feat: OpenLDAP backend

Author: dervoeti

deploy/helm/opa-operator/crds/crds.yaml

@@ -84,6 +84,8 @@ spec:
                                 - experimentalActiveDirectory
                             - required:
                                 - experimentalEntra
+                            - required:
+                                - experimentalOpenLdap
                           properties:
                             experimentalActiveDirectory:
                               description: Backend that fetches user information from Active Directory
@@ -245,6 +247,151 @@ spec:
                                 - clientCredentialsSecret
                                 - tenantId
                               type: object
+                            experimentalOpenLdap:
+                              description: Backend that fetches user information from OpenLDAP
+                              properties:
+                                bindCredentials:
+                                  description: |-
+                                    Credentials for binding to the LDAP server.
+
+                                    The bind account is used to search for users and groups in the LDAP directory.
+                                  properties:
+                                    scope:
+                                      description: |-
+                                        [Scope](https://docs.stackable.tech/home/nightly/secret-operator/scope) of the
+                                        [SecretClass](https://docs.stackable.tech/home/nightly/secret-operator/secretclass).
+                                      nullable: true
+                                      properties:
+                                        listenerVolumes:
+                                          default: []
+                                          description: |-
+                                            The listener volume scope allows Node and Service scopes to be inferred from the applicable listeners.
+                                            This must correspond to Volume names in the Pod that mount Listeners.
+                                          items:
+                                            type: string
+                                          type: array
+                                        node:
+                                          default: false
+                                          description: |-
+                                            The node scope is resolved to the name of the Kubernetes Node object that the Pod is running on.
+                                            This will typically be the DNS name of the node.
+                                          type: boolean
+                                        pod:
+                                          default: false
+                                          description: |-
+                                            The pod scope is resolved to the name of the Kubernetes Pod.
+                                            This allows the secret to differentiate between StatefulSet replicas.
+                                          type: boolean
+                                        services:
+                                          default: []
+                                          description: |-
+                                            The service scope allows Pod objects to specify custom scopes.
+                                            This should typically correspond to Service objects that the Pod participates in.
+                                          items:
+                                            type: string
+                                          type: array
+                                      type: object
+                                    secretClass:
+                                      description: '[SecretClass](https://docs.stackable.tech/home/nightly/secret-operator/secretclass) containing the LDAP bind credentials.'
+                                      type: string
+                                  required:
+                                    - secretClass
+                                  type: object
+                                customAttributeMappings:
+                                  additionalProperties:
+                                    type: string
+                                  default: {}
+                                  description: Custom attributes, and their LDAP attribute names.
+                                  type: object
+                                groupMemberAttribute:
+                                  default: member
+                                  description: |-
+                                    LDAP attribute on group objects that contains member references.
+
+                                    Common values:
+                                    - `member`: For `groupOfNames` objects (uses full DN)
+                                    - `memberUid`: For `posixGroup` objects (uses username)
+
+                                    Defaults to `member`.
+                                  type: string
+                                groupsSearchBase:
+                                  description: |-
+                                    LDAP search base for groups, e.g. `ou=groups,dc=example,dc=org`.
+
+                                    If not specified, uses the main `searchBase`.
+                                  nullable: true
+                                  type: string
+                                hostname:
+                                  description: Hostname of the LDAP server, e.g. `my.ldap.server`.
+                                  type: string
+                                port:
+                                  description: Port of the LDAP server. If TLS is used defaults to `636`, otherwise to `389`.
+                                  format: uint16
+                                  maximum: 65535.0
+                                  minimum: 0.0
+                                  nullable: true
+                                  type: integer
+                                searchBase:
+                                  default: ''
+                                  description: LDAP search base, e.g. `ou=users,dc=example,dc=org`.
+                                  type: string
+                                tls:
+                                  description: Use a TLS connection. If not specified no TLS will be used.
+                                  nullable: true
+                                  properties:
+                                    verification:
+                                      description: The verification method used to verify the certificates of the server and/or the client.
+                                      oneOf:
+                                        - required:
+                                            - none
+                                        - required:
+                                            - server
+                                      properties:
+                                        none:
+                                          description: Use TLS but don't verify certificates.
+                                          type: object
+                                        server:
+                                          description: Use TLS and a CA certificate to verify the server.
+                                          properties:
+                                            caCert:
+                                              description: CA cert to verify the server.
+                                              oneOf:
+                                                - required:
+                                                    - webPki
+                                                - required:
+                                                    - secretClass
+                                              properties:
+                                                secretClass:
+                                                  description: |-
+                                                    Name of the [SecretClass](https://docs.stackable.tech/home/nightly/secret-operator/secretclass) which will provide the CA certificate.
+                                                    Note that a SecretClass does not need to have a key but can also work with just a CA certificate,
+                                                    so if you got provided with a CA cert but don't have access to the key you can still use this method.
+                                                  type: string
+                                                webPki:
+                                                  description: |-
+                                                    Use TLS and the CA certificates trusted by the common web browsers to verify the server.
+                                                    This can be useful when you e.g. use public AWS S3 or other public available services.
+                                                  type: object
+                                              type: object
+                                          required:
+                                            - caCert
+                                          type: object
+                                      type: object
+                                  required:
+                                    - verification
+                                  type: object
+                                userIdAttribute:
+                                  default: entryUUID
+                                  description: LDAP attribute used for the user's unique identifier. Defaults to `entryUUID`.
+                                  type: string
+                                userNameAttribute:
+                                  default: uid
+                                  description: LDAP attribute used for the username. Defaults to `uid`.
+                                  type: string
+                              required:
+                                - bindCredentials
+                                - hostname
+                              type: object
                             experimentalXfscAas:
                               description: |-
                                 Backend that fetches user information from the Gaia-X

docs/modules/opa/pages/usage-guide/user-info-fetcher.adoc

@@ -54,6 +54,7 @@ Currently the following backends are supported:
 * xref:#backend-keycloak[]
 * xref:#backend-activedirectory[]
 * xref:#backend-entra[]
+* xref:#backend-openldap[]
 
 [#backends]
 == Backends
@@ -206,6 +207,66 @@ spec:
 <2> The Entra tenant ID
 <3> A secret containing the `clientId` and `clientSecret` keys
 
+[#backend-openldap]
+=== OpenLDAP
+
+WARNING: The OpenLDAP backend is experimental, and subject to change.
+
+Fetches user attributes and groups over LDAP from OpenLDAP servers using simple bind authentication.
+
+OpenLDAP supports different group schemas:
+
+* *groupOfNames* (default): Groups contain a `member` attribute with full user DNs
+* *posixGroup*: Groups contain a `memberUid` attribute with usernames
+
+[source,yaml]
+----
+spec:
+  clusterConfig:
+    userInfo:
+      backend:
+        experimentalOpenLdap: # <1>
+          hostname: openldap.default.svc.cluster.local # <2>
+          port: 1636 # <3>
+          searchBase: dc=example,dc=org # <4>
+          bindCredentials: # <5>
+            secretClass: openldap-bind-credentials # <6>
+          userIdAttribute: entryUUID # <7>
+          userNameAttribute: uid # <8>
+          groupsSearchBase: ou=groups,dc=example,dc=org # <9>
+          groupMemberAttribute: member # <10>
+          customAttributeMappings: # <11>
+            email: mail
+            displayName: cn
+            givenName: givenName
+            surname: sn
+          tls: # <12>
+            verification:
+              server:
+                caCert:
+                  secretClass: openldap-tls # <13>
+      cache: # optional, enabled by default
+        entryTimeToLive: 60s # optional, defaults to 60s
+----
+<1> Enables the OpenLDAP backend
+<2> The hostname of the LDAP server
+<3> The port of the LDAP server. Defaults to `636` for LDAPS, or `389` for plain LDAP
+<4> The base distinguished name to search. Users outside of this will not be seen
+<5> Configuration for LDAP bind credentials
+<6> The name of the SecretClass that provides the bind credentials. The secret must contain `user` and `password` keys
+<7> LDAP attribute used for the user's unique identifier. Defaults to `entryUUID`
+<8> LDAP attribute used for the username. Defaults to `uid`
+<9> LDAP search base for groups. If not specified, uses the main `searchBase`
+<10> LDAP attribute on group objects that contains member references. Use `member` for `groupOfNames` (default) or `memberUid` for `posixGroup`
+<11> Arbitrary LDAP attributes can be requested to be fetched and returned in the user info response. Use this to map custom LDAP attributes to custom attribute names in the response
+<12> Optional TLS configuration for secure LDAP connections
+<13> The name of the SecretClass that contains the LDAP server's root CA certificate(s)
+
+When retrieving user information from OpenLDAP, the user info fetcher first searches for the user by the `userNameAttribute` (defaults to `uid`) or `userIdAttribute` (defaults to `entryUUID`) depending on the request type. When a user is found, it searches for groups containing the user:
+
+* If `groupMemberAttribute` is `memberUid`: Searches for groups where `memberUid` equals the username (for `posixGroup`)
+* Otherwise (e.g. if `groupMemberAttribute` is `member`, which is the default): Searches for groups where `member` equals the user's full DN (for `groupOfNames`)
+
 == User info fetcher API
 
 User information can be retrieved from regorules using the functions `userInfoByUsername(username)` and `userInfoById(id)` in `data.stackable.opa.userinfo.v1`.
@@ -229,7 +290,7 @@ NOTE: The exact formats of `id` and `groups` will vary depending on the xref:#ba
 === Debug request
 
 To debug the user-info-fetcher you can `curl` it's API for a given user.
-To achieve this shell into the `user-info-fetcher` container and execute
+To achieve this shell into the `opa` container and execute
 
 [source,bash]
 ----

rust/operator-binary/src/controller.rs

@@ -33,6 +33,7 @@ use stackable_operator::{
         secret_class::{SecretClassVolume, SecretClassVolumeScope},
         tls_verification::{TlsClientDetails, TlsClientDetailsError},
     },
+    crd::authentication::ldap,
     k8s_openapi::{
         DeepMerge,
         api::{
@@ -313,6 +314,11 @@ pub enum Error {
     ))]
     UserInfoFetcherTlsVolumeAndMounts { source: TlsClientDetailsError },
 
+    #[snafu(display(
+        "failed to build volume or volume mount spec for the User Info Fetcher LDAP config"
+    ))]
+    UserInfoFetcherLdapVolumeAndMounts { source: ldap::v1alpha1::Error },
+
     #[snafu(display("failed to configure logging"))]
     ConfigureLogging { source: LoggingError },
 
@@ -1072,6 +1078,12 @@ fn build_server_rolegroup_daemonset(
                 .add_volumes_and_mounts(&mut pb, vec![&mut cb_user_info_fetcher])
                 .context(UserInfoFetcherTlsVolumeAndMountsSnafu)?;
             }
+            user_info_fetcher::v1alpha1::Backend::OpenLdap(openldap) => {
+                openldap
+                    .to_ldap_provider()
+                    .add_volumes_and_mounts(&mut pb, vec![&mut cb_user_info_fetcher])
+                    .context(UserInfoFetcherLdapVolumeAndMountsSnafu)?;
+            }
         }
 
         pb.add_container(cb_user_info_fetcher.build());

rust/operator-binary/src/crd/user_info_fetcher.rs

@@ -4,8 +4,10 @@ use serde::{Deserialize, Serialize};
 use stackable_operator::{
     commons::{
         networking::HostName,
+        secret_class::SecretClassVolume,
         tls_verification::{CaCert, Tls, TlsClientDetails, TlsServerVerification, TlsVerification},
     },
+    crd::authentication::ldap,
     schemars::{self, JsonSchema},
     shared::time::Duration,
     versioned::versioned,
@@ -45,6 +47,10 @@ pub mod versioned {
         /// Backend that fetches user information from Microsoft Entra
         #[serde(rename = "experimentalEntra")]
         Entra(v1alpha1::EntraBackend),
+
+        /// Backend that fetches user information from OpenLDAP
+        #[serde(rename = "experimentalOpenLdap")]
+        OpenLdap(v1alpha1::OpenLdapBackend),
     }
 
     #[derive(Clone, Debug, Deserialize, Eq, JsonSchema, PartialEq, Serialize)]
@@ -150,6 +156,56 @@ pub mod versioned {
         pub client_credentials_secret: String,
     }
 
+    #[derive(Clone, Debug, Deserialize, Eq, JsonSchema, PartialEq, Serialize)]
+    #[serde(rename_all = "camelCase")]
+    pub struct OpenLdapBackend {
+        /// Hostname of the LDAP server, e.g. `my.ldap.server`.
+        pub hostname: HostName,
+
+        /// Port of the LDAP server. If TLS is used defaults to `636`, otherwise to `389`.
+        pub port: Option<u16>,
+
+        /// LDAP search base, e.g. `ou=users,dc=example,dc=org`.
+        #[serde(default)]
+        pub search_base: String,
+
+        /// Credentials for binding to the LDAP server.
+        ///
+        /// The bind account is used to search for users and groups in the LDAP directory.
+        pub bind_credentials: SecretClassVolume,
+
+        /// Use a TLS connection. If not specified no TLS will be used.
+        #[serde(flatten)]
+        pub tls: TlsClientDetails,
+
+        /// LDAP attribute used for the user's unique identifier. Defaults to `entryUUID`.
+        #[serde(default = "openldap_default_user_id_attribute")]
+        pub user_id_attribute: String,
+
+        /// LDAP attribute used for the username. Defaults to `uid`.
+        #[serde(default = "openldap_default_user_name_attribute")]
+        pub user_name_attribute: String,
+
+        /// LDAP search base for groups, e.g. `ou=groups,dc=example,dc=org`.
+        ///
+        /// If not specified, uses the main `searchBase`.
+        pub groups_search_base: Option<String>,
+
+        /// LDAP attribute on group objects that contains member references.
+        ///
+        /// Common values:
+        /// - `member`: For `groupOfNames` objects (uses full DN)
+        /// - `memberUid`: For `posixGroup` objects (uses username)
+        ///
+        /// Defaults to `member`.
+        #[serde(default = "openldap_default_group_member_attribute")]
+        pub group_member_attribute: String,
+
+        /// Custom attributes, and their LDAP attribute names.
+        #[serde(default)]
+        pub custom_attribute_mappings: BTreeMap<String, String>,
+    }
+
     #[derive(Clone, Debug, Deserialize, Eq, JsonSchema, PartialEq, Serialize)]
     #[serde(rename_all = "camelCase")]
     pub struct Cache {
@@ -189,6 +245,18 @@ fn aas_default_port() -> u16 {
     5000
 }
 
+fn openldap_default_user_id_attribute() -> String {
+    "entryUUID".to_string()
+}
+
+fn openldap_default_user_name_attribute() -> String {
+    "uid".to_string()
+}
+
+fn openldap_default_group_member_attribute() -> String {
+    "member".to_string()
+}
+
 impl v1alpha1::Cache {
     const fn default_entry_time_to_live() -> Duration {
         Duration::from_minutes_unchecked(1)
@@ -202,3 +270,22 @@ impl Default for v1alpha1::Cache {
         }
     }
 }
+
+impl v1alpha1::OpenLdapBackend {
+    /// Returns an LDAP [`AuthenticationProvider`](ldap::v1alpha1::AuthenticationProvider) for
+    /// connecting to the OpenLDAP server.
+    ///
+    /// Converts this OpenLdap backend configuration into a standard LDAP authentication provider
+    /// that can be used by the user-info-fetcher to establish connections and query user data.
+    pub fn to_ldap_provider(&self) -> ldap::v1alpha1::AuthenticationProvider {
+        ldap::v1alpha1::AuthenticationProvider {
+            hostname: self.hostname.clone(),
+            port: self.port,
+            search_base: self.search_base.clone(),
+            search_filter: String::new(),
+            ldap_field_names: ldap::v1alpha1::FieldNames::default(),
+            bind_credentials: Some(self.bind_credentials.clone()),
+            tls: self.tls.clone(),
+        }
+    }
+}