Disabling Basic Auth on Edge

Edge for Private Cloud v4.18.01

After you have enabled SAML on Edge, you can disable Basic Auth. However, before you disable Basic Auth:

Viewing the current security profile

You can view the Edge security profile to determine the current configuration to determine if Basic Auth and SAML is currently enabled. Use the following Edge management API call on the Edge Management Server to view the current security profile used by Edge:

> curl -H "accept:application/xml" http://localhost:8080/v1/securityprofile -u sysAdminEmail:pWord

If you have not yet configured SAML, the response is as shown below meaning Basic Auth is enabled:

<SecurityProfile enabled="true" name="securityprofile">
    <UserAccessControl enabled="true">
    </UserAccessControl>
</SecurityProfile>

If you have already enabled SAML, you see the <ssoserver> tag in the output:

<SecurityProfile enabled="true" name="securityprofile">
    <UserAccessControl enabled="true">
        <SSOServer>
            <BasicAuthEnabled>true</BasicAuthEnabled>
            <PublicKeyEndPoint>/token_key</PublicKeyEndPoint>
            <ServerUrl>http://35.197.37.220:9099</ServerUrl>
        </SSOServer>
    </UserAccessControl>
</SecurityProfile>

Notice that the version with SAML enabled also shows <BasicAuthEnabled>true</BasicAuthEnabled> meaning Basic Auth is still enabled.

Disable Basic Auth

Use the following Edge management API call on the Edge Management Server to disable Basic Auth. Note that you pass as the payload the XML object returned in the previous section. The only difference is that you set <BasicAuthEnabled>false</BasicAuthEnabled>:

> curl -H "Content-Type: application/xml"
http://localhost:8080/v1/securityprofile  -u sysAdminEmail:pWord -d
 '<SecurityProfile enabled="true" name="securityprofile">
  <UserAccessControl enabled="true">
    <SSOServer>
      <BasicAuthEnabled>false</BasicAuthEnabled>
      <PublicKeyEndPoint>/token_key</PublicKeyEndPoint>
      <ServerUrl>http://35.197.37.220:9099</ServerUrl>
  </SSOServer>
 </UserAccessControl>
</SecurityProfile>'

After you disable Basic Auth, any Edge management API call that passes Basic Auth credentials returns the following error:

<Error>
    <Code>security.SecurityProfileBasicAuthDisabled</Code>
    <Message>Basic Authentication scheme not allowed</Message>
    <Contexts/>
</Error>

Re-enable Basic Auth

If for any reason you have to re-enable Basic Auth, you must perform the following steps:

Caution: As part of re-enabling Basic Auth, you have to temporarily disable all authentication on Edge, including SAML.

  1. Log in to any Edge ZooKeeper node.
  2. Run the following bash script to turn off all security:
    Caution: This step disables all authentication on Edge, including SAML.

    #! /bin/bash
    /opt/apigee/apigee-zookeeper/bin/zkCli.sh -server localhost:2181 <<EOF
    set /system/securityprofile <SecurityProfile></SecurityProfile>
    quit
    EOF

    You will see output in the form:
    Connecting to localhost:2181
    Welcome to ZooKeeper!
    JLine support is enabled
    WATCHER::

    WatchedEvent state:SyncConnected type:None path:null
    [zk: localhost:2181(CONNECTED) 0] set /system/securityprofile <SecurityProfile></SecurityProfile>
    cZxid = 0x89
    ...
    [zk: localhost:2181(CONNECTED) 1] quit
    Quitting…
  3. Re-enable Basic Auth and SAML authentication:

    > curl -H "Content-Type: application/xml"
    http://localhost:8080/v1/securityprofile -u sysAdminEmail:pWord -d
    '<SecurityProfile enabled="true" name="securityprofile">

    <UserAccessControl enabled="true">
    <SSOServer>
    <BasicAuthEnabled>true</BasicAuthEnabled>
    <PublicKeyEndPoint>/token_key</PublicKeyEndPoint>
    <ServerUrl>http://35.197.37.220:9099</ServerUrl>
    </SSOServer>
    </UserAccessControl>
    </SecurityProfile>'

    You can now use Basic Auth again.