<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div dir="ltr">
<div dir="ltr">Hi Ian,
<div> Image version both are correct!</div>
<div> The gangway manifest is generated when executes `skuba cluster init`, I am not sure when you upgrade from Beta4 to Beta5, did you redeploy the whole cluster?
<div><br>
</div>
<div>JenTing</div>
</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">Donaldson, Ian <<a href="mailto:Ian.Donaldson@ngic.com">Ian.Donaldson@ngic.com</a>> 於 2019年8月8日 週四 下午1:23寫道：<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_5376551013285065261WordSection1">
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">I have installed Beta 5, but perhaps it didn’t install correctly over Beta 4. What version of caasp-dex and gangway images should there be?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">I show:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">image:
<a href="http://registry.suse.com/caasp/v4/caasp-dex:2.16.0" target="_blank">registry.suse.com/caasp/v4/caasp-dex:2.16.0</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">image:
<a href="http://registry.suse.com/caasp/v4/gangway:3.1.0" target="_blank">registry.suse.com/caasp/v4/gangway:3.1.0</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Arial,sans-serif;color:black">Ian Donaldson<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Arial,sans-serif;color:black">Unix Systems Administrator<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Arial,sans-serif;color:black">Office: 336-435-3983<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Arial,sans-serif;color:black">ian.donaldson@NGIC.com<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><img width="200" height="37" style="width: 2.0833in; height: 0.3854in;" id="gmail-m_5376551013285065261Picture_x0020_1" src="cid:16c6fc1b82b4cff311" alt="cid:image001.png@01CF32FA.7C387000"></span><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif"> JenTing Hsiao <<a href="mailto:jenting.hsiao@suse.com" target="_blank">jenting.hsiao@suse.com</a>>
<br>
<b>Sent:</b> Thursday, August 8, 2019 1:09 AM<br>
<b>To:</b> Donaldson, Ian <<a href="mailto:Ian.Donaldson@NGIC.COM" target="_blank">Ian.Donaldson@NGIC.COM</a>><br>
<b>Cc:</b> <a href="mailto:caasp-beta@lists.suse.com" target="_blank">caasp-beta@lists.suse.com</a><br>
<b>Subject:</b> Re: [caasp-beta] Dex AD group membership not showing<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<table class="gmail-m_5376551013285065261MsoNormalTable" border="0" cellspacing="4" cellpadding="0">
<tbody>
<tr>
<td style="padding:0.75pt">
<p class="MsoNormal"><span style="color:red">WARNING:</span><u></u><u></u></p>
</td>
</tr>
</tbody>
</table>
<table class="gmail-m_5376551013285065261MsoNormalTable" border="0" cellspacing="4" cellpadding="0">
<tbody>
<tr>
<td style="padding:0.75pt">
<p class="MsoNormal"><span style="color:black">This Message came from an external source. Please exercise caution when opening any attachments or clicking on links.
</span><u></u><u></u></p>
</td>
</tr>
</tbody>
</table>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="4" width="100%" align="center">
</div>
<div>
<div>
<div>
<p class="MsoNormal">Hi Ian,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> Thanks for your reporting. The group scope was added at Beta 5.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">JenTing<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">Donaldson, Ian <<a href="mailto:Ian.Donaldson@ngic.com" target="_blank">Ian.Donaldson@ngic.com</a>>
<span style="font-family:"MS Gothic"">於</span> 2019<span style="font-family:"MS Gothic"">年</span>8<span style="font-family:"MS Gothic"">月</span>8<span style="font-family:"MS Gothic"">日</span>
<span style="font-family:"MS Gothic"">週四</span> <span style="font-family:"MS Gothic"">
上午</span>2:13<span style="font-family:"MS Gothic"">寫道：</span><u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">The issue was not with Dex. The issue is that gangway by default doesn’t have the group scope included! This should really be added to the default yaml shipped
by SUSE. I can imagine most companies being required to leverage existing ldap groups for RBAC rules in K8s.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">I found that this is missing from gangway, and prevents group from even being searched.
</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Gangway yaml requires:</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> scopes: ["openid", "profile", "email", "offline_access",
<b>"groups"</b>]</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Once I added the scope line (it wasn’t there by default) with groups, the group search was executed. I was then able to modify dex for our correct search filter.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> usernamePrompt: User Name</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> userSearch:</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> baseDN: OU=NGIC,DC=NGIC,DC=COM</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> filter: "(objectClass=person)"</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> username: sAMAccountName</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> idAttr: sAMAccountName</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> emailAttr: mail</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> nameAttr: DN</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> groupSearch:</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> baseDN: OU=NGIC,DC=NGIC,DC=COM</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> filter: "(objectCategory=group)"</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> userAttr: DN</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> groupAttr: member</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> nameAttr: sAMAccountName</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Arial,sans-serif;color:black">Ian Donaldson</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Arial,sans-serif;color:black">Unix Systems Administrator</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Arial,sans-serif;color:black">Office: 336-435-3983</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Arial,sans-serif;color:black"><a href="mailto:ian.donaldson@NGIC.com" target="_blank">ian.donaldson@NGIC.com</a></span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><img border="0" width="200" height="37" style="width: 2.0833in; height: 0.3854in;" id="gmail-m_5376551013285065261gmail-m_-24579690107020352Picture_x0020_1" src="cid:16c6fc1b82b4cff311" alt="cid:image001.png@01CF32FA.7C387000"></span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> </span><u></u><u></u></p>
<div>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif"> Donaldson, Ian
<br>
<b>Sent:</b> Tuesday, August 6, 2019 11:58 AM<br>
<b>To:</b> '<a href="mailto:caasp-beta@lists.suse.com" target="_blank">caasp-beta@lists.suse.com</a>' <<a href="mailto:caasp-beta@lists.suse.com" target="_blank">caasp-beta@lists.suse.com</a>><br>
<b>Subject:</b> Dex AD group membership not showing</span><u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<div>
<blockquote style="margin-top:5pt;margin-bottom:5pt">
<div>
<div>
<p class="MsoNormal">How do I get dex to pull down groups for a user? Our company uses Active Directory for ldap, whch I am able to authenticate a user against ok, but I never see any group info in the logs, which we need for tying RBAC to...<br>
<br>
2019-08-01T16:41:02.971260002-04:00 stderr F time="2019-08-01T20:41:02Z" level=info msg="performing ldap search OU=NGIC,DC=NGIC,DC=COM sub (&(objectClass=person)(sAMAccountName=i807154))"<br>
2019-08-01T16:41:02.991102943-04:00 stderr F time="2019-08-01T20:41:02Z" level=info msg="username \"i807154\" mapped to entry CN=Donaldson\, Ian,OU=Permanent,OU=Users,OU=Winston-Salem,OU=Sites,OU=NGIC,DC=NGIC,DC=COM"<br>
2019-08-01T16:41:03.026028235-04:00 stderr F time="2019-08-01T20:41:03Z" level=info msg="login successful: connector \"AD\", username=\"Donaldson, Ian\", email=\"<a href="mailto:Ian.Donaldson@NGIC.COM" target="_blank">Ian.Donaldson@NGIC.COM</a>\", groups=[]"<br>
[CL test] root@plctapconwc001:/var/log/containers #<br>
<br>
Here is my config:<br>
# This is a sample with LDAP as connector.<br>
# Requires a update to fulfill your environment.<br>
connectors:<br>
- type: ldap<br>
id: AD<br>
name: AD<br>
config:<br>
host: <a href="http://adldap.ngic.com:389" target="_blank">adldap.ngic.com:389</a><br>
insecureNoSSL: true<br>
insecureSkipVerify: true<br>
startTLS: true<br>
bindDN: "CN=my bind account"<br>
bindPW: 'password'<br>
usernamePrompt: User Name<br>
userSearch:<br>
baseDN: OU=NGIC,DC=NGIC,DC=COM<br>
filter: "(objectClass=person)"<br>
username: sAMAccountName<br>
#idAttr: DN<br>
#emailAttr: sAMAccountName<br>
#nameAttr: cn<br>
idAttr: DN<br>
emailAttr: mail<br>
nameAttr: cn<br>
groupSearch:<br>
baseDN: OU=NGIC,DC=NGIC,DC=COM<br>
filter: "(objectClass=group)"<br>
#userAttr: distinguishedName<br>
#groupAttr: member<br>
#nameAttr: sAMAccountName<br>
# username: userPrincipalName<br>
userAttr: DN<br>
groupAttr: member<br>
nameAttr: cn<br>
<br>
----------------------------------------------------------------------<br>
Note: Please be aware that unencrypted electronic mail is not secure. For this reason, please do not send any sensitive personal information such
<br>
as your address, driver license, policy number, Social Security Number, or claims information by unencrypted electronic mail. The information
<br>
contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient,
<br>
or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution
<br>
or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying
<br>
to the message and deleting it from your computer. Thank you.<u></u><u></u></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
</div>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="4" width="100%" align="center">
</div>
<p class="MsoNormal">Note: Please be aware that unencrypted electronic mail is not secure. For this reason, please do not send any sensitive personal information such
<br>
as your address, driver license, policy number, Social Security Number, or claims information by unencrypted electronic mail. The information
<br>
contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient,
<br>
or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution
<br>
or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying
<br>
to the message and deleting it from your computer. Thank you.<u></u><u></u></p>
</div>
<p class="MsoNormal">_______________________________________________<br>
caasp-beta mailing list<br>
<a href="mailto:caasp-beta@lists.suse.com" target="_blank">caasp-beta@lists.suse.com</a><br>
Check the mailing list archives or Unsubscribe at <a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.suse.com_mailman_listinfo_caasp-2Dbeta&d=DwMGaQ&c=eX9KRkvDm-KpLMQpCehyR8jZgBp9CE2JNMo9X4BhLFU&r=XL_zjqroomktb1qzCDuhym3JVbyITBCYnbJ2SbM3PwA&m=Glp7DdQmsT1dJ4cXgjT2lsXHNbJU3st2Gx6QTT5m3GM&s=iXf0USm87XXKp_O12GhSjSTA0yv-Lqxxhis0YMZLhPE&e=" target="_blank">
http://lists.suse.com/mailman/listinfo/caasp-beta</a><u></u><u></u></p>
</blockquote>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</body>
</html>