简体中文版经机器翻译而成，仅供参考。如与英语版出现任何冲突，应以英语版为准。

将Astra配置为使用LDAP服务器

03/07/2024 贡献者

PDF

您需要选择LDAP服务器并将Astra配置为使用该服务器作为身份验证提供程序。配置任务包括以下步骤。每个步骤都包括一个REST API调用。

1.添加CA证书

执行以下REST API调用、将CA证书添加到Astra。

此步骤是可选的、只有当您希望Astra和LDAP通过使用LDAPS的安全通道进行通信时、才需要执行此步骤。

HTTP 方法	路径
发布	/accouns/｛account_id｝/core/v1/certificates

JSON 输入示例

{
  "type": "application/astra-certificate",
  "version": "1.0",
  "certUse": "rootCA",
  "cert": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMyVEN",
  "isSelfSigned": "true"
}

有关输入参数、请注意以下事项：

cert 是一个JSON字符串、其中包含base64编码的PKCS-11格式证书(PEM编码)。
isSelfSigned 应设置为 true 证书是自签名的。默认值为 false。

curl 示例

curl --location -i --request POST --data @JSONinput 'https://astra.example.com/accounts/<ACCOUNT_ID>/core/v1/certificates' --header 'Content-Type: application/astra-certificate+json' --header 'Accept: */*' --header 'Authorization: Bearer <API_TOKEN>'

JSON响应示例

{
  "type": "application/astra-certificate",
  "version": "1.0",
  "id": "a5212e7e-402b-4cff-bba0-63f3c6505199",
  "certUse": "rootCA",
  "cert": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMyVEN",
  "cn": "adldap.example.com",
  "expiryTimestamp": "2023-07-08T20:22:07Z",
  "isSelfSigned": "true",
  "trustState": "trusted",
  "trustStateTransitions": [
  {
    "from": "untrusted",
    "to": [
      "trusted",
      "expired"
    ]
  },
  {
    "from": "trusted",
    "to": [
      "untrusted",
      "expired"
    ]
  },
  {
    "from": "expired",
    "to": [
     "untrusted",
     "trusted"
    ]
  }
  ],
  "trustStateDesired": "trusted",
  "trustStateDetails": [],
  "metadata": {
    "creationTimestamp": "2022-07-21T04:16:06Z",
    "modificationTimestamp": "2022-07-21T04:16:06Z",
    "createdBy": "8a02d2b8-a69d-4064-827f-36851b3e1e6e",
    "modifiedBy": "8a02d2b8-a69d-4064-827f-36851b3e1e6e",
    "labels": []
    }
}

2.添加绑定凭据

执行以下REST API调用以添加绑定凭据。

HTTP 方法	路径
发布	/accouns/｛account_id｝/core/v1/credentials

JSON 输入示例

{
  "name": "ldapBindCredential",
  "type": "application/astra-credential",
  "version": "1.1",
  "keyStore": {
    "bindDn": "dWlkPWFkbWluLG91PXN5c3RlbQ==",
    "password": "cGFzc3dvcmQ="
  }
}

有关输入参数、请注意以下事项：

bindDn 和 password 是LDAP管理员用户的base64编码绑定凭据、可以连接和搜索LDAP目录。 bindDn 是LDAP用户的电子邮件地址。

curl 示例

curl --location -i --request POST --data @JSONinput 'https://astra.example.com/accounts/<ACCOUNT_ID>/core/v1/credentials' --header 'Content-Type: application/astra-credential+json' --header 'Accept: */*' --header 'Authorization: Bearer <API_TOKEN>'

JSON响应示例

{
    "type": "application/astra-credential",
    "version": "1.1",
    "id": "3bd9c8a7-f5a4-4c44-b778-90a85fc7d154",
    "name": "ldapBindCredential",
    "metadata": {
        "creationTimestamp": "2022-07-21T06:53:11Z",
        "modificationTimestamp": "2022-07-21T06:53:11Z",
        "createdBy": "527329f2-662c-41c0-ada9-2f428f14c137"
    }
}

请注意以下响应参数：

。 id 的凭据将在后续工作流步骤中使用。

3.检索LDAP设置的UUID

执行以下REST API调用以检索的UUID astra.account.ldap Astra控制中心附带的设置。

以下cURL示例使用查询参数筛选设置收集。您可以改为删除筛选器以获取所有设置、然后搜索 astra.account.ldap。

HTTP 方法	路径
获取	/accouns/｛account_id｝/core/v1/settings

curl 示例

curl --location -i --request GET 'https://astra.example.com/accounts/<ACCOUNT_ID>/core/v1/settings?filter=name%20eq%20'astra.account.ldap'&include=name,id' --header 'Accept: */*' --header 'Authorization: Bearer <API_TOKEN>'

JSON响应示例

{
  "items": [
    ["astra.account.ldap",
    "12072b56-e939-45ec-974d-2dd83b7815df"
    ]
  ],
  "metadata": {}
}

4.更新LDAP设置

执行以下REST API调用以更新LDAP设置并完成配置。使用 id 上一次API调用中的值 <SETTING_ID> 以下URL路径中的值。

您可以先对特定设置的GET请求进行问题描述处理、以查看configSchema。此操作将提供有关配置中所需字段的详细信息。

HTTP 方法	路径
PUT	/accouns/｛account_id｝/core/v1/settings/｛setting_id｝

JSON 输入示例

{
  "type": "application/astra-setting",
  "version": "1.0",
  "desiredConfig": {
    "connectionHost": "myldap.example.com",
    "credentialId": "3bd9c8a7-f5a4-4c44-b778-90a85fc7d154",
    "groupBaseDN": "OU=groups,OU=astra,DC=example,DC=com",
    "isEnabled": "true",
    "port": 686,
    "secureMode": "LDAPS",
    "userBaseDN": "OU=users,OU=astra,DC=example,dc=com",
    "userSearchFilter": "((objectClass=User))",
    "vendor": "Active Directory"
    }
}

有关输入参数、请注意以下事项：

isEnabled 应设置为 true 或者可能发生错误。
credentialId 是先前创建的绑定凭据的ID。
secureMode 应设置为 LDAP 或 LDAPS 根据上一步中的配置。
仅支持使用"Active Directory"作为供应商。

curl 示例

curl --location -i --request PUT --data @JSONinput 'https://astra.example.com/accounts/<ACCOUNT_ID>/core/v1/settings/<SETTING_ID>' --header 'Content-Type: application/astra-setting+json' --header 'Accept: */*' --header 'Authorization: Bearer <API_TOKEN>'

如果调用成功、则返回HTTP 204响应。

5.检索LDAP设置

您可以选择执行以下REST API调用来检索LDAP设置并确认更新。

HTTP 方法	路径
获取	/accouns/｛account_id｝/core/v1/settings/｛setting_id｝

curl 示例

curl --location -i --request GET 'https://astra.example.com/accounts/<ACCOUNT_ID>/core/v1/settings/<SETTING_ID>' --header 'Accept: */*' --header 'Authorization: Bearer <API_TOKEN>'

JSON响应示例

{
  "items": [
  {
    "type": "application/astra-setting",
    "version": "1.0",
    "metadata": {
      "creationTimestamp": "2022-06-17T21:16:31Z",
      "modificationTimestamp": "2022-07-21T07:12:20Z",
      "labels": [],
      "createdBy": "system",
      "modifiedBy": "00000000-0000-0000-0000-000000000000"
    },
    "id": "12072b56-e939-45ec-974d-2dd83b7815df",
    "name": "astra.account.ldap",
    "desiredConfig": {
      "connectionHost": "10.193.61.88",
      "credentialId": "3bd9c8a7-f5a4-4c44-b778-90a85fc7d154",
      "groupBaseDN": "ou=groups,ou=astra,dc=example,dc=com",
      "isEnabled": "true",
      "port": 686,
      "secureMode": "LDAPS",
      "userBaseDN": "ou=users,ou=astra,dc=example,dc=com",
      "userSearchFilter": "((objectClass=User))",
      "vendor": "Active Directory"
    },
    "currentConfig": {
      "connectionHost": "10.193.160.209",
      "credentialId": "3bd9c8a7-f5a4-4c44-b778-90a85fc7d154",
      "groupBaseDN": "ou=groups,ou=astra,dc=example,dc=com",
      "isEnabled": "true",
      "port": 686,
      "secureMode": "LDAPS",
      "userBaseDN": "ou=users,ou=astra,dc=example,dc=com",
      "userSearchFilter": "((objectClass=User))",
      "vendor": "Active Directory"
    },
    "configSchema": {
      "$schema": "http://json-schema.org/draft-07/schema#",
      "title": "astra.account.ldap",
      "type": "object",
      "properties": {
        "connectionHost": {
          "type": "string",
          "description": "The hostname or IP address of your LDAP server."
        },
        "credentialId": {
          "type": "string",
          "description": "The credential ID for LDAP account."
        },
        "groupBaseDN": {
          "type": "string",
          "description": "The base DN of the tree used to start the group search. The system searches the subtree from the specified location."
        },
        "groupSearchCustomFilter": {
          "type": "string",
          "description": "Type of search that controls the default group search filter used."
        },
        "isEnabled": {
          "type": "string",
          "description": "This property determines if this setting is enabled or not."
        },
        "port": {
          "type": "integer",
          "description": "The port on which the LDAP server is running."
        },
        "secureMode": {
          "type": "string",
          "description": "The secure mode LDAPS or LDAP."
        },
        "userBaseDN": {
          "type": "string",
          "description": "The base DN of the tree used to start the user search. The system searches the subtree from the specified location."
        },
        "userSearchFilter": {
          "type": "string",
          "description": "The filter used to search for users according a search criteria."
        },
        "vendor": {
          "type": "string",
          "description": "The LDAP provider you are using.",
          "enum": ["Active Directory"]
        }
      },
      "additionalProperties": false,
      "required": [
        "connectionHost",
        "secureMode",
        "credentialId",
        "userBaseDN",
        "userSearchFilter",
        "groupBaseDN",
        "vendor",
        "isEnabled"
      ]
      },
      "state": "valid",
    }
  ],
  "metadata": {}
}

找到 state 字段中的值、该值将包含下表中的一个值。

State Description

State	Description
待定	配置过程仍处于活动状态、尚未完成。
valid	已成功完成配置、然后 `currentConfig` 在响应中匹配 `desiredConfig`。
error	LDAP配置过程失败。

待定

配置过程仍处于活动状态、尚未完成。

valid

已成功完成配置、然后 currentConfig 在响应中匹配 desiredConfig。

error

LDAP配置过程失败。

将Astra配置为使用LDAP服务器

Creating your file...

1.添加CA证书

JSON 输入示例

curl 示例

JSON响应示例

2.添加绑定凭据

JSON 输入示例

curl 示例

JSON响应示例

3.检索LDAP设置的UUID

curl 示例

JSON响应示例

4.更新LDAP设置

JSON 输入示例

curl 示例

5.检索LDAP设置

curl 示例

JSON响应示例