{"id":13144,"date":"2022-06-12T08:16:50","date_gmt":"2022-06-12T05:16:50","guid":{"rendered":"https:\/\/kifarunix.com\/?p=13144"},"modified":"2024-03-09T15:11:25","modified_gmt":"2024-03-09T12:11:25","slug":"integrate-portainer-with-openldap-for-authentication","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/integrate-portainer-with-openldap-for-authentication\/","title":{"rendered":"Integrate Portainer with OpenLDAP for Authentication"},"content":{"rendered":"\n<p>Follow through this guide to learn how to integrate Portainer with OpenLDAP for authentication. By default, Portainer ships with its own internal authentication mechanism. But if you are using OpenLDAP in your environment, you can easily integrate Portainer with it to make the management of user accounts and access to various container environments easy.<\/p>\n\n\n\n<p><em>When using LDAP authentication, Portainer will delegate user authentication to a LDAP server and fallback to internal authentication if LDAP authentication fails.<\/em><\/p>\n\n\n\n<p>With Portainer community edition, some features are not available.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Integrate Portainer with OpenLDAP for Authentication<\/h2>\n\n\n\n<p>To begin with, ensure you have a Portainer and OpenLDAP already installed and setup.<\/p>\n\n\n\n<p>You can use some of our tutorials below;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Install Portainer on Linux<\/h3>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/?s=install+portainer\" target=\"_blank\" rel=\"noreferrer noopener\">Install and Setup Portainer in Linux<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Install OpenLDAP Server on Linux<\/h3>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/?s=install+openldap\" target=\"_blank\" rel=\"noreferrer noopener\">Install and Configure OpenLDAP for Authentication<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Create OpenLDAP Portainer Access Groups<\/h3>\n\n\n\n<p>To make the account and access management easy, you can create specific groups on OpenLDAP.<\/p>\n\n\n\n<p>Each user that needs to access and manage various container environments via the Portainer web interface can belong to a specific OpenLDAP group.<\/p>\n\n\n\n<p>As per the guide below, we have created two groups, <strong><code>devops<\/code><\/strong> and <strong><code>admins<\/code><\/strong> on OpenLDAP;<\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/how-to-create-openldap-member-groups\/\" target=\"_blank\" rel=\"noreferrer noopener\">How to Create OpenLDAP Member Groups<\/a><\/p>\n\n\n\n<p>Confirming the groups and members;<\/p>\n\n\n\n<p>Devops Group<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ldapsearch -H ldapi:\/\/\/ -Y EXTERNAL -LLL -QQQ \\\n-b \"dc=ldapmaster,dc=kifarunix-demo,dc=com\" cn=devops<\/code><\/pre>\n\n\n\n<p>Sample output;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>\ndn: cn=devops,ou=groups,dc=ldapmaster,dc=kifarunix-demo,dc=com\nobjectClass: groupOfNames\ncn: devops\nmember: uid=janedoe,ou=people,dc=ldapmaster,dc=kifarunix-demo,dc=com\nmember: uid=johndoe,ou=people,dc=ldapmaster,dc=kifarunix-demo,dc=com\n<\/code><\/pre>\n\n\n\n<p>The individual users have the memberOf attributes defined;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>memberOf: cn=devops,ou=groups,dc=ldapmaster,dc=kifarunix-demo,dc=com<\/code><\/pre>\n\n\n\n<p>Admins Group;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ldapsearch -H ldapi:\/\/\/ -Y EXTERNAL -LLL -QQQ \\\n-b \"dc=ldapmaster,dc=kifarunix-demo,dc=com\" cn=admins<\/code><\/pre>\n\n\n\n<p>Sample output;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>\ndn: cn=admins,ou=groups,dc=ldapmaster,dc=kifarunix-demo,dc=com\nobjectClass: groupOfNames\ncn: admins\nmember: uid=koromicha,ou=people,dc=ldapmaster,dc=kifarunix-demo,dc=com\nmember: uid=linus,ou=people,dc=ldapmaster,dc=kifarunix-demo,dc=com\n<\/code><\/pre>\n\n\n\n<p>The individual users have the memberOf attributes defined;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>memberOf: cn=admins,ou=groups,dc=ldapmaster,dc=kifarunix-demo,dc=com<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>ldapsearch -Y EXTERNAL -H ldapi:\/\/\/ -b \"dc=ldapmaster,dc=kifarunix-demo,dc=com\" uid=* memberOf -QQQ -LLL<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>dn: uid=johndoe,ou=people,dc=ldapmaster,dc=kifarunix-demo,dc=com\nmemberOf: cn=devops,ou=groups,dc=ldapmaster,dc=kifarunix-demo,dc=com\n\ndn: uid=janedoe,ou=people,dc=ldapmaster,dc=kifarunix-demo,dc=com\nmemberOf: cn=devops,ou=groups,dc=ldapmaster,dc=kifarunix-demo,dc=com\n\ndn: uid=koromicha,ou=people,dc=ldapmaster,dc=kifarunix-demo,dc=com\nmemberOf: cn=admins,ou=groups,dc=ldapmaster,dc=kifarunix-demo,dc=com\n\ndn: uid=linus,ou=people,dc=ldapmaster,dc=kifarunix-demo,dc=com\nmemberOf: cn=admins,ou=groups,dc=ldapmaster,dc=kifarunix-demo,dc=com\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Create OpenLDAP Teams Groups on Portainer<\/h3>\n\n\n\n<p>To make access to various Portainer environments easy, you need to create the exact teams names as the OpenLDAP groups on Portainer.<\/p>\n\n\n\n<p>In our OpenLDAP, we have two groups, admins and devops.<\/p>\n\n\n\n<p>Thus, login to Portainer and navigate to <strong>Users &gt; Teams<\/strong> and create teams whose names <strong>matches<\/strong> the OpenLDAP group names.<\/p>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-teams.png\" class=\"td-modal-image\"><div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1900\" height=\"669\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-teams.png\" alt=\"Integrate Portainer with OpenLDAP for Authentication\" class=\"wp-image-13147\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-teams.png?v=1654970506 1900w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-teams-768x270.png?v=1654970506 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-teams-1536x541.png?v=1654970506 1536w\" sizes=\"(max-width: 1900px) 100vw, 1900px\" \/><\/figure><\/div><\/a><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">Connect Portainer to OpenLDAP Server<\/h3>\n\n\n\n<p>Head over to Portainer web interface and navigate to <strong>Settings &gt; Authentications &gt; Click LDAP (LDAP Authentication)<\/strong>.<\/p>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/Portainer-LDAP-Authentication-option.png\" class=\"td-modal-image\"><figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1887\" height=\"750\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/Portainer-LDAP-Authentication-option.png\" alt=\"Integrate Portainer with OpenLDAP for Authentication\" class=\"wp-image-13148\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/Portainer-LDAP-Authentication-option.png?v=1654970627 1887w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/Portainer-LDAP-Authentication-option-768x305.png?v=1654970627 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/Portainer-LDAP-Authentication-option-1536x610.png?v=1654970627 1536w\" sizes=\"(max-width: 1887px) 100vw, 1887px\" \/><\/figure><\/a><\/div>\n\n\n\n<p>Server type, <strong>Custom<\/strong>, is selected by default on the community edition version.<\/p>\n\n\n\n<p>Next, configure OpenLDAP server connection details;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>LDAP server address. Can be IP address or <strong>container resolvable<\/strong> domain name.<\/li>\n\n\n\n<li>Disable anonymous option if your LDAP requires authentication to get records.<\/li>\n\n\n\n<li>Reader DN\/Bind DN and Password. This is the DN used to authenticate to OpenLDAP server to enable you query the directory server for user records.<\/li>\n\n\n\n<li>Click <strong>Test Connectivity<\/strong> to confirm that you can connect to OpenLDAP server with provided credentials;<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1883\" height=\"735\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-ldap-configuration.png\" alt=\"\" class=\"wp-image-13149\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-ldap-configuration.png?v=1654970671 1883w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-ldap-configuration-768x300.png?v=1654970671 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-ldap-configuration-1536x600.png?v=1654970671 1536w\" sizes=\"(max-width: 1883px) 100vw, 1883px\" \/><\/figure>\n\n\n\n<p>Configure OpenLDAP SSL\/TLS connection<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>If your OpenLDAP server is configured with SSL\/TLS, you can enable TLS\/SSL connnection.<\/li>\n\n\n\n<li>Thus;\n<ul class=\"wp-block-list\">\n<li>Enable the use of StartTLS (<em>as you can see we use port 389<\/em>, <em>if using LDAPS\/TLS, change port on the server address above to 636<\/em>)<\/li>\n\n\n\n<li>We chose to Skip certificate verification in this setup.<\/li>\n\n\n\n<li><span style=\"color: initial;\">Test connectivity<\/span><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Define User search configurations.<ul><li><strong>Base DN<\/strong> (where to start when searching for users) e.g: <strong><code>dc=ldapmaster,dc=kifarunix-demo,dc=com<\/code><\/strong><\/li><li><strong>Username attribute<\/strong>: We use <strong><code>uid<\/code><\/strong> in our LDAP setup.<\/li><li><strong>User entry filter<\/strong>: We only allow users whose LDAP entry have host=portainer entry OR they belong to devops OR admins groups.<\/li><li><code><strong>(|(memberOf=cn=admins,ou=groups,dc=ldapmaster,dc=kifarunix-demo,dc=com)(memberOf=cn=devops,ou=groups,dc=ldapmaster,dc=kifarunix-demo,dc=com)(host=portainer))<\/strong><\/code><\/li><\/ul>\n<ul class=\"wp-block-list\">\n<li>We have a user called Alex (uid is alex) with host attribute entry defined as portainer. The rest of users belong to either groups as shown above.<\/li>\n\n\n\n<li>Confirming on LDAP server;<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>ldapsearch -Y EXTERNAL -H ldapi:\/\/\/ -b \"dc=ldapmaster,dc=kifarunix-demo,dc=com\" uid=alex host -QQQ -LLL<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>dn: uid=alex,ou=people,dc=ldapmaster,dc=kifarunix-demo,dc=com\n<strong>host: portainer<\/strong><\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Define Group Search Configuration\n<ul class=\"wp-block-list\">\n<li><strong>Group Base DN<\/strong>: dc=ldapmaster,dc=kifarunix-demo,dc=com<\/li>\n\n\n\n<li><strong>Group Membership Attribute<\/strong>: member<\/li>\n\n\n\n<li><strong>Filter<\/strong> (we filter for only member of the devops or admins group created above): (objectClass=groupOfNames)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-ldap_security-users-groups.png\" class=\"td-modal-image\"><figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1870\" height=\"660\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-ldap_security-users-groups.png\" alt=\"\" class=\"wp-image-13162\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-ldap_security-users-groups.png?v=1655009788 1870w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-ldap_security-users-groups-768x271.png?v=1655009788 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-ldap_security-users-groups-1536x542.png?v=1655009788 1536w\" sizes=\"(max-width: 1870px) 100vw, 1870px\" \/><\/figure><\/a><\/div>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Save the changes by hitting <strong>Save settings<\/strong> at the bottom;<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Test Login to Portainer using OpenLDAP Account<\/h3>\n\n\n\n<p>Now, logout and test login using OpenLDAP accounts. We will login as LDAP user alex, with host=portainer attribute entry.<\/p>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/test-portainer-ldap-based-user-login.png\" class=\"td-modal-image\"><figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1210\" height=\"709\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/test-portainer-ldap-based-user-login.png\" alt=\"Integrate Portainer with OpenLDAP for Authentication\" class=\"wp-image-13152\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/test-portainer-ldap-based-user-login.png?v=1654971160 1210w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/test-portainer-ldap-based-user-login-768x450.png?v=1654971160 768w\" sizes=\"(max-width: 1210px) 100vw, 1210px\" \/><\/figure><\/a><\/div>\n\n\n\n<p>And there you go! No permissions given yet!<\/p>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-ldap-user-login.png\" class=\"td-modal-image\"><div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1890\" height=\"511\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-ldap-user-login.png\" alt=\"\" class=\"wp-image-13153\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-ldap-user-login.png?v=1654971276 1890w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-ldap-user-login-768x208.png?v=1654971276 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-ldap-user-login-1536x415.png?v=1654971276 1536w\" sizes=\"(max-width: 1890px) 100vw, 1890px\" \/><\/figure><\/div><\/a><\/div>\n\n\n\n<p>Log out and re-login as admin to continue with access management setup.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Grant Portainer Environment\/Endpoints Access to LDAP Users<\/h3>\n\n\n\n<p>You can now grant access to various Portainer environments to various OpenLDAP user groups\/users depending on your setup.<\/p>\n\n\n\n<p>For example, let&#8217;s make Alex and Administrator for Portainer at large;<\/p>\n\n\n\n<p>Under Users, you will see user alex or any other user who has logged in and <strong>authentication<\/strong> method is <strong>LDAP<\/strong>.<\/p>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/Portainer-ldap-users.png\" class=\"td-modal-image\"><figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1890\" height=\"682\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/Portainer-ldap-users.png\" alt=\"\" class=\"wp-image-13154\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/Portainer-ldap-users.png?v=1654971690 1890w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/Portainer-ldap-users-768x277.png?v=1654971690 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/Portainer-ldap-users-1536x554.png?v=1654971690 1536w\" sizes=\"(max-width: 1890px) 100vw, 1890px\" \/><\/figure><\/a><\/div>\n\n\n\n<p>To grant Alex Portainer system wide admin access, click on the username alex and toggle the Administrator button on to make alex admin.<\/p>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/grant-user-admin-rights.png\" class=\"td-modal-image\"><figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1615\" height=\"430\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/grant-user-admin-rights.png\" alt=\"\" class=\"wp-image-13155\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/grant-user-admin-rights.png?v=1654971707 1615w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/grant-user-admin-rights-768x204.png?v=1654971707 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/grant-user-admin-rights-1536x409.png?v=1654971707 1536w\" sizes=\"(max-width: 1615px) 100vw, 1615px\" \/><\/figure><\/a><\/div>\n\n\n\n<p>Save the changes by clicking <strong>Save<\/strong> button. Alex is now Portainer system wide administrator.<\/p>\n\n\n\n<p>To avoid having to grant each individual user access to specific environments, you can utilize the groups created before. Remember we had two groups, <strong>admins<\/strong> and <strong>devops<\/strong> created both on LDAP and Portainer.<\/p>\n\n\n\n<p>Thus, you can grant access to various endpoints to users based on their group names.<\/p>\n\n\n\n<p>As you can see, at the moment, we only have the local Portainer docker environment connected;<\/p>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-environments-local.png\" class=\"td-modal-image\"><figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1897\" height=\"392\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-environments-local.png\" alt=\"\" class=\"wp-image-13158\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-environments-local.png?v=1654972349 1897w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-environments-local-768x159.png?v=1654972349 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-environments-local-1536x317.png?v=1654972349 1536w\" sizes=\"(max-width: 1897px) 100vw, 1897px\" \/><\/figure><\/a><\/div>\n\n\n\n<p>Now that we have two groups of users, lets grant users in admins\/devops groups access to local environment.<\/p>\n\n\n\n<p>Thus, under <strong>Environment<\/strong> &gt; <strong>Groups<\/strong> &gt; <strong>local environment<\/strong> &gt; click <strong>Manage access<\/strong>. Under <strong>Create Access<\/strong> &gt; <strong>Select user(s) and\/or team(s)<\/strong> &gt; Select teams. <em>Ability to select roles other than standard user is not possible on community edition<\/em>.<\/p>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-create-team-access.png\" class=\"td-modal-image\"><figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1885\" height=\"773\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-create-team-access.png\" alt=\"\" class=\"wp-image-13160\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-create-team-access.png?v=1655009535 1885w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-create-team-access-768x315.png?v=1655009535 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-create-team-access-1536x630.png?v=1655009535 1536w\" sizes=\"(max-width: 1885px) 100vw, 1885px\" \/><\/figure><\/a><\/div>\n\n\n\n<p>and click Create access.<\/p>\n\n\n\n<p>You can also give access to specific components of the Portainer environment.<\/p>\n\n\n\n<p>For example, click Home &gt; Open specific environment e.g local &gt; Stacks\/Volumes\/Networks\/Containers &gt; you can give access accordingly.<\/p>\n\n\n\n<p>So take for example, to restrict access to Portainer containers, navigate to containers under local environment &gt; click Portainer container name &gt; Access Control &gt; Change ownership &gt; Restricted &gt; Authorized teams &gt; Select appropriate teams.<\/p>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-environment-access-restriction.png\" class=\"td-modal-image\"><figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1891\" height=\"777\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-environment-access-restriction.png\" alt=\"\" class=\"wp-image-13161\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-environment-access-restriction.png?v=1655009657 1891w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-environment-access-restriction-768x316.png?v=1655009657 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/portainer-environment-access-restriction-1536x631.png?v=1655009657 1536w\" sizes=\"(max-width: 1891px) 100vw, 1891px\" \/><\/figure><\/a><\/div>\n\n\n\n<p>Update ownership.<\/p>\n\n\n\n<p>See screenshot below for restriction of the Volumes on the local environment to users in admins groups only;<\/p>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/restrict-access-to-volumes-portainer.png\" class=\"td-modal-image\"><figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1904\" height=\"696\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/restrict-access-to-volumes-portainer.png\" alt=\"\" class=\"wp-image-13163\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/restrict-access-to-volumes-portainer.png?v=1655010011 1904w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/restrict-access-to-volumes-portainer-768x281.png?v=1655010011 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/restrict-access-to-volumes-portainer-1536x561.png?v=1655010011 1536w\" sizes=\"(max-width: 1904px) 100vw, 1904px\" \/><\/figure><\/a><\/div>\n\n\n\n<p>If you login as a user in devops group, you wouldnt be able to access the restricted volume;<\/p>\n\n\n\n<p>See johndoe from devops group cannot access volumes;<\/p>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/restricted-volume-access-to-ldap-users.png\" class=\"td-modal-image\"><figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1913\" height=\"478\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/restricted-volume-access-to-ldap-users.png\" alt=\"\" class=\"wp-image-13164\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/restricted-volume-access-to-ldap-users.png?v=1655010152 1913w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/restricted-volume-access-to-ldap-users-768x192.png?v=1655010152 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/06\/restricted-volume-access-to-ldap-users-1536x384.png?v=1655010152 1536w\" sizes=\"(max-width: 1913px) 100vw, 1913px\" \/><\/figure><\/a><\/div>\n\n\n\n<p>And that is how easy it is to control access to Portainer environment and specific resources using LDAP based authentication.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Other Tutorials<\/h3>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/integrate-syspass-with-openldap-for-authentication\/\" target=\"_blank\" rel=\"noreferrer noopener\">Integrate sysPass with OpenLDAP for Authentication<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/integrate-gitlab-with-openldap-for-authentication\/\" target=\"_blank\" rel=\"noreferrer noopener\">Integrate Gitlab with OpenLDAP for Authentication<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Follow through this guide to learn how to integrate Portainer with OpenLDAP for authentication. By default, Portainer ships with its own internal authentication mechanism. But<\/p>\n","protected":false},"author":1,"featured_media":13166,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[121,285,1099,34],"tags":[5393,5397,5396,5394,5395],"class_list":["post-13144","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-howtos","category-directory-server","category-openldap","category-security","tag-integrate-portainer-with-openldap-for-authentication","tag-ldap-for-portainer","tag-portainer-authentication-ldap","tag-portainer-openldap","tag-setup-portainer-with-openldap","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/13144"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=13144"}],"version-history":[{"count":6,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/13144\/revisions"}],"predecessor-version":[{"id":20565,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/13144\/revisions\/20565"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media\/13166"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=13144"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=13144"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=13144"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}