Install and configure Apigee SSO

Starting with OPDK 4.54.00, the SSO architecture has been modernized. The identity broker (Dex) is now embedded directly within the apigee-openldap component, eliminating the need to install a separate legacy apigee-sso module.

To enable and configure Apigee SSO, you must do the following:

Create a machine user for the New Edge UI: Create a machine user required for the New Edge UI to invoke management APIs.
Configure properties in the common config file: Create a single configuration file that contains the properties required by both the OpenLDAP (SSO) service and the New Edge UI.
Create SSO database in Postgres: Create a database for SSO in the Apigee PostgreSQL instance.
Apply SSO configurations in OpenLDAP: Apply the configuration file to start the integrated Apigee SSO on the OpenLDAP node.
Configure the New Edge UI: Update the New Edge UI properties to use the new Apigee SSO.

Each of these steps is described in the sections that follow.

Create machine user for UI

New Edge UI requires a machine user for invoking management APIs in the backend for certain operations. A script pre-installed in the apigee-openldap node is used for this purpose.

Read more about the script and machine users in Using the apigee-machine-user script.

Use the following command in the apigee-openldap node to create a machine user for the New Edge UI, and make sure to use the exact same credentials when defining the property in the config file in the subsequent step.

 /opt/apigee/apigee-openldap/bin/apigee-machineuser.sh add -u ui-machine-user@apigee.com -p Secret123

Configure properties in the common config file

Before you can enable the Apigee SSO and New Edge UI, you must define a common configuration file (for example, /opt/silent.conf). You can change this path and filename as required for your environment.

Add the following base configuration properties to your /opt/silent.conf:

# ==========================================
# SSO Enablement
# ==========================================
ENABLE_SSO=y

# ==========================================
# SSO Hostname/IP and Port config for Dex
# ==========================================
SSO_PUBLIC_URL_SCHEME=http
SSO_PUBLIC_URL_HOSTNAME=localhost
SSO_PUBLIC_URL_PORT=9099

# ==========================================
# Static Client UI credentials
# ==========================================
MANAGEMENT_UI_SSO_CLIENT_ID=unifiedui
MANAGEMENT_UI_SSO_CLIENT_SECRET=secret123

# ==========================================
# Management UI & SSO redirect URLs
# ==========================================
MANAGEMENT_UI_SCHEME=http
MANAGEMENT_UI_IP=localhost
MANAGEMENT_UI_PORT=3001

# ==========================================
# Management Server parameters (Required for SSO registration)
# ==========================================
MSIP=localhost
ADMIN_EMAIL=admin@apigee.com
APIGEE_ADMINPW=Secret123

# ==========================================
# Machine user for UI
# ==========================================
UI_MACHINE_USER=ui-machine-user@apigee.com
UI_MACHINE_PWD=Secret123

# ==========================================
# Postgres connection parameters
# ==========================================
PG_HOST=postgres_host
PG_USER=apigee
PG_PWD=postgres_password

# ==========================================
# Other UI Parameters
# ==========================================
# Set to sso to enable SSO, default value is basic.
AUTH_MODE=sso

# Y to use internal LDAP for authentication, N to use external IDP
SSO_LOCAL_LDAP=y

MANAGEMENT_UI_APP_ENV=OPDK
MANAGEMENT_UI_SSO_ENABLED=y
MANAGEMENT_UI_SSO_CSRF_SECRET=secret
MANAGEMENT_UI_SSO_CSRF_EXPIRATION_HOURS=24
MANAGEMENT_UI_SSO_STRICT_TRANSPORT_SECURITY_AGE_HOURS=24
MANAGEMENT_UI_SSO_PUBLIC_KEY_CACHE_HOURS=0.5

Note: The modernized SSO architecture relies on a declarative configuration (GitOps) model. Unlike the legacy UAA system, OAuth clients cannot be generated dynamically at runtime using admin scripts. The client configuration for the Edge UI is defined in /opt/silent.conf. Whereas the client used for machine users is implicitly configured in Apigee SSO.

SSO properties distribution

Apigee SSO properties are distributed across the following configuration files:

/opt/silent.conf (or your custom configuration file): Contains the base configuration properties for SSO and New Edge UI.
/opt/apigee/customer/application/openldap.properties: Contains additional SSO configuration properties for optional features such as SAML and HTTPS.

The setup-sso script in the apigee-openldap component parses the variables from both of the above files. Depending on your use case you need to configure the relevant properties in the config files.

The following steps are optional depending on your environment:

Create SSO database in Postgres

On the node where apigee-postgresql is running (master node in primary-standby setup), create a database for SSO:

/opt/apigee/apigee-service/bin/apigee-service apigee-postgresql setup-sso-db

Apply SSO configurations in OpenLDAP

Because the Apigee SSO is embedded in the directory component, you do not need to install a standalone package. You simply apply the configuration file to the OpenLDAP node.

To enable and start Apigee SSO:

Log in to the node hosting apigee-openldap.
Execute the setup-sso command, passing your configuration file:
```
/opt/apigee/apigee-service/bin/apigee-service apigee-openldap setup-sso -f /opt/silent.conf
```
Note: The setup-sso script automatically parses the variables, applies the configuration, and starts the embedded Apigee SSO. You can stop the Apigee SSO at any time without affecting your core OpenLDAP directory by running apigee-service apigee-openldap stop_sso.

Configure the New Edge UI

Once the Apigee SSO is running, you must configure the New Edge UI to communicate with it.

After you enable an external IDP on the New Edge UI, the New Edge UI uses OIDC/OAuth2 to connect to the Management Server. You do not have to worry about expiring tokens between the New Edge UI and the Edge Management Server. Expired tokens are automatically refreshed.

Log in to the node hosting the New Edge UI.
Ensure your /opt/silent.conf file is available on this node.

Apply the configuration using the setup script:

/opt/apigee/apigee-service/bin/apigee-service edge-management-ui setup -f /opt/silent.conf