Does openshift (Origin or Enterprise) support multiple auth providers ?
eg 1. htpasswd (if not found ) 2. ldap
This link talks about various auth supported but can we use multiple
...
oauthConfig:
identityProviders:
- name: htpasswd_auth
challenge: true
login: false
mappingMethod: "claim"
...
- name: "my_ldap_provider"
challenge: true
login: true
mappingMethod: claim
provider:
...
Yes, you can specify multiple auth providers. Just make sure they have different names. You'll also want to be careful cases where their preferred usernames will collide. claim (like you have it) is a pretty safe default. See https://docs.openshift.com/enterprise/3.2/install_config/configuring_authentication.html#mapping-identities-to-users if you want to read up on alternatives.
Related
I have the following http path devices/{sn} in a Serverless-AWS APIgateway API. The wildcard sn is a 15 digits [A-Z0-9] pattern.
In the API today any string that is not recognized as a valid path is redirected to this end-point. Ex: devices/test goes to devices/{sn}, devices/bla goes to devices/{sn} and so on. All those strings will query the database and return null because there is no such sn in the table. I could create a validation process inside the lambda to avoid the unnecessary database query. But I want to save lambda resource and I would like to validate before call the lambda.
This is what I have today for this endpoint:
- http:
path: devices/{sn}
method: GET
private: false
cors: true
authorizer: ${file(env.yml):${self:provider.stage}.authorizer}
request:
parameters:
paths:
sn: true
How can I setup this validation or filter in Serverless.yml?
In fact it should be a very straight-forward functionality of AWS/Serverless.
Let's say we have the following scenario: myPath/{id}. In this case id is a integer (a pk in a table). If I type myPath/blabla it will trigg the lambda. The system will spend resource. It shoul have a kind of previous validation - trig the endpoint only if the {id} === integer.
Your issue is very similar to this issue
According to the post and from my experience, No, I don't think you can perform validation in api-gateway level.
I am trying to setup User Federation from a LDAP server to Keycloak. I managed to import all the users and groups respectively from LDAP server, however, the user-group (group tab in Users section) doesn’t show the actual mapped groups, although I can see those users presenting in the groups listed in Members tab in Groups section…
I went through all article in Keycloak forum/Jira ticket/Mail list and I did find a ticket describing the exact issue that I am experiencing now (https://lists.jboss.org/pipermail/keycloak-user/2018-February/013076.html) and Marek has also replied to that as well, however, I still couldn't figure out what configuration I set incorrectly just by the information provided in the post.
Could anyone please help me out? Thanks ahead!
User-Group
Group
User Configuration
Group Mapper Configuration
Thanks,
Chance
Looks like the issue was in LDAP server. The problem only exists when I import the users from FreeIPA DB. However, when I try to federate to an AD server, the user-group information just comes along with the users without any additional modification!
Below is the configuration I have used in the successful case. Hopefully it will help others who encounter with a similar issue. Thanks everyone for the attention.
[User Federation Provider Settings]
Enabled: ON (Default)
Console Display Name :
Priority: 0 (Default)
Import Users : ON (Default)
Edit Mode : READ_ONLY
Sync Registrations : OFF (Default)
Vendor : Active Directory (This is important. Once I switch to AD, instead of FreeIPA, the issue is gone)
Username LDAP attribute: sAMAccountName
RDN LDAP attribute : cn
UUID LDAP attribute : objectGUID
User Object Classes : person, organizationalPerson, user (You should check what Object Class the server is currently configured and adjust accordingly)
Connection URL : ldap://:389 (If you are using ldaps, the port is 636)
Users DN : <the scope includes all your users you would like to import, e.g. OU=User,DC=example,DC=com)
Bind Type: simple
Enable StartTLS: OFF (Default)
Bind DN:
Bind Credential:
Custom User LDAP Filter: <You can leave it blank if you don't want to filter. However, if you would like to filter something, for example, users from a specific group, you can run a filter such as (&(objectClass=user)(memberof:1.2.840.113556.1.4.1941:=CN=,OU=,DC=example,DC=com)) >
Search Scope: Subtree (It the users after under one level of Users DN, you can choose "One level" option)
Validate Password Policy: OFF (Default)
Trust Email: OFF (Default)
Use Truststore SPI: Only for ldaps
Connection Pooling: On
The rest of setting leave it blank.
You need to configure a group-ldap-mapper as well
[Group Mapper]
Name:
Mapper Type: group-ldap-mapper
LDAP Groups DN : <Where are the groups of this tree saved. For example, OU=Group,DC=example,DC=com>
Group Name LDAP Attribute : cn
Group Object Classes : group
Preserve Group Inheritance: ON
Ignore Missing Groups: OFF (Default)
Membership LDAP Attribute : member
Membership Attribute Type: DN
Membership User LDAP Attribute: sAMAccountName
LDAP Filter : <You can leave it blank if you don't want to filter any group>
Mode: READ_ONLY
User Groups Retrieve Strategy: LOAD_GROUPS_BY_MEMBER_ATTRIBUTE
Member-Of LDAP Attribute: memberOf
Mapped Group Attributes:
Drop non-existing groups during sync: ON
I have two flat Feed Groups, main, the primary news feed, and main_topics.
I can make a post to either one successfully.
But when I try to 'cc' the other using the to field, like, to: ["main_topics:donuts"] I get:
code: 17
detail: "You do not have permission to do this, you got this error because there are no policies allowing this request on this application. Please consult the documentation https://getstream.io/docs/"
duration: "0.16ms"
exception: "NotAllowedException"
status_code: 403
Log:
The request didn't have the right permissions or autorization. Please check our docs about how to sign requests.
We're generating user tokens server-side, and the token works to read and write to both groups without to.
// on server
stream_client.user(user.user_id).create({
name: user.name,
username: user.username,
});
Post body:
actor: "SU:5f40650ad9b60a00370686d7"
attachments: {images: [], files: []}
foreign_id: "post:1598391531232"
object: "Newsfeed"
text: "Yum #donuts"
time: "2020-08-25T14:38:51.232"
to: ["main_topics:donuts", "main_topics:all"]
verb: "post"
The docs show an example with to: ['team:barcelona', 'match:1'], and say you need to create the feed groups in the panel, but mention nothing about setting up specific permissions to use this feature.
Any idea why this would happen? Note that I'm trying to create the new topics (donuts, all) which don't exist when this post is made. However, the docs don't specify that feeds need to be explicitly created first - maybe that's the missing piece?
If you haven’t already tried creating the feed first, then try that. Besides that, the default permissions restrict a user from posting on another’s feed. I think it’s acceptable to do this if it’s a notification feed but not user or timeline.
You can email the getstream support to change the default permissions because these are not manageable from the dashboard.
Or you can do this call server side as an admin permissions.
active directory LDAP configuration:
Key Value
--- -----
binddn CN=BindVault,OU=my-ou,DC=ad,DC=xyz,DC=net
case_sensitive_names true
certificate n/a
deny_null_bind true
discoverdn false
groupattr memberOf
groupdn DC=ad,DC=xyz,DC=net
groupfilter (&(objectClass=person)(sAMAccountName={{.Username}}))
insecure_tls false
starttls true
tls_max_version tls12
tls_min_version tls12
token_bound_cidrs []
token_explicit_max_ttl 0s
token_max_ttl 0s
token_no_default_policy true
token_num_uses 0
token_period 0s
token_policies []
token_ttl 0s
token_type default
upndomain n/a
url ldaps://ldaps.ad.xyz.net:636
use_pre111_group_cn_behavior true
use_token_groups true
userattr cn
userdn DC=ad,DC=xyz,DC=net
This works ok, in that when a user logs in, the query returns the groups that the user is a member of, and policies can be mapped to groups.
The problem is with users who are not a member of any ldap policy groups. Currently, these users are able to log in, but are denied access to everything because they are not assigned any policies. I would prefer that they can't log in at all.
It looks like there is an open pull request that will add a filter for users that can be used to allow access to only specified LDAP users. The pull request has passed all the automated checks and is awaiting review so will hopefully be added soon.
I think I found the solution, I added the userfilter in the auth/ldap/config and configured it like this :
userfilter=“(&(objectClass=user)({{.UserAttr}}={{.Username}})(memberOf=cn=MySelectedGroup,cn=Users,dc=test,dc=com))”
So change the memberOf= at the end so that it matches your ldap group.
Have a nice day :)
We're using Roundhouse to deploy our databases and keep versions for SQL Server (2008+)
I have a script which grants permissions and needs to have a username passed in. I know there is support for token replacement in Roundhouse, but the only token I've seen mentioned is {{database}}.
What built-in tokens are available?
Can users define their own tokens? Is so how?
At this time ONLY the items in the configuration - https://github.com/chucknorris/roundhouse/wiki/ConfigurationOptions
Note the full name of the option when using token replacement:
-d, --db, --database, --databasename=VALUE | REQUIRED: DatabaseName - The database you want to create/migrate.
-c, --cs, --connstring, --connectionstring=VALUE | REQUIRED: ConnectionString - As an alternative to ServerName and Database - You
can provide an entire connection string instead.
It's the bolded name, e.g. "{{DatabaseName}}" or "{{ConnectionString}}" from the examples above.