Question about LDAP configs

[Flipjau]

I need to change the config.yml to add my LDAP settings to use as a login method, I was wondering what would be the best way to do this.

[lakshmojirao999]

@Flipjau You can update your config in values.yaml. While enable sso order is important , BasicAuth should 0 and rest followed . I had experienced couple issue while setting up sso . If you need any help let me know

I'm addressing those fix in this PR #117

[Flipjau]

Thanks for the return, I will adjust here.

[Flipjau]

Is there a template on how to configure LDAP via values.yaml?

[clyso-dr]

Would be helpful or a documentation in the chart.

[clyso-dr]

@Flipjau this config works on my side - my main problem was IPv6/IPv4 because I have a dual stack setup, if you on IPv4 only you can ignore the env:

    indexer:
      env:
        OPENSEARCH_JAVA_OPTS: "-Xms1g -Xmx1g -Dlog4j2.formatMsgNoLookups=true -Djava.net.preferIPv4Stack=false -Djava.net.preferIPv6Addresses=true"
      config:
        securityConfig: |-
            _meta:
              type: "config"
              config_version: 2
            config:
              dynamic:
                http:
                  anonymous_auth_enabled: false
                  xff:
                    enabled: false
                authc:
                  ldap:
                    description: "LDAP Authentifizierung"
                    http_enabled: true
                    transport_enabled: true
                    order: 1
                    http_authenticator:
                      type: basic
                      challenge: false
                    authentication_backend:
                      type: ldap
                      config:
                        enable_ssl: false
                        enable_start_tls: false
                        enable_ssl_client_auth: false
                        verify_hostnames: false
                        # Deine Hosts aus dem Snippet
                        hosts:
                          - "LDAP-SERVER:389"
                        bind_dn: "uid=ldap-readonly,cn=users,dc=test,dc=cloud"
                        password: "PASSWORD"
                        userbase: "cn=users,dc=test,dc=cloud"
                        usersearch: "(uid={0})"
                        username_attribute: uid
                  basic_internal_auth_domain:
                    description: "Authenticate via HTTP Basic against internal users database"
                    http_enabled: true
                    transport_enabled: true
                    order: 0
                    http_authenticator:
                      type: basic
                      challenge: true
                    authentication_backend:
                      type: intern
                authz:
                  roles_from_ldap:
                    description: "Authorize via LDAP"
                    http_enabled: true
                    transport_enabled: true
                    authorization_backend:
                      type: ldap
                      config:
                        enable_ssl: false
                        enable_start_tls: false
                        hosts:
                          - "LDAP-SERVER:389"
                        bind_dn: "uid=ldap-readonly,cn=users,dc=test,dc=cloud"
                        password: "PASSWORD"
                        rolebase: "cn=groups,dc=test,dc=cloud"
                        rolesearch: "(&(objectClass=posixGroup)(memberUid={1}))"
                        userroleattribute: null
                        userrolename: disabled
                        rolename: cn
                        resolve_nested_roles: false
                        skip_users:
                          - kibanaserver
                          - admin
                          - wazuh-wui
                          - readall
                          - snapshotrestore

        rolesMapping: |-
          _meta:
            type: "rolesmapping"
            config_version: 2
          all_access:
            reserved: false
            backend_roles:
              - "admin"
              - "wazuh-admin"
          wazuh_admin:
            backend_roles:
              - "wazuh-admin"
          kibana_user:
            reserved: false
            backend_roles:
              - "kibanauser"
              - "wazuh-admin"
          readall:
            reserved: true
            backend_roles:
              - "readall"
          manage_snapshots:
            reserved: true
            backend_roles:
              - "snapshotrestore"
          kibana_server:
            reserved: true
            users:
              - "kibanaserver"
          manage_wazuh_index:
            reserved: true
            users:
              - "kibanaserver"