*.aclpolicy 文件不起作用 - 使用 Active Directory 进行身份验证

Question

总结我的环境：

运行 Kuberenetes 集群的 Rundeck (3.3.11)
通过 JDBC 连接器连接的专用数据库 MariaDB。
使用变量 RUNDECK_JAAS_LDAP_ * 通过 JAAS 配置了 Active Directory 并且身份验证正常工作，我可以使用我的 AD 用户登录。
像这样使用 K8s Secret 配置 ACL 策略模板 Zoo sample:

         volumeMounts:
            - name: aclpolicy
              mountPath: /home/rundeck/etc/rundeck-adm.aclpolicy
              subPath: rundeck-adm.aclpolicy
      volumes:
        - name: aclpolicy
          secret:
            secretName: rundeck-adm-policy
            items:
            - key: rundeck-admin-role.yaml
              path: rundeck-adm.aclpolicy

导出到 Rundeck Pod 的变量：

RUNDECK_JAAS_MODULES_0=JettyCombinedLdapLoginModule
RUNDECK_JAAS_LDAP_USERBASEDN=OU=Users,OU=MYBRAND,DC=corp,DC=MYDOMAIN
RUNDECK_JAAS_LDAP_ROLEBASEDN=OU=RundeckRoles,OU=Users,OU=MYBRAND,DC=corp,DC=MYDOMAIN
RUNDECK_JAAS_LDAP_FLAG=sufficient
RUNDECK_JAAS_LDAP_BINDDN=myrundeckuser@mybrand.mydomain
RUNDECK_JAAS_LDAP_BINDPASSWORD=foo

在我的 MS Active Directory 中，结构是：

-mybrand.mydomain
 - MYBRAND
   - Users
     - RundeckRoles
       - rundeck-adm (group with my user associated)

我登录后 returns 这个屏幕：

编辑 1：我的 rundeck-admin-role.yaml:

description: Admin project level access control. Applies to resources within a specific project.
context:
  project: '.*' # all projects
for:
  resource:
    - equals:
        kind: job
      allow: [create] # allow create jobs
    - equals:
        kind: node
      allow: [read,create,update,refresh] # allow refresh node sources
    - equals:
        kind: event
      allow: [read,create] # allow read/create events
  adhoc:
    - allow: [read,run,runAs,kill,killAs] # allow running/killing adhoc jobs
  job:
    - allow: [create,read,update,delete,run,runAs,kill,killAs] # allow create/read/write/delete/run/kill of all jobs
  node:
    - allow: [read,run] # allow read/run for nodes
by:
  group: rundeck-adm

---

description: Admin Application level access control, applies to creating/deleting projects, admin of user profiles, viewing projects and reading system information.
context:
  application: 'rundeck'
for:
  resource:
    - equals:
        kind: project
      allow: [create] # allow create of projects
    - equals:
        kind: system
      allow: [read,enable_executions,disable_executions,admin] # allow read of system info, enable/disable all executions
    - equals:
        kind: system_acl
      allow: [read,create,update,delete,admin] # allow modifying system ACL files
    - equals:
        kind: user
      allow: [admin] # allow modify user profiles
  project:
    - match:
        name: '.*'
      allow: [read,import,export,configure,delete,admin] # allow full access of all projects or use 'admin'
  project_acl:
    - match:
        name: '.*'
      allow: [read,create,update,delete,admin] # allow modifying project-specific ACL files
  storage:
    - allow: [read,create,update,delete] # allow access for /ssh-key/* storage content

by:
  group: rundeck-adm

有人可以帮我找出我的错误吗？

Answer 1

伙计们，我发现了麻烦！

缺少添加一些变量 RUNDECK_JAAS_LDAP_ROLEMEMBERATTRIBUTE 和 RUNDECK_JAAS_LDAP_ROLEOBJECTCLASS，默认如果您不声明，Rundeck 会采用其他值。在我应用此 vars 并重新部署我的 Rundeck Pod 后，我可以使用我的 AD 帐户进行访问。

为了帮助社区，我提供了我在部署中使用的变量列表：

"JVM_MAX_RAM_PERCENTAGE"
"RUNDECK_DATABASE_URL"
"RUNDECK_DATABASE_DRIVER"
"RUNDECK_DATABASE_USERNAME"
"RUNDECK_DATABASE_PASSWORD"
"RUNDECK_LOGGING_AUDIT_ENABLED"
"RUNDECK_JAAS_MODULES_0"
"RUNDECK_JAAS_LDAP_FLAG"
"RUNDECK_JAAS_LDAP_PROVIDERURL"
"RUNDECK_JAAS_LDAP_BINDDN"
"RUNDECK_JAAS_LDAP_BINDPASSWORD"
"RUNDECK_JAAS_LDAP_USERBASEDN"
"RUNDECK_JAAS_LDAP_ROLEBASEDN"
"RUNDECK_GRAILS_URL"
"RUNDECK_SERVER_FORWARDED"
"RUNDECK_JAAS_LDAP_USERRDNATTRIBUTE"
"RUNDECK_JAAS_LDAP_USERIDATTRIBUTE"
"RUNDECK_JAAS_LDAP_ROLEMEMBERATTRIBUTE"

我使用的 JAAS 插件是：JettyCombinedLdapLoginModule

*.aclpolicy 文件不起作用 - 使用 Active Directory 进行身份验证

*.aclpolicy file not works - Auth using Active Directory

authentication

rundeck