This message was deleted.

Thanks @powerful-librarian-10572 ..Can you clarify this ..Rancher needs a service account that has read-only access to all of the domains that will be able to login, so that we can determine what groups a user is a member of when they make a request with an API key.

By default iirc, openldap doesn't restrict the read scope of an user but i could be wrong

if you don't mind can you see this @powerful-librarian-10572 .. In ldap auth provider hostname --> ************ port ***** --->given based on my ldap setup .. service account distinguished name place --> i have created dn: uid=rancher-service-account,ou=rancher,dc=tech*******,dc=com via ldap ..which i entered .. service account password: ***** user seacrh base ou=rancher,dc=tech*******,dc=com Under Test and enable authentication place username and password which i need to give ??

I'm sorry i'm struggling to follow you

Rancher needs a service account that has read-only access to all of the domains that will be able to login, so that we can determine what groups a user is a member of when they make a request with an API key. can you clarify above statement @powerful-librarian-10572

You need a permanent service account (with minimal privieges) to access the openldap data

[root@db2-primary sa]# cat sa-full-role.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: fluentd-service-account roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: rancher-service-account subjects: - kind: ServiceAccount name: rancher-service-account namespace: rancher --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rancher-service-account namespace: rancher rules: - apiGroups: ["*"] resources: - clusters - namespaces verbs: - get - watch - list --- apiVersion: v1 kind: ServiceAccount metadata: name: rancher-service-account namespace: rancher secrets: - name: rancher-sa-secret

No no a service account in the ldap

service account in ldap mean dn: uid=rancher-service-account,ou=rancher,dc=te******,dc=in

Yes sir

okay bro thanks for clearing my confusion

By default, now anyone can login with ldap (try in private window)

But i can't able to login via other ldap users..

Do you have a log?

In rancher pod there is no relevant logs