> [!CAUTION]
> **Caution:** This documentation covers Edge for Private Cloud 4.18.05, which is no longer supported. Google does not provide security patches, bug fixes, or technical support for this version. The current supported version is 4.54.00. See the [Edge for Private Cloud documentation](https://docs.apigee.com/private-cloud/latest/overview) for the current version, or [All versions](https://docs.apigee.com/private-cloud/versions) to compare releases.

*Edge for Private Cloud v4.18.05*

After you have enabled SAML on Edge, you can disable Basic Auth. However, **before you
disable Basic Auth**:

- Make sure you have added all Edge users, including system administrators, to your SAML IDP.
- Make sure you have thoroughly tested SAML authentication on the Edge UI and Edge management API.
- If you are using the Apigee Developer Services portal (or simply, *the portal* ), configure and test SAML on the portal to ensure that the portal can connect to Edge. See [Configuring the
  portal to use SAML to communicate with Edge](https://docs.apigee.com/private-cloud/v4.18.05/configuring-developer-services-portal-use-saml-communicate-edge).

## Viewing the current security profile

You can view the Edge security profile to determine the current configuration to determine if
Basic Auth and SAML is currently enabled. Use the following Edge management API call on the Edge
Management Server to view the current security profile used by Edge:

```
curl -H "accept:application/xml" http://localhost:8080/v1/securityprofile -u sysAdminEmail:pWord
```

If you have not yet configured SAML, the response is as shown below meaning Basic Auth is
enabled:

```
<SecurityProfile enabled="true" name="securityprofile">
    <UserAccessControl enabled="true">
    </UserAccessControl>
</SecurityProfile>
```

If you have already enabled SAML, you see the `<ssoserver>` tag in the
output:

```
<SecurityProfile enabled="true" name="securityprofile">
    <UserAccessControl enabled="true">
        <SSOServer>
            <BasicAuthEnabled>true</BasicAuthEnabled>
            <PublicKeyEndPoint>/token_key</PublicKeyEndPoint>
            <ServerUrl>http://35.197.37.220:9099</ServerUrl>
        </SSOServer>
    </UserAccessControl>
</SecurityProfile>
```

Notice that the version with SAML enabled also shows
**\<BasicAuthEnabled\>true\</BasicAuthEnabled\>** meaning Basic Auth is
still enabled.

## Disable Basic Auth

Use the following Edge management API call on the Edge Management Server to disable Basic
Auth. Note that you pass as the payload the XML object returned in the previous section. The only
difference is that you set
**\<BasicAuthEnabled\>false\</BasicAuthEnabled\>**:

```
curl -H "Content-Type: application/xml"
http://localhost:8080/v1/securityprofile  -u sysAdminEmail:pWord -d
 '<SecurityProfile enabled="true" name="securityprofile">
  <UserAccessControl enabled="true">
    <SSOServer>
      <BasicAuthEnabled>false</BasicAuthEnabled>
      <PublicKeyEndPoint>/token_key</PublicKeyEndPoint>
      <ServerUrl>http://35.197.37.220:9099</ServerUrl>
  </SSOServer>
 </UserAccessControl>
</SecurityProfile>'
```

After you disable Basic Auth, any Edge management API call that passes Basic Auth credentials
returns the following error:

```
<Error>
    <Code>security.SecurityProfileBasicAuthDisabled</Code>
    <Message>Basic Authentication scheme not allowed</Message>
    <Contexts/>
</Error>
```

## Re-enable Basic Auth

If for any reason you have to re-enable Basic Auth, you must perform the following steps:

> [!CAUTION]
> **Caution** : As part of re-enabling Basic Auth, you have to temporarily disable **all** authentication on Edge, including SAML.

1. Log in to any Edge ZooKeeper node.
2. Run the following bash script to turn off all security:

   > [!CAUTION]
   > **Caution**: This step disables all authentication on Edge, including SAML.

   ```
   #! /bin/bash
   /opt/apigee/apigee-zookeeper/bin/zkCli.sh -server localhost:2181 <<EOF
   set /system/securityprofile <SecurityProfile></SecurityProfile>
   quit
   EOF
   ```

   You will see output in the form:

   ```
   Connecting to localhost:2181
   Welcome to ZooKeeper!
   JLine support is enabled
   WATCHER::
   WatchedEvent state:SyncConnected
   type:None path:null
   [zk: localhost:2181(CONNECTED) 0]
   set /system/securityprofile <SecurityProfile></SecurityProfile>
   cZxid = 0x89
   ...
   [zk: localhost:2181(CONNECTED) 1] quit
   Quitting...
   ```
3. Re-enable Basic Auth and SAML authentication:  

   ```
   curl -H "Content-Type: application/xml" http://localhost:8080/v1/securityprofile
     -u sysAdminEmail:pWord -d '<SecurityProfile enabled="true" name="securityprofile">
     <UserAccessControl enabled="true">
     <SSOServer>
     <BasicAuthEnabled>true</BasicAuthEnabled>
     <PublicKeyEndPoint>/token_key</PublicKeyEndPoint>
     <ServerUrl>http://35.197.37.220:9099</ServerUrl>
     </SSOServer>
     </UserAccessControl>
     </SecurityProfile>'
   ```

   You can now use Basic Auth again.