LDAP authentication into control center not working when bindDn and bindPassword are configured using secrets

[cijujoseph]

We tried to configure the bindDn and bindPassword using secrets as shown here for control center. However it doesn't work as expected. When we configure the bindDn and bindPassword in-line (as shown here) it works as expected.

Upon further investigation, we noticed that the jaas-config.file on the pod is malformed when the configuration is via secrets. See below (the bindDn appears to have a double quote at the beginning of the line)

bash-4.4$ cat /mnt/config/shared/jaas-config.file
ldap {
  org.eclipse.jetty.jaas.spi.LdapLoginModule required
  debug="false"
  authenticationMethod="simple"
" bindDn="CN=sa_confluentldapbind,OU=RBAC,DC=xx,DC=xx,DC=com
  bindPassword="xxx"
  contextFactory="com.sun.jndi.ldap.LdapCtxFactory"
  forceBindingLogin="true"
  hostname="xx.xx.com"
  port="389"
  roleBaseDn="ou=RBAC,dc=xx,dc=xx,dc=com"
  roleMemberAttribute="member"
  roleNameAttribute="cn"
  roleObjectClass="group"
  useLdaps="false"
  userBaseDn="dc=xx,dc=xx,dc=com"
  userIdAttribute="sAMAccountName"
  userObjectClass="user"
  userPasswordAttribute="Password"
  userRdnAttribute="sAMAccountName";
};

Our environment is on GCP. We tried to replicate this locally on a minikube using the exact same configuration, but the jaas-config.file rendered correctly on minikube. So wondering if this could be a bug specific to a particular platform?

[cijujoseph]

The lda-credential secret, since it was created from a file from a windows machine, it had a carriage return (\r) in it which was causing the bindDn to get substituted incorrectly. It would be good to get that handled in the operator so others won’t run into such issues in the future.

The command kubectl get configmap controlcenter-shared-config showed the following in the output which helped us figure this out.

jaas-config.file: "ldap {\n  org.eclipse.jetty.jaas.spi.LdapLoginModule required\n
    \ debug=\"false\"\n  authenticationMethod=\"simple\"\n  bindDn=\"xxx\r\"\n  bindPassword=\"xx\"\n
    \ contextFactory=\"com.sun.jndi.ldap.LdapCtxFactory\"\n  forceBindingLogin=\"true\"\n
    \ hostname=\"xxx.xxx.com\"\n  port=\"389\"\n  roleBaseDn=\"ou=RBAC,dc=xxx,dc=xxx,dc=com\"\n
    \ roleMemberAttribute=\"member\"\n  roleNameAttribute=\"cn\"\n  roleObjectClass=\"group\"\n
    \ useLdaps=\"false\"\n  userBaseDn=\"dc=xxx,dc=xxx,dc=com\"\n  userIdAttribute=\"sAMAccountName\"\n
    \ userObjectClass=\"user\"\n  userPasswordAttribute=\"Password\"\n  userRdnAttribute=\"sAMAccountName\";\n};\n"