安装和配置 Apigee SSO

如需使用外部 IDP 安装和配置 Apigee SSO 模块，您必须执行以下操作：

  1. 创建密钥和证书。
  2. 设置基本 Apigee SSO 配置：基础文件必须包含所有 SSO 配置通用的属性。
  3. 添加 IDP 专用配置属性：在配置文件中使用以下某个 IDP 专用配置属性块：
  4. 安装 Apigee SSO：安装 Apigee SSO 模块，并将配置文件传递给安装程序。

后续几个部分将介绍其中每个步骤。

创建密钥和证书

本部分介绍如何创建可能适合您测试环境的自签名证书，但在生产环境中应使用由证书授权机构 (CA) 签名的证书。

如需创建用于签名以进行验证的密钥对，请执行以下操作：

  1. 以 sudo 用户身份创建以下新目录： 
    sudo mkdir -p /opt/apigee/customer/application/apigee-sso/jwt-keys
  2. 切换到新目录： 
    cd /opt/apigee/customer/application/apigee-sso/jwt-keys/
  3. 使用以下命令生成私钥： 
    sudo openssl genrsa -out privkey.pem 2048
  4. 使用以下命令根据私钥生成公钥： 
    sudo openssl rsa -pubout -in privkey.pem -out pubkey.pem
  5. 将输出 PEM 文件的所有者更改为“apigee”用户： 
    sudo chown apigee:apigee *.pem

如需创建无口令用于与 IDP 通信的密钥和自签名证书，请执行以下操作：

  1. 以 sudo 用户的身份创建一个新目录： 
    sudo mkdir -p /opt/apigee/customer/application/apigee-sso/idp/
  2. 切换到新目录： 
    cd /opt/apigee/customer/application/apigee-sso/idp/
  3. 使用口令生成私钥： 
    sudo openssl genrsa -aes256 -out server.key 1024
  4. 从密钥中移除口令： 
    sudo openssl rsa -in server.key -out server.key
  5. 为 CA 生成证书签名请求： 
    sudo openssl req -x509 -sha256 -new -key server.key -out server.csr
  6. 生成有效期为 365 天的自签名证书： 
    sudo openssl x509 -sha256 -days 365 -in server.csr -signkey server.key -out selfsigned.crt
  7. 将密钥和 crt 文件的所有者更改为“apigee”所有者： 
    sudo chown apigee:apigee server.key
sudo chown apigee:apigee selfsigned.crt

如需在 Apigee SSO 模块上启用 TLS，请将 SSO_TOMCAT_PROFILE 设置为 SSL_TERMINATION 或 SSL_PROXY，但不能使用自签名证书。您必须通过 CA 生成证书。如需了解详情，请参阅配置 Apigee SSO 以实现 HTTPS 访问。

Apigee SSO 配置设置

您必须先定义配置文件，然后才能安装 Apigee SSO 模块。在安装 Apigee SSO 模块时，您需要将此配置文件传递给安装程序。

配置文件的格式如下：

IP1=hostname_or_IP_of_apigee_SSO
IP2=hostname_or_IP_of_apigee_SSO

## Management Server configuration.
# Management Server IP address and port
MSIP=$IP1
MGMT_PORT=8080
# Edge sys admin username and password as set when you installed Edge.
ADMIN_EMAIL=opdk@google.com
APIGEE_ADMINPW=Secret123
# Set the protocol for the Edge management API. Default is http.
# Set to https if you enabled TLS on the management API.
MS_SCHEME=http

## Postgres configuration.
# Postgres IP address and port
PG_HOST=$IP1
PG_PORT=5432
# Postgres username and password as set when you installed Edge.
PG_USER=apigee
PG_PWD=postgres

## Apigee SSO module configuration.
# Choose either "saml" or "ldap".
SSO_PROFILE="[saml|ldap]"
# Externally accessible IP or DNS name of apigee-sso.
SSO_PUBLIC_URL_HOSTNAME=$IP2
SSO_PG_DB_NAME=database_name_for_sso

# Default port is 9099. If changing, set both properties to the same value.
SSO_PUBLIC_URL_PORT=9099
SSO_TOMCAT_PORT=9099
# Set Tomcat TLS mode to DEFAULT to use HTTP access to apigee-sso.
SSO_TOMCAT_PROFILE=DEFAULT
SSO_PUBLIC_URL_SCHEME=http

# SSO admin user name. The default is ssoadmin.
SSO_ADMIN_NAME=ssoadmin
# SSO admin password using uppercase, lowercase, number, and special chars.
SSO_ADMIN_SECRET=Secret123

# Enable the ability to sign an authentication request with SAML SSO.
SSO_SAML_SIGN_REQUEST=y

# Path to signing key and secret from Create the TLS keys and certificates above.
SSO_JWT_SIGNING_KEY_FILEPATH=/opt/apigee/customer/application/apigee-sso/jwt-keys/privkey.pem
SSO_JWT_VERIFICATION_KEY_FILEPATH=/opt/apigee/customer/application/apigee-sso/jwt-keys/pubkey.pem

###########################################################
#                 Define External IDP                     #
# Use one of the following configuration blocks to        #
# define your IDP settings:                               #
#  - SAML configuration properties                     #
#  - LDAP Direct Binding configuration properties        #
#  - LDAP Indirect Binding configuration properties       #
###########################################################

INSERT_IDP_CONFIG_BLOCK_HERE (SAML, LDAP direct, or LDAP indirect, below)

# Configure an SMTP server so that the Apigee SSO module can send emails to users
SKIP_SMTP=n
SMTPHOST=smtp.example.com
SMTPUSER=smtp@example.com
# omit for no username
SMTPPASSWORD=smtppwd
# omit for no password
SMTPSSL=n
SMTPPORT=25
# The address from which emails are sent
SMTPMAILFROM="My Company <myco@company.com>"

SAML SSO 配置属性

如果您为 IDP 使用 SAML，请在配置文件（如上所定义）中使用以下配置属性块：

## SAML Configuration Properties
# Insert this section into your base configuration file, as described previously.

# Name of SAML IDP. For example, okta or adfs.
SSO_SAML_IDP_NAME=okta
# Text displayed on the SSO sign-in page after being redirected by either the New or Classic Edge UI for SAML logins.
# Note: Installing SSO does not depend on the Edge UI or which version of the UI you are using.
SSO_SAML_IDP_LOGIN_TEXT="Please log in to your IDP"

# The metadata URL from your IDP.
# If you have a metadata file, and not a URL,
# see "Specifying a metadata file instead of a URL" below.
SSO_SAML_IDP_METADATA_URL=https://dev-343434.oktapreview.com/app/exkar20cl/sso/saml/metadata

# Determines whether to skip TLS validation for the URL specified
# by SSO_SAML_IDP_METADATA_URL.
# This is necessary if the URL uses a self-signed certificate.
# The default value is "n".
SSO_SAML_IDPMETAURL_SKIPSSLVALIDATION=n

# SAML service provider key and cert from Create the TLS keys and certificates above.
SSO_SAML_SERVICE_PROVIDER_KEY=/opt/apigee/customer/application/apigee-sso/saml/server.key
SSO_SAML_SERVICE_PROVIDER_CERTIFICATE=/opt/apigee/customer/application/apigee-sso/saml/selfsigned.crt

# The passphrase used when you created the SAML cert and key.
# The section "Create the TLS keys and certificates" above removes the passphrase,
# but this property is available if you require a passphrase.
# SSO_SAML_SERVICE_PROVIDER_PASSWORD=samlSP123

# Requires that SAML responses be signed by your IDP.
# This property is enabled by default since release 4.50.00.05.
SSO_SAML_SIGNED_ASSERTIONS=y

LDAP 直接绑定配置属性

如果您要为 IDP 使用 LDAP 直接绑定，请在配置文件中使用以下配置属性块，如上例所示： 

## LDAP Direct Binding configuration
# Insert this section into your base configuration file, as described previously.

# The type of LDAP profile; in this case, "direct"
SSO_LDAP_PROFILE=direct

# The base URL to which SSO connects; in the form: "ldap://hostname_or_IP:port
SSO_LDAP_BASE_URL=LDAP_base_URL

# Attribute name used by the LDAP server to refer to the user's email address; for example, "mail"
SSO_LDAP_MAIL_ATTRIBUTE=LDAP_email_attribute

# Pattern of the user's DN; for example: =cn={0},ou=people,dc=example,dc=org
# If there is more than one pattern, separate with semicolons (";"); for example:
# =cn={0},ou=people,dc=example,dc=org;=cn={0},ou=people,dc=example,dc=com
SSO_LDAP_USER_DN_PATTERN=LDAP_DN_pattern

LDAP 间接绑定配置属性

如果您为 IdP 使用 LDAP 间接绑定，请在配置文件中使用以下配置属性块，如上例所示： 

## LDAP Indirect Binding configuration
# Insert this section into your base configuration file, as described previously.

# Type of LDAP profile; in this case, "indirect"
SSO_LDAP_PROFILE=indirect

# Base URL to which SSO connects; in the form: "ldap://hostname_or_IP:port
SSO_LDAP_BASE_URL=LDAP_base_URL

# DN and password of the LDAP server's admin user
SSO_LDAP_ADMIN_USER_DN=LDAP_admin_DN
SSO_LDAP_ADMIN_PWD=LDAP_admin_password

# LDAP search base; for example, "dc=example,dc=org"
SSO_LDAP_SEARCH_BASE=LDAP_search_base

# LDAP search filter; for example, "cn={0}"
SSO_LDAP_SEARCH_FILTER=LDAP_search_filter
# LDAP 服务器用于引用用户电子邮件地址的属性名称；例如“mail” SSO_LDAP_MAIL_ATTRIBUTE=LDAP_email_attribute

安装 Apigee SSO 模块

创建密钥并设置配置文件后，您可以安装 Apigee SSO 模块。

如需安装 Apigee SSO 模块，请执行以下操作：

  1. 登录管理服务器节点。该节点应已安装 apigee-service，如安装 Edge apigee-setup 实用程序中所述。

    或者，您也可以在其他节点上安装 Apigee SSO 模块。不过，该节点必须能够通过端口 8080 访问管理服务器。

  2. 通过执行以下命令安装和配置 apigee-sso： 
    /opt/apigee/apigee-setup/bin/setup.sh -p sso -f configFile

    其中 configFile 是您在上面定义的配置文件。

  3. 安装用于管理 apigee-sso 模块的管理员用户和机器用户的 apigee-ssoadminapi.sh 实用程序： 
    /opt/apigee/apigee-service/bin/apigee-service apigee-ssoadminapi install
  4. 退出 shell，然后重新登录，将 apigee-ssoadminapi.sh 实用程序添加到您的路径中。

指定元数据文件，而不是网址

如果您的 IDP 不支持 HTTP/HTTPS 元数据网址，您可以使用元数据 XML 文件配置 Apigee SSO。

如需使用元数据文件（而非网址）配置 Apigee SSO，请执行以下操作：

  1. 将元数据 XML 的内容从 IDP 复制到 Apigee SSO 节点上的文件。例如，将 XML 复制到： 
    /opt/apigee/customer/application/apigee-sso/saml/metadata.xml
  2. 将 XML 文件的所有权更改为“apigee”用户： 
    chown apigee:apigee /opt/apigee/customer/application/apigee-sso/saml/metadata.xml
  3. 将 SSO_SAML_IDP_METADATA_URL 的值设置为绝对文件路径： 
    SSO_SAML_IDP_METADATA_URL=file:///opt/apigee/customer/application/apigee-sso/saml/metadata.xml

    您必须在文件路径前面添加“file://”，后跟根目录 (/) 的绝对路径。