Authentication Source Cloud Bridge

The authentication source type Cloud Bridge is one of the IDaaS Cloud Bridges. It is used to establish a connection channel between BambooCloud IDaaS and enterprise internal authentication sources. Currently, AD authentication source and LDAP authentication source are supported.

This chapter guides you through deploying and using the Authentication Source Cloud Bridge Agent on the IDaaS platform, and provides update records for the Authentication Source Cloud Bridge installation package so you can choose the appropriate version according to project requirements. The following takes CentOS Linux release 8.0.1905 as an example for deploying the Authentication Source Cloud Bridge Agent.

Prerequisites

• You have administrator permissions for the IDaaS enterprise center platform.

• You have internal network server operation permissions.

• The server has net-tools, curl, jdk (OpenJDK 17 or above), and rng-tools installed. Installation steps are as follows:

  net-tools Installation

  • Verify whether net-tools is installed.

    rpm -q net-tools

    yum -y install net-tools-2.0-0.22.20131004git.el7.x86_64.rpm

    rpm -q net-tools

    curl --version

    yum -y install jdk-17.0.13_linux-x64_bin.rpm

    java -version

    yum install rng-tools

    cat /etc/sysconfig/rngd

    echo "OPTIONS=\"-r /dev/urandom\"" > /etc/sysconfig/rngd

    service rngd start   启动rng服务
    service rngd status   查看rng服务状态

  sha256sum -c cloudAgent-authSource-{版本号}.zip.sha256

  unzip -od {文件解压后的存放地址} cloudAgent-authSource-{版本号}.zip

   ###UTF-8格式YAML配置标识头,勿删除###
   server:
     # 云桥启动端口
     port: 9082

   agent:
     # 云桥服务地址，domain为在IDaaS的租户域名xx.bccastle.com
     示例：serverAddress: wss://domain/api/v1/ws
     # 云桥ClientID，在IDaaS创建的云桥的ClientID
     示例：agentId: 7jve68NwihfnjsD8SJToWxTU5Wg8hkl1
     # 云桥ClientSecret，在IDaaS创建的云桥的ClientSecret
     示例：agentSecret: LdfwryojYHLMaeNGVdr9fSh1iwyDCL0QuBx2wewrjxT5UOhUQVpAqwerfgj8pLNV1

   authentication:
     ad:
       # AD认证开关，默认值为false，为true开启AD认证
       示例：enable: false
       # AD服务器地址，格式为ldap://host:port/，多个地址时使用,分隔，多个地址时schema必须全部相同，全部都为ldap或全部都为ldaps
       示例：urls: ldap://localhost:389/
       # AD中的节点，会到该节点下查询用户
       示例：rootDn: User
       # AD中的域名，域名存在时，自动拼接登录名+@+域名作为查询条件，否则仅登录名作为查询条件
       示例：domain: test.ad.com
       # 用户查询条件，根据对象类和用户登录名进行查找，userPrincipalName可根据实际情况调整；
       # 占位符说明：{0}-带域名查询，页面输入值+域名，如zhangsan@companya.cn,
       # 无域名时获取认证源域名属性值拼接后查询,{1}-原值查询，以页面输入值查询，如zhangsan。
       示例：searchFilter: '(&(objectClass=user)(userPrincipalName={0}))'
       # AD连接超时时间，可设置范围 1000 - 3000 毫秒
       示例：timeout: 1000

     ldap:
       # LDAP 认证开关，默认值false，为true开启LDAP认证
       示例：enable: false
       # LDAP服务器地址，格式为ldap://host:port/，多个地址时使用,分隔，多个地址时schema必须全部相同，全部都为ldap或全部都为ldaps
       示例：urls: ldap://localhost:389/
       # LDAP目录树最顶部的根目录
       示例：baseDn: DC=test,DC=com,DC=cn
       # LDAP管理员账号标识
       示例：managerDn: testadmin
       # LDAP管理员账号密码
       示例：managerPassword: Passw0rd
       # Ldap公共搜索路径
       示例：userSearchBase: ou=people
       # LDAP中匹配系统用户的过滤条件，详细请参考:https://ldap.com/ldap-filters/，基于条件的查询优先级低于基于DN的查询
       示例：userSearchFilter: (&(objectClass=user)(uid={0}))
       # 填写用户ID或者组织单元除BaseDn外，Ldap用户搜索路径，用户DN模式查询优先
       示例：dnPatterns: uid={0},ou=people
       # LDAP连接超时时间，可设置范围 1000 - 3000 毫秒
       示例：timeout: 1000

   # This is the Agent log level control configuration
   logging:
     level:
       com.bamboocloud.bcidaas.cloudbridge: DEBUG
     file:
       # The value of the attribute must have a unit, which can be KB or MB
       # 单个日志文件大小。默认值10MB，最大值10MB
       # default: 10MB
       # max-size: 10MB
       # The maximum number of days that log files are to be archived
       # 日志最长保留时间。默认值7天，最大值7天
       # default: 7 DAYS
       # max-history: 7

   ./cloudBridge.sh start

   ./agent.sh install

   ./agent.sh uninstall