Disabling Basic Auth on Edge

Edge for Private Cloud v4.19.01

After you have enabled SAML on Edge, you can disable Basic Auth. However, before you disable Basic Auth:

  • Make sure you have added all Edge users, including system administrators, to your SAML IDP.
  • Make sure you have thoroughly tested SAML authentication on the Edge UI and Edge management API.
  • If you are using the Apigee Developer Services portal (or simply, the portal), configure and test SAML on the portal to ensure that the portal can connect to Edge. See Configuring the portal to use SAML to communicate with Edge.

Viewing the current security profile

You can view the Edge security profile to determine the current configuration to determine if Basic Auth and SAML is currently enabled. Use the following Edge management API call on the Edge Management Server to view the current security profile used by Edge:

curl -H "accept:application/xml" http://localhost:8080/v1/securityprofile -u sysAdminEmail:pWord

If you have not yet configured SAML, the response is as shown below meaning Basic Auth is enabled:

<SecurityProfile enabled="true" name="securityprofile">
    <UserAccessControl enabled="true">
    </UserAccessControl>
</SecurityProfile>

If you have already enabled SAML, you see the <ssoserver> tag in the output:

<SecurityProfile enabled="true" name="securityprofile">
    <UserAccessControl enabled="true">
        <SSOServer>
            <BasicAuthEnabled>true</BasicAuthEnabled>
            <PublicKeyEndPoint>/token_key</PublicKeyEndPoint>
            <ServerUrl>http://35.197.37.220:9099</ServerUrl>
        </SSOServer>
    </UserAccessControl>
</SecurityProfile>

Notice that the version with SAML enabled also shows <BasicAuthEnabled>true</BasicAuthEnabled> meaning Basic Auth is still enabled.

Disable Basic Auth

Use the following Edge management API call on the Edge Management Server to disable Basic Auth. Note that you pass as the payload the XML object returned in the previous section. The only difference is that you set <BasicAuthEnabled>false</BasicAuthEnabled>:

curl -H "Content-Type: application/xml"
http://localhost:8080/v1/securityprofile  -u sysAdminEmail:pWord -d
 '<SecurityProfile enabled="true" name="securityprofile">
  <UserAccessControl enabled="true">
    <SSOServer>
      <BasicAuthEnabled>false</BasicAuthEnabled>
      <PublicKeyEndPoint>/token_key</PublicKeyEndPoint>
      <ServerUrl>http://35.197.37.220:9099</ServerUrl>
  </SSOServer>
 </UserAccessControl>
</SecurityProfile>'

After you disable Basic Auth, any Edge management API call that passes Basic Auth credentials returns the following error:

<Error>
    <Code>security.SecurityProfileBasicAuthDisabled</Code>
    <Message>Basic Authentication scheme not allowed</Message>
    <Contexts/>
</Error>

Re-enable Basic Auth

If for any reason you have to re-enable Basic Auth, you must perform the following steps:

  1. Log in to any Edge ZooKeeper node.
  2. Run the following bash script to turn off all security: 
    #! /bin/bash
/opt/apigee/apigee-zookeeper/bin/zkCli.sh -server localhost:2181 <<EOF
set /system/securityprofile <SecurityProfile></SecurityProfile>
quit
EOF

    You will see output in the form:

    Connecting to localhost:2181
Welcome to ZooKeeper!
JLine support is enabled
WATCHER::
WatchedEvent state:SyncConnected
type:None path:null
[zk: localhost:2181(CONNECTED) 0]
set /system/securityprofile <SecurityProfile></SecurityProfile>
cZxid = 0x89
...
[zk: localhost:2181(CONNECTED) 1] quit
Quitting...
  3. Re-enable Basic Auth and SAML authentication:
    curl -H "Content-Type: application/xml" http://localhost:8080/v1/securityprofile
  -u sysAdminEmail:pWord -d '<SecurityProfile enabled="true" name="securityprofile">
  <UserAccessControl enabled="true">
  <SSOServer>
  <BasicAuthEnabled>true</BasicAuthEnabled>
  <PublicKeyEndPoint>/token_key</PublicKeyEndPoint>
  <ServerUrl>http://35.197.37.220:9099</ServerUrl>
  </SSOServer>
  </UserAccessControl>
  </SecurityProfile>'

    You can now use Basic Auth again.