Deploying to a Container (Kubernetes) Platform

The credentials supplied here are used in the container startup to run configuration tasks and setup Leap. Make sure to update the credentials in the custom values if they are changed manually.

The default credentials are set to leapadmin for username and password:

security:
  # Security configuration for Leap
  leap:
    # Credentials used for IBM WebSphere Application Server administrative access.
    # Whenever the credentials are changed in LDAP, the values for wasUser and wasPassword need to be 
manually updated accordingly.
    wasUser: "leapadmin"
    wasPassword: "leapadmin"

The Leap Helm chart and container offer a basic SAML configuration through the Helm values. This can be used to enable SAML, deploy the WebSphereSamlSP.ear, configure the ACS URL, pass the IdP Metadata of the identity provider and add trusted realms.

Example configuration:

security:
  # Security configuration for Leap
  leap:
    # Basic SAML installation and configuration.
    # Please refer to:
    # https://www.ibm.com/docs/en/was/9.0.5?topic=swss-saml-web-single-sign-sso-trust-
association-interceptor-tai-custom-properties
    # and
    # https://www.ibm.com/docs/en/was/9.0.5?topic=sign-configuring-single-sso-partners
    # for reference and additional manual configuration.
    saml:
      # If enabled, this will install the "WebSphereSamlSP.ear" and apply the configuration below 
if they are defined
      # This value can currently only be used to enable the SAML TAI SSO. To disable it, please 
set the flag to false and remove the Trust Association manually in WebSphere
      enabled: true
      # -----
      # WARNING: "acsUrl" and "idpMetadata" are currently only applied once.
      # To update those settings the previous configuration must be removed manually in the WAS console. 
Afterwards it can be changed here again.
      # -----
      # This property specifies the URL of the ACS or business application.
      # This will add a SAML TAI SSO with ssoId "9999" in WAS
      acsUrl: "https://my-leap-host.com/samlsps/acs"
      # The metadata of the SAML IdP in xml format.
      # This supports "multi-line strings" as described in 
https://helm.sh/docs/chart_template_guide/yaml_techniques/#strings-in-yaml
      # acsUrl must be set for the idpMetadata to be applied
      # This will add a SAML IdP Partner configuration for ssoId "9999" and idpId "9999" in WAS
      idpMetadata: |
        <?xml version="1.0" encoding="UTF-8"?>
          <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="http://www.okta.com/exkexl6xc9MhzqiC30h7">
              <md:IDPSSODescriptor WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
                  <md:KeyDescriptor use="signing">
                      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                          <ds:X509Data>
                              <ds:X509Certificate>
                  MIIDpDCCAoygAwIBAgIGAWMnhv7cMA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJVUzETMBEG
                  ...
                  ...
                  p/qaHYcQd6i2vyor888DLHDPXhSKWhpG
                              </ds:X509Certificate>
                          </ds:X509Data>
                      </ds:KeyInfo>
                  </md:KeyDescriptor>
                  <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
                  <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
                  <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://my-saml-idp.com/app/sso/saml"/>
                  <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://my-saml-idp.com/app/sso/saml"/>
              </md:IDPSSODescriptor>
          </md:EntityDescriptor>
      # Inbound trusted realms for the IdP
      realmList: 
        - my-trusted-realm.com

The contextRoot parameters allow the configuration of the context roots set for Leap:

# Application configuration
configuration:
  # Application specific configuration for Leap
  leap:
    # This sets the context roots for the leap application
    contextRoot:
      leap: /apps
      leapBasicAuth: /apps-basic

Leap properties example:

# Application configuration
configuration:
  # Application specific configuration for Leap
  leap:
    # This supports "multi-line strings" as described in https://helm.sh/docs/chart_template_guide/yaml_techniques/#strings-in-yaml
    leapProperties: |
      ibm.nitro.InfoEntryPoint.dailyInfo = <div>Welcome to <b>HCL Leap</b> in Helm!</div>

The roleMapping section of the Helm values give the option to specify the security mappings of users or groups in WebSphere for the Leap application. Please refer to the WebSphere documentation for a reference on the effects of those values.

# Application configuration
configuration:
  # Application specific configuration for Leap
  leap:
    # The role mapping is applied for the "Security role to user/group mapping" in WebSphere for Leap
    roleMapping:
      SuperAdminUsers:
        Everyone: false
        AllAuthenticated: false
        MappedUsers:
          - leapadmin
        MappedGroups: []
        AllAuthenticatedInTrustedRealms: false
        MappedUsersAccessIDs: []
        MappedGroupsAccessIDs: []
      EditApplicationsUsers:
        Everyone: false
        AllAuthenticated: false
        MappedUsers:
          - leapadmin
        MappedGroups: []
        AllAuthenticatedInTrustedRealms: false
        MappedUsersAccessIDs: []
        MappedGroupsAccessIDs: []
      AdministrativeUsers:
        Everyone: false
        AllAuthenticated: false
        MappedUsers:
          - leapadmin
        MappedGroups: []
        AllAuthenticatedInTrustedRealms: false
        MappedUsersAccessIDs: []
        MappedGroupsAccessIDs: []
      UseApplicationsUsers:
        Everyone: false
        AllAuthenticated: false
        MappedUsers: []
        MappedGroups: []
        AllAuthenticatedInTrustedRealms: true
        MappedUsersAccessIDs: []
        MappedGroupsAccessIDs: []