Post-installation tasks
Complete the required post-installation tasks to prepare IBM Bob for end users, including TLS certificates, LDAP federation, user access, and endpoint distribution.
After installing Bob on-premises, perform the following administrative tasks before onboarding users.
Configure LDAP federation
LDAP federation allows users to sign in to Bob with existing LDAP or Active Directory credentials. Configure LDAP federation only if your organization uses a directory service for identity management. If LDAP federation is not required, create users directly in Keycloak.
Obtain the required LDAP or Active Directory configuration values, including:
- LDAP server URL
- User and group search bases
- Bind account information (if applicable)
- CA certificate for LDAPS connections that use a private certificate authority
Create a configuration file from the provided template:
cp config-ldap-template.yaml my-ldap.yamlUpdate the file with values from your LDAP or Active Directory environment.
Apply the LDAP configuration.
If your directory requires a bind account:
./bobctl add-ldap \
--config my-ldap.yaml \
--bind-password '<bind-password>' \
--ca-cert-file /path/to/ca.crtIf your directory supports anonymous bind:
./bobctl add-ldap --config my-ldap.yaml| Parameter | Description |
|---|---|
--config | Specifies the LDAP configuration file. |
--bind-password | Specifies the bind account password. Required unless anonymous bind is enabled. |
--ca-cert-file | Specifies the CA certificate for LDAPS connections that use a private CA. |
--dry-run | Validates the configuration without applying changes. |
Verify the LDAP configuration.
View the LDAP provider status:
oc get bobldap -n <instance-namespace>View detailed reconciliation information:
oc get bobldap <provider-name> -n <instance-namespace> -o yamlVerify that the following conditions report a successful status:
| Condition | Description |
|---|---|
Ready | LDAP provider registered successfully. |
LDAPReachable | LDAP server is reachable from the cluster. |
LDAPAuthenticated | Authentication completed successfully. |
For full LDAP configuration details, see LDAP integration.
Manage certificates
Bob exposes services over TLS. Client workstations must trust the certificate authority (CA) that issued the cluster certificates.
You can use one of the following certificate approaches:
- Configure an enterprise or public certificate (recommended)
- Generate certificates with OpenSSL
- Use the default self-signed certificate
TLS connection errors in Bob IDE or bob-shell are typically caused by an untrusted CA certificate on the client workstation.
For complete instructions, see TLS certificates.
Configure user access
An on-premises installation of Bob includes a Keycloak identity provider. Before users can access the platform, configure one of the following authentication methods:
- LDAP or Active Directory federation — if LDAP federation was configured using
bobctl add-ldap, users can authenticate with their existing enterprise credentials. See LDAP integration. - Direct Keycloak users — create and manage users directly in Keycloak. This approach is suitable for evaluation environments that do not require LDAP integration.
Retrieve and share the endpoint URL
Provide users with the endpoint information required to connect to Bob.
Retrieve the Bob gateway route hostname:
oc get route \
-n <instance-namespace> \
-l app.kubernetes.io/component=gateway \
-o jsonpath='{.items[0].spec.host}'Example output:
api.bob.example.comConstruct the endpoint URL:
https://api.bob.example.comIf no route is available, verify that the Bob instance is ready:
oc get bob -n <instance-namespace>Confirm that the status is Ready, then provide users with the following information:
| Item | Required |
|---|---|
| Bob endpoint URL | Yes |
CA certificate (bob-ca.crt) | Only when using a self-signed or private CA |
| Authentication details | Yes |