The Apigee SSO supports two types of authentication profiles that were formerly managed by the legacy apigee-ssoadminapi.sh script:
The apigee-machineuser.sh utility lets you manage headless machine user accounts directly in OpenLDAP.
About OAuth clients (formerly Administrators)
In previous versions of Edge, you used the admin commands in the apigee-ssoadminapi.sh utility to dynamically create OAuth clients in the UAA database. In 4.54.00, the Apigee SSO relies on a declarative configuration (GitOps) model.
You no longer use a CLI script to create OAuth clients as they are static now. The client configuration for the Edge UI is defined in /opt/silent.conf. Whereas the client used for machine users (edgecli) is implicitly configured in Apigee SSO.
About machine users
A machine user can obtain OIDC/OAuth2 tokens via a standard password grant without requiring a browser or interactive MFA. This means you can completely automate the process of obtaining and refreshing tokens for your CI/CD pipelines and scripts.
When you create a machine user with the apigee-machineuser.sh utility, the account is created directly in the local OpenLDAP directory and is explicitly tagged with employeeType: machineuser. This tag allows the Apigee SSO to securely authenticate the machine user via a password grant, even when federated SAML/OIDC is strictly enforced for human users.
Invoke the apigee-machineuser.sh utility
The apigee-machineuser.sh utility is automatically installed on the node hosting the apigee-openldap component at the following path:
/opt/apigee/apigee-openldap/bin/apigee-machineuser.sh
The available commands for the utility are:
add: Creates a new machine user in OpenLDAP.list: Lists all machine users registered in OpenLDAP.setpassword: Updates the password for an existing machine user.delete: Permanently removes the machine user from OpenLDAP.
Add a machine user
Use the add command with the -u and -p flags to create a new machine user.
/opt/apigee/apigee-openldap/bin/apigee-machineuser.sh add -u jenkins-bot@apigee.com -p BotSecret123!
Output:
Machine user 'jenkins-bot@apigee.com' created successfully in OpenLDAP.
List all machine users
Use the list command to view all machine users currently registered in OpenLDAP. Human users are filtered out of this list.
/opt/apigee/apigee-openldap/bin/apigee-machineuser.sh list
Output:
Listing all machine users in OpenLDAP: dn: uid=jenkins-bot@apigee.com,ou=users,ou=global,dc=apigee,dc=com uid: jenkins-bot@apigee.com mail: jenkins-bot@apigee.com
Reset a machine user's password
Use the setpassword command to update the password for an existing machine user.
/opt/apigee/apigee-openldap/bin/apigee-machineuser.sh setpassword -u jenkins-bot@apigee.com -p NewSecret456!
Output:
Password for machine user 'jenkins-bot@apigee.com' updated successfully.
Delete a machine user
Use the delete command to permanently remove a machine user from OpenLDAP.
/opt/apigee/apigee-openldap/bin/apigee-machineuser.sh delete -u jenkins-bot@apigee.com
Output:
Machine user 'jenkins-bot@apigee.com' deleted successfully from OpenLDAP.