SonarQube LDAP
I want to Search for a Account in SonarQube
Administration -> Security -> User ->Search
The premise is that this account has not been logged in SonarQube. But the account exists in LDAP.
But if the account has been logged in SonarQube,it can be searched.
My goal is to group and authorize the known LDAP accounts in advance.
thanks so much
Ever since SONAR-8715 was implemented in 6.3, it has been possible to provision non-local users. Your use-case is pretty well described in that ticket, and you can make use of the POST api/users/create Web API. This is only possible through the Web API, not the UI.
Once your users are created, they can be assigned permissions that persist when a user logs in for the first time.
Check out your own instance’s Web API documentation for the most relevant information for your version of SonarQube.
Related
The use case is a sudo for a dual-role user who wants to switch user accounts to perform Jenkins administrative tasks when no GitHub account is authorized as a local Jenkins admin and GitHub OAuth Plugin manages authentication (overshadowing Jenkins built-in authentication form).
More info
A power user with two roles (Jenkins admin and DevOps) wants to perform some administrative task (like adding an access token to Jenkins keyring), but none of the linked GitHub accounts (that can be authenticated by Jenkins using its GitHub OAuth Plugin) is authorized as Jenkins admin (using Matrix Authorization Strategy). Is the admin account effectively locked out, because Jenkins GitHub OAuth Plugin does not let us log in with local Jenkins admin rights? If so, then shouldn't this situation be prevented by the GitHub OAuth Plugin, ensuring that at least one GitHub user has retained Jenkins admin role?
Side note: out of all alternatives such as (over)shadowing, hiding, or obscuring, the first sounded the most exciting, but feel free to fix the term if necessary.
I managed to turn off security, i.e. escalate to admin... using Jenkins own interface. But wait, there's more: I was led there by... Jenkins' security tip.
Just go to:
https://<JENKINS_URL>/configureSecurity/
(then change Security Realm to "None" and Authorization to "Anyone can do anything").
Key take-away: never run Jenkins without proper air-gapping.
As a company, is it possible to mandate SSO for everyone who works for me? i.e anyone who registers with an #companyname.com email has to go through my Google SSO regardless if they're logging into and pushing code to a repo not maintained by my organization?
If your users are Enterprise Managed Users, you now (Sept. 2022) have the option of:
Automatic Single Sign On for Enterprise Managed Users – Public Beta
Enterprise administrators can now choose to redirect signed-out Enterprise Managed Users to their company's single sign-on (SSO) page. This feature is available as a public beta.
By default, enterprises with Managed Users enabled are hidden, showing a 404 error page any time an enterprise resource is visited by a user that isn't already signed in to the enterprise.
If you enable this feature for your enterprise, visitors to resources in your enterprise, org, or user namespaces will immediately be presented with an SSO redirect if not already signed in to your enterprise.
This redirect helps users sign in to the correct account, rather than giving them the impression that the link they were given no longer works.
You can find this setting in the Authentication security section of your Enterprise Settings, below the single sign-on configuration sections.
Read more about this settings at "Automatic redirection for Enterprise Managed Users".
since anypoint platform url anypoint.mulesoft.com is publicly accessible anyone can access the resources. Is there anyway i can restrict access to my org users apart from creating access roles.
Can i create org specific url with org secific access so that others cant access?
Can put some network related restrictions?
I think you confusing two different things:
Accessing a public URL (ie https://anypoint.mulesoft.com)
Authorization inside your organization's account
You can not restrict access to a site that you don't own, it is publicly accessible and needs to be accessed by other users. It doesn't even make sense really. Would you attempt to restrict access by others to google.com or twitter.com (or their API URLs)? It is not the right approach and it is just not possible.
What makes sense however is to manage permissions inside your organization in Anypoint Platform. It means when an user belonging to your organization logs in you can manage what of the available roles are permissions that user will have. You can do that in the Access Management page. You can also create custom roles with specific permissions and teams to better organize your users.
As mentioned you are not able to change MuleSoft's main URL (ie https://anypoint.mulesoft.com), one option being to control from Access Management page, both mentioned by #aled
There are two main ways you can get what you need:
If your organization already has some MFA tool that requires you to be in your corporate VPN, you could use that MFA as the MFA for the Anypoint Platform e.g. Users will need Username/Password, connect to the VPN to be able to get access to the MFA generator/auth and then use that code to finish logging into the platform. As Admin in Anypoint Platform you can enforce EVERYONE to have MFA set up (keep in mind ClientApps authorization for your automation users)
If your company already has an Identity Provider you can configure identity management in Anypoint Platform to set up users for single sign-on (SSO). The fragments below extracted from the official docs external-identity:
After configuring identity management, you must add new SSO users using your external identity management solution and internal provisioning process. If you use the Invite User feature to add users to your organization after you have configured an identity provider, the credentials for these users are stored locally in your organization rather than with the identity provider.
Users that log in with SSO are new users to the system. If the new user has the same username as a user that already exists in your Anypoint Platform organization, the new user co-exists with the original user with the same username. Users with the same username are managed independently from one another.
I am trying to protect a Java servlet with OpenAM + J2EE tomcat agent. I got this part working by using embedded OpenDJ of OpenAM.
Now I am trying to authenticate against a LDAP server, so I added a LDAP module instance for OpenAM, but I get "User has no profile in this organization" when I am trying use uid/password of an user from that LDAP store.
I checked OpenAM administration guide on this the description is rather brief. I am wondering if it is even possible to do this without using the data store configured for OpenAM?
The login process in OpenAM is made of two stages:
Verifying credentials based on the authentication chain and individual authentication module configurations
User profile lookup
By configuring the LDAP authentication module you took care of the authentication part, however the profile lookup fails as you haven't configured the user data store (see data stores tab). Having a configured data store allows you to potentially expose additional user details across your deployment (e.g. include user attributes in SAML assertions or map them to HTTP headers with the agent), so in most of the scenarios having a data store configured is necessary.
In case you still don't want to configure a data store, then you can prevent the user profile lookup failure by going to Access Control -> <realm> -> Authentication -> All Core Settings -> User Profile Mode and set it to Ignore.
This is unrelated to authentication but it's related to authorization ... you have to configure appropriate policies ... see OpenAM docs.
Agents will enforce authorization, OpenAM determines if the user has the permission to access a protected resource.
As Bernhard has indicated authentication is only part of the process of granting access to a user. He is referring to using a Policy to control access.
Another method is to check if the authenticated user is a member of the desired group programmatically. This can be useful when you want access control over resources that OpenAM doesn't know about (e.g. specific data).
For example, lets say that you want different groups to have access to different rows in a table in a database. You can retrieve the group information associated with the user and add that to your database query, thus restricting the data returned.
I'm sure that you could do this with OpenAM as well using custom modules to allow the policy to use information in the database as resource, but I've found it is much simpler to perform this fine grained access control in your code, and is in all likelihood significantly faster.
We have a requirement to get information from specific users on an LDAP directory based on a Smartcard being presented. The application is already running under an AD user account, but using that users access to LDAP will not have sufficient access to the specific users data.
We have stumbled through a few parts of LDAP APIs and not had much luck finding info on how to make an LDAP bind call without username/password and more specifically with auth from a smartcard. Some of the MS LDAP appears to allow the option of using the current user token.
The best we have come up with is to use the SC to login then while impersonating the user create the ldap connecton using the current user token. Similar in idea to this MDSN blog .
Is there a better way?
The problem we are having with the impersonation is that the logged in user has to have certain rights for logging on other users to do the impersonation. Also while impersonating we need to limit other interactions, accessing the file system or registry as the alternate user is not desirable.