How to enable LDAP authentication

vmk8s

The Lightweight Directory Access Protocol (LDAP) enables centralised authentication for PostgreSQL clusters, reducing the overhead of managing local credentials and access policies.

This guide goes over the steps to integrate LDAP as an authentication method with the PostgreSQL charm, all within the Juju ecosystem.

Do not use self-signed certificates in production.

In this guide, we use self-signed certificates provided by the self-signed-certificates operator .

This is not recommended for a production environment.

Check the collection of Charmhub operators that implement the tls-certificate interface.

Prerequisites

  • Juju v3.6 or higher

  • A Kubernetes Juju controller

  • Juju v3.6 or higher

Deploy an LDAP server on Kubernetes

With PostgreSQL for machines, you’ll need a separate Juju controller with a K8s model in order to deploy the glauth-k8s charm .

Then, we’ll create a cross-controller relation to the PostgreSQL VM model.

juju switch <k8s-controller-name>
juju add-model <k8s-model-name>

With PostgreSQL for Kubernetes, you can simply deploy GLAuth alongside PostgreSQL without a separate Juju model.

Deploy glauth-k8s, self-signed-certificates, and postgresql-k8s:

juju deploy glauth-k8s --channel edge --trust --config ldaps_enabled=true
juju deploy self-signed-certificates
juju deploy postgresql-k8s --channel 16/edge --trust

Integrate the three applications:

juju integrate glauth-k8s:certificates self-signed-certificates
juju integrate glauth-k8s:pg-database postgresql-k8s

Deploy the glauth-utils charm to manage LDAP users, and integrate it with the GLAuth application:

juju deploy glauth-utils --channel edge --trust
juju integrate glauth-k8s glauth-utils

Users and groups can now be created using glauth-utils.

Create a cross-model relation (VM only)

Expose cross-controller URLs

Enable the required MicroK8s plugin:

IPADDR=$(ip -4 -j route get 2.2.2.2 | jq -r '.[] | .prefsrc')
sudo microk8s enable metallb $IPADDR-$IPADDR

Deploy the Traefik charm in order to expose endpoints from the K8s cluster:

juju deploy traefik-k8s --trust

Integrate the two applications:

juju integrate traefik-k8s glauth-k8s:ldaps-ingress

Expose cross-model relations

To offer the GLAuth interfaces, run:

juju offer glauth-k8s:ldap ldap
juju offer glauth-k8s:send-ca-cert send-ca-cert

Consume offers

Switch to the VM controller:

juju switch <lxd_controller>:<my-model>

Consume the LDAP offers:

juju consume <k8s_controller>:admin/<k8s-model-name>.ldap
juju consume <k8s_controller>:admin/<k8s-model-name>.send-ca-cert

This step is not needed with PostgreSQL K8s. Proceed to the next section: Map LDAP users to PostgreSQL.

Map LDAP users to PostgreSQL

To have LDAP users available in PostgreSQL, provide a comma separated list of LDAP groups to already created PostgreSQL authorisation groups. To create those groups before hand, refer to the Data Integrator charm .

juju config postgresql ldap-map="<ldap_group>=<psql_group>"

juju config postgresql-k8s ldap-map="<ldap_group>=<psql_group>"

Disable LDAP

You can disable LDAP removing the following relations:

juju remove-relation postgresql.receive-ca-cert send-ca-cert
juju remove-relation postgresql.ldap ldap

juju remove-relation postgresql-k8s:receive-ca-cert send-ca-cert
juju remove-relation postgresql-k8s:ldap ldap