Red Hat OpenShift Administration III: Scaling Deployments in the Enterprise

OpenShift expands the Kubernetes authentication mechanisms by providing a built-in OAuth server to configure external identity providers (IdPs).

You can authenticate to OpenShift by using client certificates and OAuth access tokens.

OpenShift includes users, groups, and identities.

The mapping methods in OpenShift control how OpenShift establishes mappings between the identities of IdPs and the user resources.

In the OpenShift built-in OAuth server, you can configure different IdPs, such as LDAP and OIDC.

When you configure an LDAP IdP, OpenShift automatically synchronizes the users, but not the groups. Synchronizing LDAP groups requires manual action by an administrator and custom automation.

Use OIDC to automatically synchronize users and groups from an OIDC IdP, such as Google, Microsoft Identity Platform, or Keycloak.

OIDC claims enable OpenShift to read the user information from the OIDC token and to populate the user, identity, and group resources.

OpenShift provides by default the kubeadmin user, which is a special system-level user account with administrative access.

Use service accounts and client certificates to authenticate external resources to the Kubernetes API.