Post-installation tasks
Complete the required post-installation tasks to prepare IBM Bob for end users, including TLS certificates, LDAP federation, user access, and endpoint distribution.
After installing Bob self-hosted, perform the following administrative tasks before onboarding users.
Configure IDP and LDAP federation
With LDAP federation, you can sign in to Bob using your existing LDAP or Active Directory credentials. Configure LDAP federation only if your organization uses a directory service for identity management. If LDAP federation is not required, create users directly in Keycloak.
Obtain the required LDAP or Active Directory configuration values, including:
- LDAP server URL
- User and group search bases
- Bind account information (if applicable)
- CA certificate for LDAPS connections that use a private certificate authority
Create an IDP configuration file from the provided template:
cp config-idp-template.yaml my-idp.yamlUpdate the file with your email domains, admin emails, and LDAP or Active Directory environment details.
Apply the IDP configuration:
./bobctl configure-idp --config my-idp.yaml| Parameter | Description |
|---|---|
--config | Specifies the IDP configuration file. |
--dry-run | Validates the configuration without applying changes. |
Verify the IDP configuration.
View the IDP status:
oc get bobidp -n <instance-namespace>View detailed reconciliation information:
oc get bobidp bob-idp -n <instance-namespace> -o yamlVerify that the following conditions report a successful status:
| Condition | Description |
|---|---|
Ready | All configured domains, administrator assignments, and LDAP providers were reconciled successfully. |
LDAPRegistered | The LDAP provider was registered in Keycloak. |
LDAPReachable | The LDAP server is reachable from the cluster. |
LDAPAuthenticated | LDAP authentication completed successfully. |
LDAPUserSyncSucceeded | Initial user synchronization completed successfully. Present only when userSync.enabled: true. |
By default, bobctl waits up to 600 seconds for reconciliation to complete. To change the timeout:
BOB_IDP_WAIT_TIMEOUT=900 ./bobctl configure-idp --config my-idp.yamlYou can configure multiple LDAP providers in a single configuration file by defining multiple entries in the ldaps list. A separate bobctl configure-idp invocation is not required for each provider.
For full LDAP configuration details, see LDAP integration.
Manage certificates
Bob exposes services over TLS. Client workstations must trust the certificate authority (CA) that issued the cluster certificates.
You can use one of the following certificate approaches:
- Configure an enterprise or public certificate (recommended)
- Generate certificates with OpenSSL
- Use the default self-signed certificate
TLS connection errors in Bob IDE or bob-shell are typically caused by an untrusted CA certificate on the client workstation.
For complete instructions, see TLS certificates.
Configure user access
A Bob self-hosted installation includes a Keycloak identity provider. Before users can access the platform, configure one of the following authentication methods:
- LDAP or Active Directory federation: if you configured LDAP federation using
bobctl configure-idp, users can authenticate with their existing enterprise credentials. See LDAP integration. - Direct Keycloak users: create and manage users directly in Keycloak. This approach is suitable for evaluation environments that do not use LDAP integration.
Retrieve and share the endpoint URL
Provide users with the endpoint information required to connect to Bob.
Retrieve the Bob gateway route hostname:
oc get route \
-n <instance-namespace> \
-l app.kubernetes.io/component=gateway \
-o jsonpath='{.items[0].spec.host}'Example output:
api.bob.example.comConstruct the endpoint URL:
https://api.bob.example.comIf no route is available, verify that the Bob instance is ready:
oc get bob -n <instance-namespace>Confirm that the status is Ready, then provide users with the following information:
| Item | Required |
|---|---|
| Bob endpoint URL | Yes |
CA certificate (bob-ca.crt) | Only when using a self-signed or private CA |
| Authentication details | Yes |