本節說明如何取得、安裝及設定將 LDAP 服務整合至 Apigee Edge 以進行使用者驗證所需的元件。
必要條件
- 您必須有 Private Cloud 4.18.05 適用的 Apigee Edge 安裝作業。
- 您必須在 Apigee Edge for Private Cloud 上具備全域系統管理員憑證,才能執行這項安裝作業。
- 您必須知道 Apigee Edge 安裝私有雲的根目錄。預設的根目錄為
/opt
。 - 您必須將 Edge 全域系統管理員憑證新增至外部 LDAP。請注意,sysadmin 憑證預設會儲存在 Edge 內部 LDAP。切換至 external LDAP 後,系統會改為在該處驗證 sysadmin 憑證。因此,您必須先將憑證佈建至外部系統,然後才能在 Edge 中啟用外部驗證。
舉例來說,如果您已設定並安裝私有雲適用的 Apigee Edge,且全域系統管理員憑證為:
username: edgeuser@mydomain.com password: Secret123
接著,外部 LDAP 中也必須含有密碼為
Secret123
的使用者edgeuser@mydomain.com
。 - 如果您正在執行管理伺服器叢集,請務必為每個管理伺服器執行本文件中的所有步驟。
設定外部驗證
您將執行的主要活動是設定 management-server.properties
檔案。這個活動包括停止及啟動 Edge Management Server,以及決定要使用直接或間接繫結、加密機密憑證,以及其他相關工作。
- 重要事項:現在請決定要使用間接還是直接繫結驗證方法。這項決定會影響設定的某些部分。請參閱外部驗證。
- 重要事項:您必須在每個 Apigee Edge Management Server 上執行這些設定步驟 (如果您使用多個 Apigee),
- 在文字編輯器中開啟
/opt/apigee/customer/application/management-server.properties
。如果檔案不存在,請建立一個。 - 新增下列程式碼:
conf_security_authentication.user.store=externalized.authentication
這行程式碼會在 Edge 中新增外部驗證功能,以便安裝 Private Cloud。
- 為簡化這個步驟,我們建立了兩個註解清楚的範例設定,分別用於直接繫結驗證和間接繫結驗證。請參閱以下範例,瞭解要使用的繫結並完成設定:
- 重新啟動管理伺服器:
/opt/apigee/apigee-service/bin/apigee-service edge-management-server restart
- 確認伺服器是否正在運作:
/opt/apigee/apigee-service/bin/apigee-all status
- 重要事項:如果遇到以下情況 (或兩者皆有),您必須進行額外設定:
- 如果您打算讓使用者以非電子郵件地址的使用者名稱登入。在這種情況下,您的 sysadmin 使用者也必須透過使用者名稱進行驗證。
和/或
- 如果外部 LDAP 中的 sysadmin 使用者帳戶密碼與首次安裝適用於 Private Cloud 的 Apigee Edge 時設定的密碼不同。請參閱不同的 sysadmin 憑證需要進行設定。
- 如果您打算讓使用者以非電子郵件地址的使用者名稱登入。在這種情況下,您的 sysadmin 使用者也必須透過使用者名稱進行驗證。
直接繫結設定範例
## The first property is always required to enable the external authorization feature. ## Do not change it. conf_security_externalized.authentication.implementation.class=com.apigee.rbac.impl.LdapAuthenticatorImpl ## Identify the type of binding: ## Set to "true" for direct binding ## Set to "false" for indirect binding. conf_security_externalized.authentication.bind.direct.type=true ## The next seven properties are needed regardless of direct or indirect binding. You need to ## configure these per your external authentication installation. ## The IP or domain for your external LDAP instance. conf_security_externalized.authentication.server.url=ldap://localhost:389 ## Your external LDAP server version. conf_security_externalized.authentication.server.version=3 ## The server timeout in milliseconds. conf_security_externalized.authentication.server.conn.timeout=50000 ## Change these baseDN values to match your external LDAP service. This attribute value will be ## provided by your external LDAP administrator, and may have more or fewer dc elements depending ## on your setup. conf_security_externalized.authentication.user.store.baseDN=dc=apigee,dc=com ## Do not change this search string. It is used internally. conf_security_externalized.authentication.user.store.search.query=(&(${userAttribute}=${userId})) ## Identifies the external LDAP property you want to bind against for Authentication. For ## example if you are binding against an email address in Microsoft Active Directory, this would be ## the userPrincipalName property in your external LDAP instance. Alternatively if you are binding ## against the user's ID, this would typically be in the sAMAccountName property: conf_security_externalized.authentication.user.store.user.attribute=userPrincipalName ## The LDAP attribute where the user email value is stored. For direct binding with AD, set it to ## userPrincipalName. conf_security_externalized.authentication.user.store.user.email.attribute=userPrincipalName ## ONLY needed for DIRECT binding. ## The direct.bind.user.directDN property defines the string that is used for the bind against the ## external authentication service. Ensure it is set as follows: conf_security_externalized.authentication.direct.bind.user.directDN=${userDN}
「INDIRECT BINDING」設定範例
## Required to enable the external authorization feature. Do not change it. conf_security_externalized.authentication.implementation.class=com.apigee.rbac.impl.LdapAuthenticatorImpl ## Identifies the type of binding: ## Set to "true" for direct binding ## Set to "false" for indirect binding. conf_security_externalized.authentication.bind.direct.type=false ## The next seven properties are needed regardless of direct or indirect binding. You need to ## configure these per your external LDAP installation. ## The IP or domain for your external LDAP instance. conf_security_externalized.authentication.server.url=ldap://localhost:389 ## Replace with your external LDAP server version. conf_security_externalized.authentication.server.version=3 ## Set the server timeout in milliseconds. conf_security_externalized.authentication.server.conn.timeout=50000 ## Change these baseDN values to match your external LDAP service. This attribute value will be # provided by your external LDAP administrator, and may have more or fewer dc elements # depending on your setup. conf_security_externalized.authentication.user.store.baseDN=dc=apigee,dc=com ## Do not change this search string. It is used internally. conf_security_externalized.authentication.user.store.search.query=(&(${userAttribute}=${userId})) ## Identifies the external LDAP property you want to bind against for Authentication. For example ## if you are binding against an email address, this would typically be in the ## userPrincipalName property in your external LDAP instance. Alternatively if you are binding ## against the user's ID, this would typically be in the sAMAccountName property. ## See also "Configuration required for different sysadmin credentials". conf_security_externalized.authentication.user.store.user.attribute=userPrincipalName ## Used by Apigee to perform the Authorization step and currently, Apigee only supports email ## address for Authorization. Make sure to set it to the attribute in your external LDAP that ## stores the user's email address. Typically this will be in the userPrincipalName property. conf_security_externalized.authentication.user.store.user.email.attribute=userPrincipalName ## The external LDAP username (for a user with search privileges on the external LDAP) and ## password and whether the password is encrypted. You must also set the attribute ## externalized.authentication.bind.direct.type to false. ## The password attribute can be encrypted or in plain text. See ## "Indirect binding only: Encrypting the external LDAP user's password" ## for encryption instructions. Set the password.encrypted attribute to "true" if the password is ## encrypted. Set it to "false" if the password is in plain text. conf_security_externalized.authentication.indirect.bind.server.admin.dn=myExtLdapUsername conf_security_externalized.authentication.indirect.bind.server.admin.password=myExtLdapPassword conf_security_externalized.authentication.indirect.bind.server.admin.password.encrypted=true
測試安裝
- 確認伺服器是否正在運作:
/opt/apigee/apigee-service/bin/apigee-all status
- 執行這個指令,提供一組 Apigee Edge 全域系統管理員憑證。要測試的 API 呼叫只能由 Edge 系統管理員執行。
curl -v http://management-server-IP:8080/v1/o -u sysadmin_username
例如:
curl -v http://192.168.52.100:8080/v1/o -u jdoe@mydomain.com
- 在系統提示時輸入密碼。
如果指令傳回 200 狀態和機構清單,即代表設定正確。 這個指令會驗證對 Edge Management Server 發出的 API 呼叫是否已成功透過外部 LDAP 系統進行驗證。