Alternative Identity Provider Support for IBM Concert on OpenShift (LDAP & Local Users)

Solution Value Statement

Customers deploying IBM Concert on OpenShift often lack OpenID Connect with Keycloak. Providing alternative authentication options such as LDAP or local user management ensures broader adoption, simplifies onboarding, and meets enterprise security requirements without forcing Keycloak dependency.

Proposed Solution

• Introduce support for LDAP-based authentication for Concert on OpenShift.

• Enable local user creation and management within Concert for environments without external IDPs.

• Provide configuration options via UI and CLI for administrators to select and configure authentication methods.

• Maintain compatibility with existing RBAC and MSP role assignments.

Customer Impact / Business Value

• Expands Concert’s usability for customers without Keycloak or OIDC.

• Reduces friction for OpenShift-based deployments.

• Improves compliance with enterprise identity standards and accelerates adoption in regulated environments.

Pilot or Validation Context

• Validate in OpenShift environments without Keycloak.

• Test LDAP integration with enterprise directories (e.g., Active Directory, OpenLDAP).

• Conduct pilot with customers requesting local user management for small-scale deployments.

Key Functional Requirements

• LDAP integration for authentication.

• Local user creation and management within Concert.

• UI and CLI configuration for selecting authentication method.

• Preserve RBAC and MSP role mapping across authentication modes.

Metrics for Success

• Successful LDAP authentication for 100% of pilot users.

• Ability to create and manage local users without errors.

• Positive feedback from OpenShift customers on flexibility and ease of configuration.

Roadmap & Feature Overlap Analysis

• Existing Epic(s):

  • Permission and RBAC Model (Under consideration)

  • Tag-Based RBAC and Delegated Group Administration (Ready to develop)

  • Secure Configuration Guidance for Tenants (Under consideration)

• Overlap Summary:
  Current roadmap epics address RBAC and secure configuration but do not explicitly cover LDAP or local user support.

• Unmet Needs:

  • LDAP authentication support

  • Local user management

  • UI for configuring alternative IDPs

Related Aha Ideas

• User management (Active Directory, OpenLDAP, 3rd party) (Status: Delivered)

• Concert to offer different connection methods for on-prem/hybrid K8s/OpenShift platform deployments (Status: Not under consideration)

• Enterprise-Grade Access Control for IBM Concert (Status: Under review)