they
wanted
to
use
that
thing.
No
matter
what,
because
it
was
already
in
place,
they
didn't
want
to
reinvent
the
wheel.
So
I'm
very
much
in
the
same
vein
as
you
right,
like
the
personalities,
the
talent,
the
systems
you
have
in
place
already,
like
don't
reinvent
the
wheel,
utilize
them.
A
But
yeah
I
mean
it
was
cumbersome
to
use
ad,
not
in
the
cloud
like
on-prem
with
some
of
our
aws
stuff.
So
we
just
kind
of
said
all
right.
Well
how
about
a
guest
bubble
work?
Okay,
security
team?
You
can
manage.
You
know
who's
in
that
who's.
Out
of
that,
and
you
know
the
administrative
functions
of
you
know,
person
leaves
company
they
get.
We
had
all
that
automated
right
yeah.
It
was
just
one
of
those
things
where
it's
like
hr
did
this:
that
user
id
doesn't
exist
anymore
in
ad.
A
B
Yeah
and
it's
interesting
you
bring
up,
you
know,
philosophies
like
devops
and
git.
Ops
is
the
same
way
and
chat
ops,
and
you
know
all
of
these
other
things
right
of
there's
a
lot
of
folks
who
believe
that
like
in
order
to
be
successful,
I
have
to
adopt
this
100
percent.
It's
either
all
get
ups
or
it's
none.
It's
either
all
devops
or
it's
none.
But
you
know
you
know
far
better
than
I
do
that
devops.
Is
this
huge
spectrum
of
things.
B
A
B
Yeah
well
there's
reasons
for
that
and
I
used
to
have
this
conversation
all
the
time
of.
You
know
why.
Why
is
the
storage
admin
reluctant
to
change
reluctant
to
do
these
things?
Well,
it's
because
we've
all
gotten
those
angry
middle
of
the
night
emails
or
phone
calls
because
something
broke.
Why
did
it
break
well
because
of
x
or
y
or
z?
Well,
now
I'm
going
to
be
cautious
of
remember
that
burn
factor,
I'm
going
to
be
cautious
of
affecting
that
in
the
future.
B
So
funny
enough,
I
used
to
blame
virtualization
for
why
storage
admins
are
so
grumpy,
so
maybe
so
the
rationale
is
pre
call
it
2008
right,
storage
arrays
were
responsible,
basically
only
for
application
data
right.
I
had
a
physical
server
in
a
rack.
It
had
a
fiber
channel
connection
over
to
the
storage
array.
The
only
thing
on
that
storage
array
was
whatever
the
application
was
using
and
then
almost
overnight
you
know
global
recession.
B
B
Storage
systems,
especially
the
big
frame,
arrays
and
stuff,
like
that
they
have
lifespans
of
10
plus
years,
so
you
know
suddenly
they
became
responsible
for
all
this
and
it's
you
know
why
is
it
so
slow,
well,
storage,
latency,
because
we're
running
you
know
x,
number
of
drives
at
whatever
speed
you
know
back
in
the
2000s,
it
was
still
mostly
spinning
media.
That
was
all
if
not
all
spammy
drive
yeah
yeah.
B
B
B
C
A
B
B
B
C
C
B
B
Where
am
I
going
here
so
shut,
we'll
search
for
graceful,
because
I
know
that
there
is
a
docs
page
called
shutting
down
a
cluster
gracefully,
so
we
talked
about
this
a
little
bit
last
week.
I
think
it
was
last
week
just
kind
of
talking
about
certificates
and
how
bringing
back
the
cluster
can
sometimes
create
certificate
issues,
so
you
can
absolutely
shut
down
a
cluster.
I
do
this
all
the
time
inside
of
my
lab.
I
know
customers
that
do
it
regularly
right
they
shut
down.
B
B
B
B
B
Yes,
wow
and
it's
every
time
it's
been
as
simple
as
I
need
to
use
the
cube
admin
or
or
write
the
the
the
kubeconfig
file
that
was
created
with
the
cluster.
That
has
the
system
admin
right
credentials,
which
is
the
certificate
based
right,
connect
to
the
api
and
basically
do
an
oc,
get
csr
and
then
approve
whatever
pending
csrs.
Are
there
and
you
can
do
like
an
oc
get
node?
B
What
you'll
see
is
all
the
nodes
in
a
not
ready
status
and,
of
course,
if
you
do
like
an
oc
get
co
if
it
responds
because
remember,
co
is
going
to
be
a
part
of
the
open
shift.
Api
server,
which
may
or
may
not
come
up
depending
on
what
certificates
have
expired,
but
yeah
it's
more
or
less,
go
through
and
approve
all
ocsrs
and
then
give
it
a
few
minutes
and
everything
comes
back.
A
A
B
Yeah:
here's
here's
the
restarting
cluster,
gracefully
nice,
so
yeah
there
is
some
kcs's
be
careful
with
the
kcs's
around
like
restarting
things,
because
this
yeah,
because
this
process
changed
so
back
in
the
4.3
or
4.4
time
frame,
was
when
we
introduced
the
automatic
certificate
renewal
process
so
prior
to.
I
think
it
was
4.4,
so
4.3
and
earlier
you'll
find
kcs's
where
it's
you
know
this.
B
You
got
to
connect
into
the
control
plane
and
execute
these
commands
and
refresh
these
certificates
and
replace
these
files,
and
you
know,
do
all
these
things.
None
of
that's
necessary
anymore.
So
just
be
careful
with
those.
You
can
always
open
a
support
ticket
right
right,
yeah
that
that's
literally
what
what
support's
there
for.
B
So,
if
you
have
a
problem,
if
you
have
an
issue
with
it
coming
back
up
if
it's
been
shut
down
for
a
while
call
up
the
support
guys
right,
they'll
they'll
help
you
with
all
that
stuff,
and
I
know
that
they
do
it.
You
know
that
that's
that's
their
thing!
Oh
man!
Now
how
do
I
move?
Oh
there
we
go.
I
just
zoom
windows
or
zoom
bars.
A
B
Right,
this
is
where
we
go
and
download
all
of
the
resources.
So
for
reference,
this
is
actually
the
site
that
like,
if
you
go
to
cloud.redhat.com
openshift
and
you
go
and
download
the
install
tools.
This
is
where
it
takes
you
to
right.
So
this
is
or
if
you
click
the
link
that
says
download
coreos.
This
is
the
site
that
it
takes
you
to.
I
just
skipped
that
process,
so
I
don't
have
to
log
in
again.
B
C
B
B
B
So
y
release
is
the
second
number,
so
4.6
would
be
the
y
so
use
whatever
the
newest
one
is
is
generally
your
best
bet
where
this
gets
complicated
is
existing
clusters,
especially
clusters
that
have
been
around
for
since
4.5,
right
and
adding
new
nodes
with
upi
in
particular
to
a
older
cluster,
so
4.5
and
earlier
used
ignition
version.
2.
4.6.
We
moved
to
ignition
version
3.0
and
then
recently,
actually
with
4.7.
B
B
B
This
kcs
has
a
down
at
the
bottom
after
you
authenticate
has
just
a
little
short
couple
of
scriptlets
that
you
can
run
that
will
pull
that
ignition
file
and
then
update
it
to
the
new
spec,
and
then
you
just
use
that
to
boot.
Your
worker
notes
so
just
be
aware
if
it's
an
existing
cluster
right,
so
you
updated
from
you
know,
4.5
to
6
to
7
you're
going
to
install
a
new
node
and
you
use
the
4.7
core
os
to
install
it.
You'll
need
to
update
your
ignition.
B
That
being
said
in
theory,
you
can
continue
to
use
the
original
core
os
version
right.
So
this
is
why
so
think
about
it?
This
is
why,
with
ipi,
it
generally
just
works
right.
So
let's
say
I
did
a
vmware
ipi
deployment
to
vsphere
right.
The
first
thing
that
it's
going
to
do
is
it's
going
to
upload
the
ova
and
create
what
effectively
becomes
the
template
virtual
machine
for
all
the
nodes.
B
B
It
doesn't
reach
out
to
vmware
and
say
hey
here's,
a
new
ova
right.
The
cluster
doesn't
do
that
only
the
installer
does
that
right.
So
when
you
go
with
ipi
and
say
scale,
this
machine
set
it's
going
to
at
that
point,
clone
that,
even
though
it's
a
4.7
cluster,
that
ova
was
4.5
based
it'll
clone
that
machine,
and
that
would
is
what
gets
introduced
and
machine
config
operator
does
the
same
thing.
It
updates
that
operating
system
to
whatever
the
latest,
whatever
the
version
it
needs,
is
so
this
is
why
sometimes
it's
an
issue.
B
Sometimes
it's
not
an
issue,
there's
no
harm.
For
example,
if
you
go
in
and
replace
that
4.5
template
virtual
machine
with
one
that
is
4.7
based,
if
you
create
a
new
machine
set
and
use
a
4.7
ova,
you
just
need
to
update
the
the
ignition
file
that
it's
using
inside
of
there
and
the
the
kcs
will
walk
through
all
of
that
stuff.
So
anyways
just
be
aware
of
that.
There
is
kcs
posted
in
the
chat
here.
We'll
include
that
in
the
blog
post,
so
on
and
so
forth,.
A
A
B
Ready
to
be
posted
there,
you
go
so
all
right.
Today's
topic
authentication
authorization
yeah.
So
let's
look
at
a
couple
of
things
I
usually
like
to.
As
most
people
know,
I
like
to
start
with
the
docs,
and
my
reason
for
that
is
the
docs
should
be
our
source
of
truth.
They
should
have
most
of
the
things
that
we
need
in
order
to
learn
about
a
particular
subject,
and
if
they
don't,
we
want
to
fix
that
yeah,
and
we
can
do
that
right.
You
can
open
an
issue
up
here.
You
can
reach
out.
B
B
So
what
I
really
want
to
focus
on
here
is
these
top
two
sections,
users
and
groups
so
within
side
of
openshift,
there
are
roughly
three
types
of
users
right:
three
broad
categories:
there's
a
regular
user
right.
This
is
just
somebody
who
is
connecting
in
they're
meant
to
be
using
it.
You
know
administering
the
cluster
deploying
applications
right.
It's
often
a
human
that
is
behind
the
scenes
here,
you're
out
of
focus
again
chris.
Oh
my
gosh.
B
There
is
system
users
right
and
you
can
see
that
these
are
going
to
be
prefaced
by
system
inside
of
the
inside
of
the
name
there.
These
are
users
that
are
created
by
the
system
to
do
certain
tasks
for
certain
things
right.
So
so
we
have
this
open
shift
registry
system
user
or
this
node
account
right
type
of
things
inside
of
there
and
then
last
but
not
least,
we
have
service
accounts.
B
B
It's
using
a
service
account
to
run
underneath
that
particular
context,
so
we
need
to
give
permissions
to
the
service
account
or
create
a
service
account
and
assign
it
to
that
pod
in
order
for
it
to
do
the
things
that
it
needs
to
do
the
other
thing
that
we
want
to
be
aware
about
is
groups
and
exactly,
as
the
name
implies,
just
as
you
would
expect
from
you
know,
any
sort
of
authentication
authorization
experience
with
groups.
It
is
simply
a
collection
of
users
and
users
can
be
assigned
to
one
or
more
group.
B
So
by
default
there
are
a
few.
What
the
documentation
calls
virtual
groups
that
we
need
to
be
aware
of,
and
then
we'll
look
at
some
kind
of
user
or,
in
our
case
we'll
be
syncing
them
with
ldap.
So
some
other
groups
that
we
that
can
be
created
for
whatever
purpose
we
see
fit
so
probably
the
most
important
one
here
that
I'll
talk
about
is
this
system
authenticated
oauth
effectively.
This
is
a
group
that
is
assigned
to
any
user
who
is
authenticated
with
the
oauth
server
inside
of
openshift
right.
So
that's
the
default
authentication
mechanism.
B
This
will
be
configuring
in
order
to
use,
in
our
case
httpd,
as
well
as
ldap
authentication.
The
system
unauthenticated
is,
as
you
can
see,
associated
with
all
unauthenticated
users.
You
could,
if
you
wanted
to
right,
assign
some
permissions
to
an
unauthenticated
user
right.
Maybe
I
want
anybody
to
be
able
to
come
in
and
see
metrics
on
some
service,
or
I
don't
know
something
like
that-
it's
technically
possible.
I
I
struggle
to
come
up
with
any
use
cases
for
something
like
that,
so
the
authenticated.
B
A
B
B
A
B
Strange-
I
don't
like
this,
so
I
am
running
an
openshift
4.8
rc
inside
of
this
particular
cluster.
You
happen
to
notice
that
this
one
is
actually
a
single
node
openshift
deployment.
So
if
you
aren't
familiar,
you
can
go
to
cloud.redhat.com.
I
don't
know
why.
I
forgot
the
url,
so
cloud.redhat.com
openshift.
You
can
go
to
install,
select
the
tab
for
on-prem
and
up
at
the
top
there's
the
thing
that
says:
assisted
installer
and
with
the
assisted
installer.
You
can
deploy
a
single
node
instance.
So
this.
B
So
if
we
look
at
the
nodes
here,
you
can
see
it's
just
just
one
single
node
inside
of
here
mine
happens
to
be.
I
think
the
minimum
requirements
are
four
vcpus
and
32
gigs
of
ram,
which
is
what
I'm
using
here
and
it
works
flawlessly.
I
haven't
had
any
issues
so
when
we
think
about-
and
if
I
browse
down
here
to
users
right,
I
have
no
users
inside
of
here
right.
I
have
no
identity
identity
provider
configured.
B
So,
for
example,
if
I
were
to
go
in
and
say
you
know,
give
the
user
see
shorts.
You
know
system
admin
privileges,
even
though
your
name
wouldn't
show
up
underneath
this
until
the
user
account
is
created
or
until
you
log
in
essentially
the
first
time
through
whatever
the
authentication
process
is
that
permission
would
be
there
and
associated
with
you.
So
how
do
users
get
created?
B
B
C
B
All
right
so
inside
of
here
is
I
I
have
things
staged
to
hopefully
work
for
us,
so
oc
get
node.
We
can
see
I'm
connected
to
my
single
node
open
shift
and
if
I
do
an
oc
get
user,
no
user.
I
have
no
resources
right,
no
users
inside
of
here,
so
let's
cd
into
our
httpd
here,
so
I
have
an
ht
password
file
right.
This
is
created
in
the
standard
way,
so
ht
password
dash
c
dash
blah
blah
blah.
If
I
look
at
that,
I
have
two
users
and
sulliv
and
andrew.
C
B
C
B
We
go
yeah,
so
we
have
this
command
I'll.
Just
put
that
one
command
on
the
screen
here,
oc
create
secret
generic.
I'm
going
to
use
the
name
hd
pass
secret,
I'm
going
to
use
the
file,
I'm
going
to
give
it
the
name
ht
password
inside
of
the
secrets,
I'm
going
to
use
the
source
file
in
the
current
directory,
also
named
hd
password
and
we're
going
to
create
the
secret
in
the
open
shift,
config
namespace.
C
B
Yeah
so
now,
let's
look
at
our
oauth
file
here,
so
extremely
straightforward.
All
we're
doing.
Is
configuring
oauth,
with
an
identity
provider
named
hd,
password
of
type
hd
password
and
saying
hey
this
secret,
the
one
that
we
just
created
has
all
of
your
data,
so
we
do
it
oc
apply.
Dash,
f,
it'll
complain
because
apply
didn't
originally
create
the
resource.
Thank
you
very
much.
B
B
Yeah
so
now
we
want
to
come
back
over
here
and
we
want
to
look
at
our
cluster
operators.
We
should
see,
among
other
things,
the
authentication
operator
will
update.
Sometimes
it
takes
a
few
seconds
for
it
to
do
its
thing.
It'll
update
after
a
second
and
it'll
be
it'll
become
available
to
us.
Now.
I
just
did
all
of
that
from
the
command
line.
You
can
do
this
directly
through
the
gui
yep.
So
if
you
go
to
global
configuration,
we
go
to
we
search
for
oauth
and
down
here.
B
You
see,
I
have
this
oauth,
this
hd
password
provider
configured-
I
can
come
in
here
and
I
can
say,
create
an
hd
password,
authentication
provider
and
it
will
all.
I
do
is
copy
and
paste
the
contents
of
that
hd
password
file
that
I
just
showed
copy
and
paste
them
into
here
and
click
add
and
we're
done.
B
A
B
B
A
B
And
it
allows
me
to
log
in-
and
it
gives
me
the
default
set
of
permissions
nice,
which
is
great
limited.
Well,
yes,
ish,
so
you'll
notice
that
I
didn't
create
a
user
account.
We
just
looked.
We
saw
that
there
was
no
user
accounts.
If
I
switch
back
over
here.
If
I
now
do
an
oc
get
user,
all
of
a
sudden
that
user,
I
just
logged
in
with
exists.
B
I
can
go
in
here
and
create
a
project
name
test
one
and
I
can
hit
create,
and
now
I
can
come
in
here
and
I
can
deploy
things
as
I
see
fit.
It
will
follow
the
default
project
creation
template.
So
if,
for
example,
you
have
a
you
know,
a
quota
put
in
place
or
a
limit
rate
or
whatever
the
project
default
project
template
happens
to
be.
B
B
So
let's
switch
over
to
I'm
going
to
copy
this
guy,
let's
switch
over
to
our
terminal
again
and
we'll
make
it
easier
to
read
so
you
can
see
here.
I
have
a
default
group
called
self
provisioners
which,
as
the
name
implies,
means
that
you
can
provision
your
own
projects
and
use
them
right,
and
the
group
system
authenticated
oauth,
belongs
to
that
role
right
or
is
a
member
of
that
role.
B
So
if
I
want
to
disable,
if
I
want
to
prevent
any
authenticated
user
from
just
coming
in
and
being
able
to
create
their
own
projects,
all
I
need
to
do
is
remove
this
particular
config.
I'm
not
going
to
do
it
in
this
one,
but
just
know
that
it
is
in
the
docs
here
and
the
docs
walk
through
precisely
how
to
do
that
right.
We
do
a
patch
on
that
self
provisioners.
We
remove
that
group
from
inside
of
there
and
then
we
update
remove
cluster
role
from
group.
B
We
remove
system
authenticated
oauth
from
the
self
provisioner
group
cluster
cluster
level
group,
so
relatively
straightforward
yeah.
So
what
if
I
want
to
assign
permissions
to
a
user
when
they
authenticate
so
remember
my
oc
get
user.
So
remember,
there's
only
one
user
right
now,
but
what
if
I
wanted
to.
B
B
B
B
B
So
let's
say
that
I
want
to
add
chris
as
a
cluster
administrator.
All
I
need
to
do
is
come
back
over
here
and
I
would
update,
I
would
add
your
user
to
the
hd
password
file.
I
would
re-upload
that
secret
and
then
you
would
be
able
to
log
in
now,
because
that
is
per
user
authentication
right,
that's
kind
of
a
pain
to
manage
right.
We
don't.
B
Do
that
yeah
and
you
know
essentially
every
time
a
new
admin
admin
joins
the
team
right.
I
now
have
to
go
into
every
cluster
and
give
them
permissions
inside
of
that
cluster.
Every
time
an
admin
leaves
the
team.
I
now
have
to
go
into
every
cluster
and
remove
them
from
that
cluster
and
so
on
and
so
forth.
Not
an
ideal
scenario.
You
can
see
hopefully
pretty
easily,
where
I'm
going
with
this,
which
is
using
some
sort
of
central
authentication
authorization
mechanism,
is
definitely
ideal.
B
B
B
So
this
is
my
my
80
domain
really
really
simple,
because
this
is
just
kind
of
a
demo.
If
you
look
down
here
in
the
corner,
this
is
actually
an
eval,
so
I'm
not
really
attached
to
it.
So
I've
got
an
ou
in
here
for
domain
users.
Inside
of
there.
I
just
created
a
few
different
sub
ou's
right,
so
one
for
administrators,
where
we
have
this
user
andrew
sullivan,
we
can
see
that
my
username
here
is
going
to
be
a
in
sulliv
and
then
I
have
a
couple
of
groups:
openshift
users,
openshift
admins.
B
B
B
B
A
C
B
B
Yeah,
so
I
I
forgot
to
mention
with
the
hd
password:
we
do
have
this
in
the
docs
here,
you
can
walk
through
and
it
shows
you
step
by
step.
Here's
the
hd
password
command
to
follow
right.
Here's!
Where
is
it?
You
know,
on
windows,
here's
creating
a
secret
right.
This
should
look
incredibly
familiar.
It
was
literally
the
command
that
I
just
used
right,
creating
the
hd
pass
secret
and
then
adding
it
into
the
cluster
using
a
the
oauth
yaml
file.
B
B
C
B
B
This
is
how
we
are
telling
the
system
how
to
connect
to
our,
in
our
instance
active
directory
domain
and
then
importantly,
we
want
to
pay
attention
to
base
dn.
So,
basically,
where
is
the
route
right?
Where
am
I
looking
for
user
accounts
and
the
filter?
So
this
is,
if
I
want
to
limit
those
who
are
allowed
to
authenticate
what
filter
do
I
need
to
use
to
do
that.
B
So,
basically
yeah
so
basically
it'll.
Anybody
who
is
found
inside
of
this
base
dn
would
be
allowed
to
log
in
yeah.
So,
let's
move
back
over
here
and
let's
look
at
our
ado.
Auth
file
here
cool
I'm
going
to
actually
open
it
in
vim,
so
it's
a
little
easier
to
to
see
with
the
syntax
highlighting
so
I'm
going
to
ignore
these
things.
These
are
pretty
straightforward
with
active
directory.
You
just
want
to
make
sure
to
use
the
sam
account
name
for
both
the
id
and
the
preferred
username,
so
preferred
username.
B
You
can
use
mail
if
you
want
basically
up
that
affects
what
the
display
name
is
up
in
the
upper
corner.
Okay.
So
if
we
look
at
where's
my
cluster
here
so
up
here
where
it
says
and
sullive
yep,
if
I
were
to
use
mail
for
example,
it
would
show
my
email
address
instead
of
or
I
could
use
my
principal
account
name,
which
would
show
my
full
name
right-
that
type
of
stuff
cool
so
bind
dn.
B
B
It
doesn't
need
to
log
in
it
doesn't
need
to
have
nothing
all
this
is
used
for
is
to
authenticate
against
our
ldap
server
to
then
validate
the
user
accounts
so
definitely
encourage
great
suggested
to
use
a
service
account
that
has
effectively
no
permissions
anywhere
inside
of
your
active
directory
organization.
Right
to
be
able
to
just
do
that
that
bind
checking,
you
can
see.
That's
the
password.
There
is
just
stored
in
a
simple
secret
inside
of
here
so
mine.
You
see
this
insecure.
True.
I
set
this
up
in
like
20
minutes
in
my
life.
B
Yeah,
so
insecure
is
true
if,
if
insecure
is
set
to
false,
it
doesn't
matter
whether
you
use
ldap
or
ldap
s
in
the
url
here
it
will
always
go
to
l.s
to
do
cert,
checking
and
all
that
other
stuff.
If
insecure
is
set
to
true
and
use
ldap
here,
it
will
use
standard,
unencrypted
ldap
on
port
389.,
so
the
next
part
of
our
ldap
url
here
this
is
the
name
of
the
ldap
server.
B
You
want
to
connect
to
now
you'll
note
here
that
I
used
the
name
of
my
domain
and
andrew's
opinion,
and
we
don't
say
this
in
the
docs.
I
think
the
docs
just
say
what
is
the
ldap
server,
that
you're
connecting
to
right
host
and
port,
and
many
of
the
examples
show
connecting
to
a
specific
you
know
server
instance,
my
personal
preference
is
to
use
the
name
of
the
domain.
B
The
reason
for
that
is
because
active
directory
will
automatically
resolve
that,
to
whatever
domain
controller
is
at
the
site
that
you're
on.
So
let's
say
that
you
are
creating
a
generic
deployments
right
you're,
maybe
using
get
ops
and
you're
deploying
to
a
dozen
sites
across
the
globe
right
inside
of
active
directory.
Each
one
of
those
sites
is
going
to
be
defined
and
each
one
of
those
sites
is
going
to
have
a
set
of
subnets
and
a
set
of
domain
controllers
associated
with
it.
B
If
you
were
to
choose
so,
for
example,
I've
got
you
know
one
one
data
center
in
here
in
north
carolina
and
another
one,
that's
in
australia
and
I'm
not
thinking
about
it,
and
I
deploy
my
australia.
You
know
instance-
and
it's
connecting
all
the
way
back
here
to
north
carolina,
to
do
that
authentication.
B
B
B
Now
you
may
be
wondering
what
is
this
one?
Two,
eight
forty
blah
blah
blah
blah
blah
string.
This
is
basically
so
that
it
does
tree
traversal,
so
you
can
use
nested
groups,
so
it
is
important,
particularly
with
active
directory,
where
we
do
a
lot
of
group-
nesting
right,
ou
nesting
inside
of
there,
so
it
is
important
to
use
that
with
active
directory.
B
A
B
B
C
C
B
B
All
right,
so,
what's
going
to
happen
here
is
remember.
I
just
applied
this
to
that
oauth
config.
So
what
I'm
going
to
expect
is
cluster
dash.
Oh
yeml
right.
It
replaced
my
ht
password
provider
right.
So
now
it's
going
to
go
through
it's
going
to
reconfigure
everything.
If
I
don't
know
oc.co,
we
can
see
that
it
is
going
through
and
it's
now
updating
its
status.
B
B
B
B
Can
the
user
access
the
cluster
or
not
not
assigning
permissions?
What
if
we
want
to
create
groups
to
manage
those
permissions,
so
I'm
going
to
very
quickly
go
through
this?
I
I
have.
I
actually
have
all
this
typed
up
in
a
and
I'll
publish
it
as
a
gist
and
then
I'll
link
that
from
the
blog
post,
that'll
come
out
on
friday,
so
you'll
be
able
to
see
all
of
these
things
that
I'm
doing
inside
of
there.
B
B
Instances
so
I
have
a
command
here
so
ocadm
group
sync,
I'm
going
to
use
my
group
allow
list
and
I'm
going
to
provide
my
sync
config
and
then,
if
I
don't
provide
the
confirm
it'll,
just
do
a
dry
run
and
it'll.
Tell
me
what
it's
going
to
do
with
the
dash
dash
confirm.
It
basically
says:
okay,
we've
created
these
groups,
and
now
you
see
I
have
my
two
groups
and
the
users
who
are
a
member
of
those
groups.
B
B
Now
I
can
do
my
open
shift,
admins-
and
I
add
cluster
role
to
group
and
just
like
that.
Anybody
who
is
in
the
openshift
admins
group
is
now
a
cluster
administrator.
Note,
however,
that
these
groups
are
only
updated
when
you
go
and
update
them
unless
you
create
either
a
cron
job
or
you
can
use
so.
The
cop
has
very
helpfully
created
a
sync
operator.
B
Nice,
so
if
we
come
here,
the
group
sync
operator
I'll
post
a
link
into
the
chat
here
so
very
simply
does
exactly
what
it
says.
It
does
synchronizes
those
groups
and
their
user
membership
based
on
a
time
frame.
So
I
know
we're
out
of
time
today.
Thank
you,
everybody
for
watching.
I
hope
that
this
has
been
beneficial.
I
hope
it's
been
informative.
A
B
I
will
address
any
questions
in
the
blog
post.
I
will
also
link
to
the
gist
that
will
have
all
of
this
information
inside
of
it
inside
of
that
blog
post.
That
will
come
out
friday
morning.
If
you
have
any
questions,
if
we
didn't
answer
anything
here
on
the
stream,
please
don't
hesitate
to
reach
out.
You
can
reach
me
at
andrew.sullivan
redhat.com
or
on
twitter
at
practical,
andrew
or
chris's
chris
short
on
twitter
and
short
redhead.com.