Configure your LDAP IDP

With the modernization of the Apigee SSO tier in version 4.54.00, the underlying identity broker natively requires indirect binding (search and bind) and no longer supports direct (simple) binding. To maintain least-privilege security standards, Apigee SSO now standardizes on using a dedicated, read-only service account for directory searches.

This section describes the mechanisms with which you can use LDAP as an IDP with Apigee Edge for Private Cloud.

Authentication mechanism: search and bind (indirect binding)

With search and bind, the user supplies an RDN (such as a username or email address) and their password. Apigee SSO then finds the user's distinguished name (DN) and attempts to bind. Search and bind allows for partial matches.

The following shows the steps in a search and bind operation:

The user inputs an identifier, such as a username or email address, plus their password.
Apigee SSO performs a search using an LDAP filter and a set of read-only service account credentials.
If there is exactly one match, Apigee SSO retrieves the user's DN. If there are zero or more than one matches, Apigee SSO rejects the user.
Apigee SSO then attempts to bind the user's DN and supplied password against the LDAP server.
The LDAP server performs the authentication.
If successful, Apigee SSO returns an OIDC/OAuth2 token that the client can attach to their requests to the Edge services.

Internal OpenLDAP (default configuration)

If you are using the embedded Apigee OpenLDAP (where the LDAP host is set to localhost), the installation process automatically secures the configuration. During setup, the system auto-provisions a least-privilege service account (cn=sso-reader) with a randomly generated secret and restricted read-only access.

The OpenLDAP root admin credentials (cn=manager) are eliminated from the Apigee SSO configuration files to prevent the exposure of high-privilege credentials on disk.

If you are using internal OpenLDAP, proceed to Install and configure Apigee SSO.

External corporate LDAP

If you are connecting Apigee SSO to an external LDAP directory, such as a corporate Active Directory, you must provide a pre-provisioned read-only service account in your directory prior to configuration. Apigee SSO will use this account strictly for search and bind operations.

Security Warning: Do not configure privileged administrative accounts (such as Domain Admins) for the bind DN. Storing domain administrator credentials in configuration files violates least-privilege security standards. During setup, if the system detects high-privilege identifiers (such as cn=admin or ou=domain admins) in the bind DN, it will emit a security warning.

External LDAP configuration properties

To configure an external LDAP directory, provide your read-only service account details in your configuration file. The setup-sso script will automatically handle injecting the necessary tokens into the configuration.

Add the following properties to your config file for example /opt/silent.conf:

ENABLE_SSO=y
SSO_EXTERNAL_LDAP=y
SSO_LDAP_HOST=corp-ad.company.com
SSO_LDAP_PORT=636

# Set to false for secure connection
SSO_LDAP_INSECURE_SKIP_VERIFY=false

# The DN and password of your pre-provisioned read-only service account
SSO_LDAP_BIND_DN="cn=svc-apigee,ou=ServiceAccounts,dc=corp,dc=com"
SSO_LDAP_BIND_PW="password"

# The base DN for user searches
SSO_LDAP_USER_BASE_DN="ou=Employees,dc=corp,dc=com"

# The filter used to search for the user
SSO_LDAP_USER_FILTER="(&(objectClass=user)(objectCategory=person))"

# The attribute containing the user's email address
SSO_LDAP_USER_EMAIL_ATTR="mail"

# (Optional) The attribute containing the user's ID
# SSO_LDAP_USER_ID_ATTR="sAMAccountName"

# (Optional) The attribute containing the user's display name
# SSO_LDAP_USER_NAME_ATTR="displayName"

After defining these properties, proceed to Install and configure Apigee SSO.