Skip to content

Grant Cluster-Admin Access to LDAP Users#

Once you have configured LDAP authentication, you can assign administrative permissions to LDAP identities using the Auth API. To do this, you must first retrieve your session bearer token and use it in the API documentation interface.

Retrieve the Bearer Token#

  1. Log in to the MKE 4k Dashboard.

  2. Open the Developer Tools for your browser.

  3. Locate bearer-token. To do this, refer to the documentation for your browser.

  4. Copy the bearer token value. This value is your authentication token.

Deploy the Authentication Token#

  1. Open the Auth API documentation athttps://<cluster-url>/api/auth/v1/docs.

  2. Click the green Authorize button in the top right corner.

  3. Copy-paste the bearer token value in the authorization dialog.

  4. Click Authorize.s

Grant the Role to an LDAP identity#

Following authorization, you can use the PUT operations under the /grants section of the API specification.

Select the endpoint for the grant you want to make.

Grant Target Endpoint
Organization PUT /grants//org/
Team PUT /grants//team/
LDAP group PUT /grants//group/
User PUT /grants//user/

Important

To give cluster-admin permissions to a user, the user name must match LDAP emailAttr type.

If it is configured to an email address, the configuration should be <username>@<email> or it should be equivalent to the value of the attribute set.

It is not necessary to specify a namespace, unless the cluster-admin permissions are to be given in a specific namespace.

Verification#

Once a PUT request has been issued on the designated endpoint, the user will gain cluster-admin access. Use a GET request for verification.