啟用外部驗證功能

私有雲 v4.18.05 的邊緣

本節說明如何取得、安裝及設定將 LDAP 服務整合至 Apigee Edge 以進行使用者驗證所需的元件。

必要條件

  • 您必須有 Private Cloud 4.18.05 適用的 Apigee Edge 安裝作業。
  • 您必須在 Apigee Edge for Private Cloud 上具備全域系統管理員憑證,才能執行這項安裝作業。
  • 您必須知道 Apigee Edge 安裝私有雲的根目錄。預設的根目錄為 /opt
  • 您必須將 Edge 全域系統管理員憑證新增至外部 LDAP。請注意,sysadmin 憑證預設會儲存在 Edge 內部 LDAP。切換至 external LDAP 後,系統會改為在該處驗證 sysadmin 憑證。因此,您必須先將憑證佈建至外部系統,然後才能在 Edge 中啟用外部驗證。

    舉例來說,如果您已設定並安裝私有雲適用的 Apigee Edge,且全域系統管理員憑證為:

    username: edgeuser@mydomain.com
    password: Secret123

    接著,外部 LDAP 中也必須含有密碼為 Secret123 的使用者 edgeuser@mydomain.com

  • 如果您正在執行管理伺服器叢集,請務必為每個管理伺服器執行本文件中的所有步驟。

設定外部驗證

您將執行的主要活動是設定 management-server.properties 檔案。這個活動包括停止及啟動 Edge Management Server,以及決定要使用直接或間接繫結、加密機密憑證,以及其他相關工作。

  1. 重要事項:現在請決定要使用間接還是直接繫結驗證方法。這項決定會影響設定的某些部分。請參閱外部驗證
  2. 重要事項:您必須在每個 Apigee Edge Management Server 上執行這些設定步驟 (如果您使用多個 Apigee),
  3. 在文字編輯器中開啟 /opt/apigee/customer/application/management-server.properties。如果檔案不存在,請建立一個。
  4. 新增下列程式碼:
    conf_security_authentication.user.store=externalized.authentication

    這行程式碼會在 Edge 中新增外部驗證功能,以便安裝 Private Cloud。

  5. 為簡化這個步驟,我們建立了兩個註解清楚的範例設定,分別用於直接繫結驗證和間接繫結驗證。請參閱以下範例,瞭解要使用的繫結並完成設定:
  6. 重新啟動管理伺服器:
    /opt/apigee/apigee-service/bin/apigee-service edge-management-server restart
  7. 確認伺服器是否正在運作:
    /opt/apigee/apigee-service/bin/apigee-all status
  8. 重要事項:如果遇到以下情況 (或兩者皆有),您必須進行額外設定:
    1. 如果您打算讓使用者以非電子郵件地址的使用者名稱登入。在這種情況下,您的 sysadmin 使用者也必須透過使用者名稱進行驗證。

      和/或

    2. 如果外部 LDAP 中的 sysadmin 使用者帳戶密碼與首次安裝適用於 Private Cloud 的 Apigee Edge 時設定的密碼不同。請參閱不同的 sysadmin 憑證需要進行設定

直接繫結設定範例

## The first property is always required to enable the external authorization feature.
## Do not change it.
conf_security_externalized.authentication.implementation.class=com.apigee.rbac.impl.LdapAuthenticatorImpl

## Identify the type of binding:
## Set to "true" for direct binding
## Set to "false" for indirect binding.
conf_security_externalized.authentication.bind.direct.type=true

## The next seven properties are needed regardless of direct or indirect binding. You need to
## configure these per your external authentication installation.
## The IP or domain for your external LDAP instance. 
conf_security_externalized.authentication.server.url=ldap://localhost:389

## Your external LDAP server version.
conf_security_externalized.authentication.server.version=3

## The server timeout in milliseconds. 
conf_security_externalized.authentication.server.conn.timeout=50000

## Change these baseDN values to match your external LDAP service. This attribute value will be
## provided by your external LDAP administrator, and may have more or fewer dc elements depending
## on your setup.
conf_security_externalized.authentication.user.store.baseDN=dc=apigee,dc=com

## Do not change this search string. It is used internally. 
conf_security_externalized.authentication.user.store.search.query=(&(${userAttribute}=${userId}))

## Identifies the external LDAP property you want to bind against for Authentication. For
## example if you are binding against an email address in Microsoft Active Directory, this would be
## the userPrincipalName property in your external LDAP instance. Alternatively if you are binding
## against the user's ID, this would typically be in the sAMAccountName property:
conf_security_externalized.authentication.user.store.user.attribute=userPrincipalName

## The LDAP attribute where the user email value is stored. For direct binding with AD, set it to
## userPrincipalName.
conf_security_externalized.authentication.user.store.user.email.attribute=userPrincipalName

## ONLY needed for DIRECT binding.
## The direct.bind.user.directDN property defines the string that is used for the bind against the
## external authentication service. Ensure it is set as follows:
conf_security_externalized.authentication.direct.bind.user.directDN=${userDN}

「INDIRECT BINDING」設定範例

## Required to enable the external authorization feature. Do not change it.
conf_security_externalized.authentication.implementation.class=com.apigee.rbac.impl.LdapAuthenticatorImpl

## Identifies the type of binding:
## Set to "true" for direct binding
## Set to "false" for indirect binding.
conf_security_externalized.authentication.bind.direct.type=false

## The next seven properties are needed regardless of direct or indirect binding. You need to
## configure these per your external LDAP installation.
## The IP or domain for your external LDAP instance.
conf_security_externalized.authentication.server.url=ldap://localhost:389

## Replace with your external LDAP server version.
conf_security_externalized.authentication.server.version=3

## Set the server timeout in milliseconds. 
conf_security_externalized.authentication.server.conn.timeout=50000

## Change these baseDN values to match your external LDAP service. This attribute value will be
# provided by your external LDAP administrator, and may have more or fewer dc elements
# depending on your setup.
conf_security_externalized.authentication.user.store.baseDN=dc=apigee,dc=com

## Do not change this search string. It is used internally. 
conf_security_externalized.authentication.user.store.search.query=(&(${userAttribute}=${userId}))

## Identifies the external LDAP property you want to bind against for Authentication. For example
## if you are binding against an email address, this would typically be in the
## userPrincipalName property in your external LDAP instance. Alternatively if you are binding
## against the user's ID, this would typically be in the sAMAccountName property.
## See also "Configuration required for different sysadmin credentials".
conf_security_externalized.authentication.user.store.user.attribute=userPrincipalName

## Used by Apigee to perform the Authorization step and currently, Apigee only supports email
## address for Authorization. Make sure to set it to the attribute in your external LDAP that
## stores the user's email address. Typically this will be in the userPrincipalName property.
conf_security_externalized.authentication.user.store.user.email.attribute=userPrincipalName

## The external LDAP username (for a user with search privileges on the external LDAP) and
## password and whether the password is encrypted. You must also set the attribute
## externalized.authentication.bind.direct.type to false.
## The password attribute can be encrypted or in plain text. See
## "Indirect binding only: Encrypting the external LDAP user's password"
## for encryption instructions. Set the password.encrypted attribute to "true" if the password is
## encrypted. Set it to "false" if the password is in plain text.
conf_security_externalized.authentication.indirect.bind.server.admin.dn=myExtLdapUsername
conf_security_externalized.authentication.indirect.bind.server.admin.password=myExtLdapPassword
conf_security_externalized.authentication.indirect.bind.server.admin.password.encrypted=true

測試安裝

  1. 確認伺服器是否正在運作:
    /opt/apigee/apigee-service/bin/apigee-all status
  2. 執行這個指令,提供一組 Apigee Edge 全域系統管理員憑證。要測試的 API 呼叫只能由 Edge 系統管理員執行。
    curl -v http://management-server-IP:8080/v1/o -u sysadmin_username

    例如:

    curl -v http://192.168.52.100:8080/v1/o -u jdoe@mydomain.com
  3. 在系統提示時輸入密碼。

    如果指令傳回 200 狀態和機構清單,即代表設定正確。 這個指令會驗證對 Edge Management Server 發出的 API 呼叫是否已成功透過外部 LDAP 系統進行驗證。