The New Edge UI and Edge management API operate by making requests to the Edge Management Server, where the Management Server supports the following types of authentication:
- Basic authentication: Log in to the New Edge UI or make requests to the Edge management API by passing your username and password.
- OAuth2 / OIDC: Exchange your Edge Basic Auth credentials for an OAuth2 access token and refresh token. Make calls to the Edge management API by passing the OAuth2 access token in the Bearer header of an API call.
Edge supports using the following external Identity Providers (IDPs) for authentication:
- Security Assertion Markup Language (SAML) 2.0: Generate OAuth access tokens from SAML assertions returned by a SAML identity provider.
- Lightweight Directory Access Protocol (LDAP): Use LDAP's search and bind authentication methods to generate OAuth access tokens.
Both SAML and LDAP IDPs support a single sign-on (SSO) environment. By using an external IDP with Edge, you can support SSO for the New Edge UI and API in addition to any other services that you provide and that also support your external IDP.
About new Apigee SSO structure
Starting in Edge for Private Cloud 4.54.00, the legacy apigee-sso component has been replaced by a modernized, lightweight OpenID Connect (OIDC) identity broker called Dex. This SSO adapter is integrated directly into the apigee-openldap component lifecycle, removing the need to install a separate apigee-sso module.
Because the Apigee SSO (Dex broker) is bundled with apigee-openldap, it is deployed on the same nodes as your OpenLDAP instances. Lifecycle management is handled natively via OPDK actions such as apigee-service apigee-openldap start_sso and stop_sso.
Port 9099 must be open on the apigee-openldap node to support access to the Apigee SSO from a browser,
from the external SAML or LDAP IDP, and from the Management Server and New Edge UI. As part of configuring
the Apigee SSO, you can specify whether the external connection uses HTTP or the encrypted HTTPS
protocol.
The Apigee SSO is a stateless service that uses a Postgres database (apigee_dex) accessible on port 5432 on the Postgres node to persist OAuth2 state across multiple nodes, ensuring High Availability. Typically, you
can use the same Postgres server that you installed with Edge, either a standalone Postgres
server or two Postgres servers configured in master/standby mode. If the load on your Postgres
server is high, you can also choose to create a separate Postgres node just for the SSO database.
Support for standard OpenID Connect (OIDC)
The Edge implementation of SAML and LDAP relies on standard OpenID Connect (OIDC) and OAuth2 access tokens.
The modernized Apigee SSO issues strictly OIDC-compliant tokens (utilizing standard claims like email and sub, as well as opaque refresh tokens). For more information, see
Introduction to OAuth 2.0.
About SAML
SAML authentication offers several advantages. By using SAML you can:
- Take full control of user management. When users leave your organization and are deprovisioned centrally, they are automatically denied access to Edge.
- Control how users authenticate to access Edge. You can choose different authentication types for different Edge organizations.
- Control authentication policies. Your SAML provider may support authentication policies that are more in line with your enterprise standards.
- You can monitor logins, logouts, unsuccessful login attempts and high-risk activities on your Edge deployment.
With SAML enabled, access to the New Edge UI and Edge management API uses OAuth2 access tokens. These tokens are generated by the Apigee SSO which accepts SAML assertions returned by your IDP.
About LDAP
The Lightweight Directory Access Protocol (LDAP) is an open, industry-standard application protocol for accessing and maintaining distributed directory information services. Directory services may provide any organized set of records, often with a hierarchical structure, such as a corporate email directory.
LDAP authentication within the new Apigee SSO uses its built-in LDAP connector. The connector performs LDAP searches for organizationalRole and standard attributes (such as mail and uid) to natively map Apigee legacy users to standard OIDC claims.
LDAP with Edge for the Private Cloud supports standard Search and Bind authentication methods against an LDAP-compatible server.
The Apigee SSO retrieves the user's email address and standard OIDC claims
(for example, email, preferred_username, and groups)
and updates the internal user record
so that there is a current email address on file, as Edge uses this email for authorization
purposes.
New Edge UI and API URLs
The URL that you use to access the New Edge UI and Edge management API is the same as used before you enabled SAML or LDAP. For the New Edge UI:
http://edge_UI_IP_DNS:3001
Where edge_UI_IP_DNS is the IP address or DNS name of the machine hosting the New Edge UI. As part of configuring the New Edge UI, you can specify that the connection use HTTP or the encrypted HTTPS protocol.
For the Edge management API:
http://ms_IP_DNS:8080/v1
Where ms_IP_DNS is the IP address or DNS name of the Management Server. As part of configuring the API, you can specify that the connection use HTTP or the encrypted HTTPS protocol.
Configure TLS with New Apigee SSO
By default, the connection to the Apigee SSO uses HTTP over port 9099 on the node hosting
apigee-openldap. The lightweight Go-based identity broker natively handles HTTP and HTTPS requests.
The Apigee SSO supports three connection modes:
- DEFAULT: The default configuration supports HTTP requests on port 9099.
- SSL_TERMINATION: Enables TLS access to the Apigee SSO on the port of your choice. You must specify a TLS key and cert for this mode.
- SSL_PROXY: Configures the Apigee SSO in proxy mode, meaning you installed a load balancer in front of the component and terminated TLS on the load balancer. You can specify the port used on the Apigee SSO for requests from the load balancer.