Hi I'm trying to integrate Active Directory as the external identity provider.
As per the documentation,
https://docs.apigee.com/private-cloud/v4.51.00/enabling-external-authentication#configuringexternala...
We need to create (and/or update)
/opt/apigee/customer/application/management-server.properties
and add the following
conf_security_authentication.user.store=externalized.authentication
## Required to enable the external authorization feature. Do not change it.
conf_security_externalized.authentication.implementation.class=com.apigee.rbac.impl.LdapAuthenticatorImpl
## Identifies the type of binding:
## Set to "true" for direct binding
## Set to "false" for indirect binding.
conf_security_externalized.authentication.bind.direct.type=false
## The next seven properties are needed regardless of direct or indirect binding. You need to
## configure these per your external LDAP installation.
## The IP or domain for your external LDAP instance.
conf_security_externalized.authentication.server.url=ldap://localhost:389
## Replace with your external LDAP server version.
conf_security_externalized.authentication.server.version=3
## Set the server timeout in milliseconds.
conf_security_externalized.authentication.server.conn.timeout=50000
## Change these baseDN values to match your external LDAP service. This attribute value will be
# provided by your external LDAP administrator, and may have more or fewer dc elements
# depending on your setup.
conf_security_externalized.authentication.user.store.baseDN=dc=apigee,dc=com
## Do not change this search string. It is used internally.
conf_security_externalized.authentication.user.store.search.query=(&(${userAttribute}=${userId}))
## Identifies the external LDAP property you want to bind against for Authentication. For example
## if you are binding against an email address, this would typically be in the
## userPrincipalName property in your external LDAP instance. Alternatively if you are binding
## against the user's ID, this would typically be in the sAMAccountName property.
## See also "Configuration required for different sysadmin credentials".
conf_security_externalized.authentication.user.store.user.attribute=userPrincipalName
## Used by Apigee to perform the Authorization step and currently, Apigee only supports email
## address for Authorization. Make sure to set it to the attribute in your external LDAP that
## stores the user's email address. Typically this will be in the userPrincipalName property.
conf_security_externalized.authentication.user.store.user.email.attribute=userPrincipalName
## The external LDAP username (for a user with search privileges on the external LDAP) and
## password and whether the password is encrypted. You must also set the attribute
## externalized.authentication.bind.direct.type to false.
## The password attribute can be encrypted or in plain text. See
## "Indirect binding only: Encrypting the external LDAP user's password"
## for encryption instructions. Set the password.encrypted attribute to "true" if the password is
## encrypted. Set it to "false" if the password is in plain text.
conf_security_externalized.authentication.indirect.bind.server.admin.dn=myExtLdapUsername
conf_security_externalized.authentication.indirect.bind.server.admin.password=myExtLdapPassword
conf_security_externalized.authentication.indirect.bind.server.admin.password.encrypted=true
I guess my question is when do we do this? during the initial install? if so how does the following lines, in the config file do? for example,
/opt/apigee/apigee-setup/bin/setup.sh -p ms -f apigee.cfg
USE_LDAP_REMOTE_HOST=y
LDAP_HOST=adserver.lab.local
LDAP_PORT=389
APIGEE_LDAPPW=AdminPwd!
So, I'm little confused, at what point do we integrate Apigee and AD, is it during the Apigee cluster install process? or
after we install with the following settings,
USE_LDAP_REMOTE_HOST=n
LDAP_TYPE=1
APIGEE_LDAPPW=Passw0rd!
and then we configure AD integration as per
https://docs.apigee.com/private-cloud/v4.51.00/enabling-external-authentication#configuringexternala...
Any guidance would be great. Also,
https://www.googlecloudcommunity.com/gc/Apigee/Apigee-Edge-Integration-with-Active-Directory-for-Ext...
suggests "Apigee Edge Private Cloud External Auth" document that is provided by Apigee, just wondering whether this is a public document? if not, what is the process of obtaining the doc?
LinkedIn
Twitter
