此页面由 Cloud Translation API 翻译。

安装和配置 Edge SSO

适用于私有云的 Edge v4.19.01

要安装和配置 Edge SSO 模块，您必须先生成两组 TLS 密钥和证书。Edge SSO 模块使用 TLS 来确保信息传输安全与 SAML IDP 进行 SAML 握手。

创建 TLS 密钥和证书

以下步骤将创建自签名证书，该证书可能适用于您的测试环境，在生产环境中，您通常需要 CA 签署的证书。

如需创建验证和签名密钥以及自签名证书，请执行以下操作：

sudo mkdir -p /opt/apigee/customer/application/apigee-sso/jwt-keys

cd /opt/apigee/customer/application/apigee-sso/jwt-keys/

sudo openssl genrsa -out privkey.pem 2048

sudo openssl rsa -pubout -in privkey.pem -out pubkey.pem

```
sudo chown apigee:apigee *.pem
```

创建无密码的密钥和自签名证书，以便与 SAML 通信 IDP:

sudo mkdir -p /opt/apigee/customer/application/apigee-sso/saml/

cd /opt/apigee/customer/application/apigee-sso/saml/

使用口令生成私钥：

sudo openssl genrsa -aes256 -out server.key 1024

从密钥中移除口令：

sudo openssl rsa -in server.key -out server.key

为 CA 生成证书签名请求：

sudo openssl req -x509 -sha256 -new -key server.key -out server.csr

生成有效期为 365 天的自签名证书：

sudo openssl x509 -sha256 -days 365 -in server.csr -signkey server.key -out selfsigned.crt

```
sudo chown apigee:apigee server.key
```
```
sudo chown apigee:apigee selfsigned.crt
```

如果您想在 Edge SSO 模块中启用 TLS，请执行以下操作：将 SSO_TOMCAT_PROFILE 设置为 SSL_TERMINATION 或 SSL_PROXY，则不能使用自签名证书。您必须生成证书。请参阅为 apigee-sso 配置 apigee-sso HTTPS 访问。

安装并配置适用于 HTTP 的 Edge SSO 访问权限

如需安装 Edge SSO 模块 apigee-sso，您必须按照相同的流程安装安装 Edge 时使用的凭据。由于 apigee-sso 由 RPM 文件表示，这意味着，执行安装的用户必须是 root 用户或具有完整 sudo 的用户访问权限。如需了解详情，请参阅 Edge 安装概览。

将配置文件传递给安装程序。配置文件的格式如下：

IP1=hostname_or_ip_of_management_server
IP2=hostname_or_ip_of_UI_and_apigge_sso

## Management Server configuration.
MSIP=$IP1
MGMT_PORT=8080
# Edge sys admin username and password as set when you installed Edge.
ADMIN_EMAIL=opdk@google.com
APIGEE_ADMINPW=Secret123
# Set the protocol for the Edge management API. Default is http.
# Set to https if you enabled TLS on the management API.
MS_SCHEME=http

## Postgres configuration.
PG_HOST=$IP1
PG_PORT=5432
# Postgres username and password as set when you installed Edge.
PG_USER=apigee
PG_PWD=postgres

# apigee-sso configuration.
SSO_PROFILE="saml"
# Externally accessible IP or DNS name of apigee-sso.
SSO_PUBLIC_URL_HOSTNAME=$IP2
# Default port is 9099. If changing, set both properties to the same value.
SSO_PUBLIC_URL_PORT=9099
SSO_TOMCAT_PORT=9099
# Set Tomcat TLS mode to DEFAULT to use HTTP access to apigee-sso.
SSO_TOMCAT_PROFILE=DEFAULT
SSO_PUBLIC_URL_SCHEME=http

# SSO admin user name. The default is ssoadmin.
SSO_ADMIN_NAME=ssoadmin
# SSO admin password using uppercase, lowercase, number, and special chars.
SSO_ADMIN_SECRET=Secret123

# Enable the ability to sign an authentication request with SAML SSO.
SSO_SAML_SIGN_REQUEST=y

# Path to signing key and secret from "Create the TLS keys and certificates" above.
SSO_JWT_SIGNING_KEY_FILEPATH=/opt/apigee/customer/application/apigee-sso/jwt-keys/privkey.pem
SSO_JWT_VERIFICATION_KEY_FILEPATH=/opt/apigee/customer/application/apigee-sso/jwt-keys/pubkey.pem

# Name of SAML IDP. For example, okta or adfs.
SSO_SAML_IDP_NAME=okta
# Text displayed to user when they attempt to access Edge UI.
SSO_SAML_IDP_LOGIN_TEXT="Please log in to your IDP"

# The metadata URL from your IDP.
# If you have a metadata file, and not a URL,
# see "Specifying a metadata file instead of a URL" below.
SSO_SAML_IDP_METADATA_URL=https://dev-343434.oktapreview.com/app/exkar20cl/sso/saml/metadata

# Specifies to skip TLS validation for the URL specified
# by SSO_SAML_IDP_METADATA_URL. Necessary if URL uses a self-signed cert.
# Default value is "n".
SSO_SAML_IDPMETAURL_SKIPSSLVALIDATION=n

# SAML service provider key and cert from "Create the TLS keys and certificates" above.
SSO_SAML_SERVICE_PROVIDER_KEY=/opt/apigee/customer/application/apigee-sso/saml/server.key
SSO_SAML_SERVICE_PROVIDER_CERTIFICATE=/opt/apigee/customer/application/apigee-sso/saml/selfsigned.crt
# The passphrase used when you created the SAML cert and key.
# The section "Create the TLS keys and certificates" above removes the passphrase,
# but this property is available if you require a passphrase.
# SSO_SAML_SERVICE_PROVIDER_PASSWORD=samlSP123

# Requires that SAML responses be signed by your IDP.
SSO_SAML_SIGNED_ASSERTIONS=y

# Must configure an SMTP server so Edge SSO can send emails to users.
SKIP_SMTP=n
SMTPHOST=smtp.example.com
SMTPUSER=smtp@example.com
# omit for no username
SMTPPASSWORD=smtppwd
# omit for no password
SMTPSSL=n
SMTPPORT=25
SMTPMAILFROM="My Company <myco@company.com>"

如需安装 Edge SSO 模块，请执行以下操作：

登录管理服务器节点。该节点应已已按照以下网址中的说明安装 apigee-service：安装 Edge apigee-setup 实用程序。
请注意，您可以在其他节点上安装 Edge SSO。但是，该节点必须能够通过端口 8080 访问管理服务器。
安装并配置 apigee-sso：
```
/opt/apigee/apigee-setup/bin/setup.sh -p sso -f configFile
```
其中，configFile 是上面显示的配置文件。
安装用于执行以下操作的 apigee-ssoadminapi.sh 实用程序：管理apigee-sso模块的管理员和机器用户：
```
/opt/apigee/apigee-service/bin/apigee-service apigee-ssoadminapi install
```
退出 shell，然后再次登录以添加 apigee-ssoadminapi.sh 实用性。

指定元数据文件（而非网址）

如果您的 IdP 不支持 HTTP/HTTPS 元数据网址，您可以使用元数据 XML 文件配置 Edge SSO：

将元数据 XML 的内容从 IDP 复制到 Edge SSO 节点上的文件中。对于请将 XML 复制到：
```
/opt/apigee/customer/application/apigee-sso/saml/metadata.xml
```
注意：该文件必须命名为 metadata.xml。

将文件的所有权更改为 apigee:apigee：

chown apigee:apigee /opt/apigee/customer/application/apigee-sso/saml/metadata.xml

将 SSO_SAML_IDP_METADATA_URL 的值设置为绝对文件路径：
```
SSO_SAML_IDP_METADATA_URL=file:///opt/apigee/customer/application/apigee-sso/saml/metadata.xml
```
您必须在文件路径前面加上“file://”前缀，后跟根 (/)。