Skip to content

Update the openldap tutorial #795

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Nov 5, 2025
Merged

Update the openldap tutorial #795

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
2a4714c
Fix stackablectl stacklet list command
NickLarsenNZ Nov 4, 2025
0355a85
Simplify instruction
NickLarsenNZ Nov 4, 2025
b8dcdc6
Simplify instruction
NickLarsenNZ Nov 4, 2025
e389dff
Update instructions
NickLarsenNZ Nov 4, 2025
cbd4031
Update rego rule syntax
NickLarsenNZ Nov 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 12 additions & 5 deletions modules/tutorials/examples/ldap-auth/trino-opa-bundle-snippet.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,19 +2,26 @@ data:
trino.rego: |
package trino

import future.keywords.in

default allow = false

allow {
allow if {
is_alice
}
extended[i] {

batch contains i if {
some i
input.action.filterResources[i]
is_alice
}

is_alice() {
batch contains i if {
some i
input.action.operation == "FilterColumns"
count(input.action.filterResources) == 1
input.action.filterResources[0].table.columns[i]
is_alice
}

is_alice() if {
input.context.identity.user == "alice"
}
14 changes: 8 additions & 6 deletions modules/tutorials/pages/authentication_with_openldap.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,13 +42,12 @@ to learn more.
Before starting to add configuration to your Stackable cluster, inspect what the command above has set up in your
Kubernetes cluster.

Use `stackablectl stacklets list` to find the endpoints of Superset and Trino and open their web interfaces in the
Use `stackablectl stacklet list` to find the endpoints of Superset and Trino and open their web interfaces in the
browser.

You can log into Superset with user _admin_ and password _adminadmin_, and into Trino with user _admin_ and password
_adminadmin_.
You can log into both Superset and Trino with user `admin` and password `adminadmin`.

These are the current users defined in Superset's and Trino's internal user management. Later you will see that these users cannot be used for authentication anymore after LDAP authentication has been enabled.
These _admin_ users are defined in Superset's and Trino's internal user management. Later you will see that these users cannot be used for authentication anymore after LDAP authentication has been enabled.

=== OpenLDAP Stack

Expand Down Expand Up @@ -211,7 +210,10 @@ Now deploy the updated superset cluster:
[source,bash]
include::example$ldap-auth/40-modify-superset.sh[tag=apply-superset-cluster]

Connect to superset as before, and try logging in again with username _admin_ and password _adminadmin_, Superset will not accept these credentials anymore. You now have to use LDAP credentials to log in. The OpenLDAP you installed earlier comes with two users, _alice_ (password _alice_) and _bob_ (password _bob_). Log in with any of these users and Superset will accept.
Connect to superset as before (logout if you still had a valid session from earlier), and try logging in again with username _admin_ and password _adminadmin_, Superset will not accept these credentials anymore.
You now have to use LDAP credentials to log in.
The OpenLDAP you installed earlier comes with two users, _alice_ (password _alice_) and _bob_ (password _bob_).
Log in with any of these users and Superset will accept.

[#trino]
=== Add LDAP configuration to Trino
Expand Down Expand Up @@ -315,7 +317,7 @@ Fetch the snippet as before:
[source,bash]
include::example$ldap-auth/70-modify-trino-opa-bundle.sh[tag=get-yaml]

Apply this patch:
Update the ConfigMap to look like the below:

[source,yaml]
----
Expand Down
Loading