LDAP with Active Directory SSO Support for OpenStack¶

StarlingX OpenStack enables Single Sign-On (SSO) for OpenStack Horizon and OpenStack APIs/CLIs by integrating with LDAP-based identity providers, including Windows Active Directory (WAD). The platform’s oidc-auth-apps application (Dex OIDC Proxy IdP) acts as a federation bridge between StarlingX OpenStack Keystone and external LDAP directories, letting enterprise users authenticate with their existing corporate credentials — no separate OpenStack-local accounts are required.

How It Works¶

The integration divides responsibilities between Keystone and Dex:

Keystone delegates user authentication to Dex and retains full control over authorization, project scoping, and access control.
Dex connects to an LDAP backend, validates user credentials, and retrieves group membership.

This separation keeps security policy centralized in Keystone while offloading credential verification to the directory that already manages your users.

Supported LDAP Backends¶

StarlingX OpenStack supports two LDAP backend types, configured as Dex connectors:

Local LDAP — The StarlingX built-in LDAP server (cgcs.local domain). Suitable for standalone deployments or environments without an external directory service.
Remote LDAP / Windows Active Directory — An external LDAP-compatible directory such as Microsoft Active Directory. Suitable for enterprise environments where users and groups are centrally managed.

Both backends can operate simultaneously alongside other identity providers.