Skip to content

Document required AD ACLs #541

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nightkr merged 3 commits into from
Jan 15, 2025
Merged

Document required AD ACLs #541

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
97116c8
Document required AD ACLs
nightkr Jan 14, 2025
3f6896c
Document how to configure the ACL rules manually
nightkr Jan 15, 2025
6510c93
Add a warning about empty-looking ACL rules
nightkr Jan 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 53 additions & 3 deletions docs/modules/secret-operator/pages/secretclass.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -219,6 +219,56 @@ If the same AD domain _is_ shared between multiple Kubernetes clusters, the foll
* The Kubernetes Nodes' names and fully qualified domain names
* The Kubernetes Namespaces' names (only Namespaces that use Kerberos)

[#ad-acl]
===== Access Control

The Secret Operator needs permission to create users in the configured base container
(`kerberosKeytab.admin.activeDirectory.userDistinguishedName`), as well as to reset their passwords.

The easiest way to configure this is to run the following PowerShell script:

Copy link
Member

@soenkeliebau soenkeliebau Jan 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It might make sense to also have a textual description for people who want to click this instead of running a PowerShell script.
Doesn't need to be guide "click here, then click there" - just "account needs these rights configured"

Copy link
Contributor Author

@nightkr nightkr Jan 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Isn't that covered by the text above? Honestly not sure about how to flesh it out better without going full tutorial mode. :/

Copy link
Member

@soenkeliebau soenkeliebau Jan 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The text sounded so prose-like, I was hoping there might be some technical names for the privileges ore something like that .. I mean .. I guess there is, its apparently 00299570-246d-11d0-a768-00aa006e0529 :)

I presume in the gui/wizard/whereever you could click this its just called "change password" ?

Copy link
Contributor Author

@nightkr nightkr Jan 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the GUI it's all grouped in under "All extended rights".

Copy link
Contributor Author

@nightkr nightkr Jan 15, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's also.. very hidden away that you can set it at all (need to use the low-level ADSI Edit tool to even see ACLs as an option).

Copy link
Member

@soenkeliebau soenkeliebau Jan 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So in the GUI its just a blanket "All extended rights" ?

Copy link
Contributor Author

@nightkr nightkr Jan 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

3f6896c

Copy link
Contributor Author

@nightkr nightkr Jan 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In "Active Directory Users and Computers" there are no permission options at all. "ADSI Edit" is a lower-level graphical tool that does expose them.. but is still missing a lot of extended rights (which, yes, just get grouped under "all extended rights").

// FIXME: This script is copied from ad-init, can we share this somehow?

[source,powershell]
----
Import-Module ActiveDirectory
# Change these variables to fit your environment
$ou_path = "AD:OU=SDP,DC=sble,DC=test"
$secretop = [System.Security.Principal.SecurityIdentifier]::New("S-1-5-21-1256652973-2063416196-3566311115-1103")

$acl = Get-ACL -Path $ou_path
$user_schema_guid = "bf967aba-0de6-11d0-a285-00aa003049e2"
$password_reset_right_guid = "00299570-246d-11d0-a768-00aa006e0529"
$ou_create_children_rule = [System.DirectoryServices.ActiveDirectoryAccessRule]::New(
$secretop,
[System.DirectoryServices.ActiveDirectoryRights]::CreateChild,
[System.Security.AccessControl.AccessControlType]::Allow,
$user_schema_guid,
[System.DirectoryServices.ActiveDirectorySecurityInheritance]::None
)
$ou_reset_passwords_rule = [System.DirectoryServices.ExtendedRightAccessRule]::New(
$secretop,
[System.Security.AccessControl.AccessControlType]::Allow,
$password_reset_right_guid,
[System.DirectoryServices.ActiveDirectorySecurityInheritance]::Children
)
$acl.AddAccessRule($ou_create_children_rule)
$acl.AddAccessRule($ou_reset_passwords_rule)
Set-ACL -Path $ou_path -AclObject $acl
----

NOTE: The "reset passwords" rule created by the script will show up as applying no permissions in ADSI Edit.
This is because ADSI Edit is unaware of the extended right that it grants. The rule _should not_ be
deleted or modified manually, or the operator will break. If the rule has been tampered with, run the
script again to fix the problem.

Alternatively, it can be configured manually using the graphical "ADSI Edit" tool. Secret Operator's user needs two permission rules
on the base container:

- On the container itself: Create User objects
- On descendants of the container: Reset Password (this is not visible in the GUI, but is granted by the "All extended rights" toggle)


[#ad-samaccountname]
===== Custom `samAccountName` generation

Expand Down Expand Up @@ -273,7 +323,7 @@ spec:
passwordCacheSecret:
namespace: default
name: secret-operator-ad-passwords
userDistinguishedName: CN=Users,DC=sble,DC=test
userDistinguishedName: OU=SDP,DC=sble,DC=test
schemaDistinguishedName: CN=Schema,CN=Configuration,DC=sble,DC=test
adminKeytabSecret:
namespace: default
Expand All @@ -290,8 +340,8 @@ spec:
`kerberosKeytab.admin.activeDirectory.ldapServer`:: An AD LDAP server, such as the AD Domain Controller. This _must_ match the server's FQDN, or GSSAPI authentication will fail.
`kerberosKeytab.admin.activeDirectory.ldapTlsCaSecret`:: Reference (`name` and `namespace`) to a K8s `Secret` object containing the TLS CA (in `ca.crt`) that the LDAP server's certificate should be authenticated against.
`kerberosKeytab.admin.activeDirectory.passwordCacheSecret`:: Reference (`name` and `namespace`) to a K8s `Secret` object where workload passwords will be stored. This _must not_ be accessible to end users.
`kerberosKeytab.admin.activeDirectory.userDistinguishedName`:: The root Distinguished Name (DN) where service accounts should be provisioned, typically `CN=Users,\{domain_dn\}`.
`kerberosKeytab.admin.activeDirectory.schemaDistinguishedName`:: The root Distinguished Name (DN) for AD-managed schemas, typically `CN=Schema,CN=Configuration,\{domain_dn\}`.
`kerberosKeytab.admin.activeDirectory.userDistinguishedName`:: The root Distinguished Name (DN) of the container where service accounts should be provisioned, such as `OU=SDP,\{domain_dn\}`.
`kerberosKeytab.admin.activeDirectory.schemaDistinguishedName`:: The root Distinguished Name (DN) of the container for AD-managed schemas, typically `CN=Schema,CN=Configuration,\{domain_dn\}`.
`kerberosKeytab.adminKeytabSecret`:: Reference (`name` and `namespace`) to a K8s `Secret` object where a keytab with administrative privileges is stored in the key `keytab`.
`kerberosKeytab.adminPrincipal`:: The name of the Kerberos principal to be used by the Secret Operator. This should be provided by the Kerberos administrator. The credentials for this principal must be stored in the keytab (`adminKeytabSecret`).

Expand Down
Loading