diff --git a/docs/documentation/platform/dynamic-secrets/ldap.mdx b/docs/documentation/platform/dynamic-secrets/ldap.mdx index ccb629dcc..2dc51d74e 100644 --- a/docs/documentation/platform/dynamic-secrets/ldap.mdx +++ b/docs/documentation/platform/dynamic-secrets/ldap.mdx @@ -53,12 +53,14 @@ The Infisical LDAP dynamic secret allows you to generate user credentials on dem - LDIF file to run while creating a user in LDAP. This can include extra steps to assign the user to groups or set permissions. + LDIF to run while creating a user in LDAP. This can include extra steps to assign the user to groups or set permissions. Here `{{Username}}`, `{{Password}}` and `{{EncodedPassword}}` are templatized variables for the username and password generated by the dynamic secret. + `{{EncodedPassword}}` is the encoded password required for the `unicodePwd` field in Active Directory as described [here](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/change-windows-active-directory-user-password). + **OpenLDAP** Example: ``` - dn: uid={{Username}},dc=acme,dc=com + dn: uid={{Username}},dc=infisical,dc=com changetype: add objectClass: top objectClass: person @@ -67,51 +69,53 @@ The Infisical LDAP dynamic secret allows you to generate user credentials on dem cn: John Doe sn: Doe uid: jdoe - mail: jdoe@jumpcloud.com + mail: jdoe@infisical.com userPassword: {{Password}} ``` **Active Directory** Example: ``` - dn: CN={{Username}},OU=Test Create,DC=mcs19,DC=tech + dn: CN={{Username}},OU=Test Create,DC=infisical,DC=com changetype: add objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user - userPrincipalName: {{Username}}@mcs19.tech + userPrincipalName: {{Username}}@infisical.com sAMAccountName: {{Username}} unicodePwd::{{EncodedPassword}} userAccountControl: 66048 - dn: CN=test-group,OU=Test Create,DC=mcs19,DC=tech + dn: CN=test-group,OU=Test Create,DC=infisical,DC=com changetype: modify add: member - member: CN={{Username}},OU=Test Create,DC=mcs19,DC=tech + member: CN={{Username}},OU=Test Create,DC=infisical,DC=com - ``` - LDIF file to run while revoking a user in LDAP. This can include extra steps to remove the user from groups or set permissions. + LDIF to run while revoking a user in LDAP. This can include extra steps to remove the user from groups or set permissions. Here `{{Username}}` is a templatized variable for the username generated by the dynamic secret. - **OpenLDAP** Example: + **OpenLDAP / Active Directory** Example: ``` - dn: uid={{Username}},dc=acme,dc=com - changetype: delete - ``` - - **Active Directory** Example: - ``` - dn: CN={{Username}},OU=Test Create,DC=mcs19,DC=tech + dn: CN={{Username}},OU=Test Create,DC=infisical,DC=com changetype: delete ``` - LDIF file to run incase create fails midway. + LDIF to run incase Creation LDIF fails midway. + + For the creation example shown above, if the user is created successfully but not added to a group, this LDIF can be used to remove the user. Here `{{Username}}`, `{{Password}}` and `{{EncodedPassword}}` are templatized variables for the username generated by the dynamic secret. + + **OpenLDAP / Active Directory** Example: + ``` + dn: CN={{Username}},OU=Test Create,DC=infisical,DC=com + changetype: delete + ``` @@ -136,7 +140,7 @@ The Infisical LDAP dynamic secret allows you to generate user credentials on dem - Once you click the `Submit` button, a new secret lease will be generated and the credentials from it will be shown to you. With an array of DN's depending on the LDIF file. + Once you click the `Submit` button, a new secret lease will be generated and the credentials from it will be shown to you with an array of DN's altered depending on the Creation LDIF. ![Provision Lease](/images/platform/dynamic-secrets/dynamic-secret-ldap-lease.png) @@ -146,12 +150,12 @@ The Infisical LDAP dynamic secret allows you to generate user credentials on dem ## Active Directory Integration -- Passwords in Active Directory are set using the `unicodePwd` field. This must be proceeded by two colons `::` as shown in the example. -- Active directory uses the `userAccountControl` field to enable account. +- Passwords in Active Directory are set using the `unicodePwd` field. This must be proceeded by two colons `::` as shown in the example. [Source](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/change-windows-active-directory-user-password) +- Active directory uses the `userAccountControl` field to enable account. [Read More](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/useraccountcontrol-manipulate-account-properties) - `userAccountControl` set to `512` enables a user. - To disable AD's password expiration for this dynamic user account. The `userAccountControl` value for this is: `65536`. - Since `userAccountControl` flag is cumulative set it to `512 + 65536` = `66048` to do both. -- Active Directory does not permit direct modification of a user's `memberOf` attribute. The member attribute of a group and the `memberOf` attribute of a user are linked attributes, where the member attribute represents the forward link, which can be modified. In the context of AD group membership, the group's member attribute serves as the forward link. Therefore, to add a newly created dynamic user to a group, a modification request must be issued to the desired group, updating its membership to include the new user. +- Active Directory does not permit direct modification of a user's `memberOf` attribute. The member attribute of a group and the `memberOf` attribute of a user are [linked attributes](https://learn.microsoft.com/en-us/windows/win32/ad/linked-attributes), where the member attribute represents the forward link, which can be modified. In the context of AD group membership, the group's `member` attribute serves as the forward link. Therefore, to add a newly created dynamic user to a group, a modification request must be issued to the desired group, updating its membership to include the new user. ## LDIF Entries diff --git a/docs/images/platform/dynamic-secrets/dynamic-secret-ldap-select.png b/docs/images/platform/dynamic-secrets/dynamic-secret-ldap-select.png index a8bc817a5..7694a3fef 100644 Binary files a/docs/images/platform/dynamic-secrets/dynamic-secret-ldap-select.png and b/docs/images/platform/dynamic-secrets/dynamic-secret-ldap-select.png differ diff --git a/frontend/src/views/SecretMainPage/components/ActionBar/CreateDynamicSecretForm/LdapInputForm.tsx b/frontend/src/views/SecretMainPage/components/ActionBar/CreateDynamicSecretForm/LdapInputForm.tsx index c59f914b5..b78161aa5 100644 --- a/frontend/src/views/SecretMainPage/components/ActionBar/CreateDynamicSecretForm/LdapInputForm.tsx +++ b/frontend/src/views/SecretMainPage/components/ActionBar/CreateDynamicSecretForm/LdapInputForm.tsx @@ -1,4 +1,7 @@ import { Controller, useForm } from "react-hook-form"; +import Link from "next/link"; +import { faArrowUpRightFromSquare, faBookOpen } from "@fortawesome/free-solid-svg-icons"; +import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; import { zodResolver } from "@hookform/resolvers/zod"; import ms from "ms"; import { z } from "zod"; @@ -160,6 +163,21 @@ export const LdapInputForm = ({
Configuration + + +
+ + Docs + +
+ +
diff --git a/frontend/src/views/SecretMainPage/components/DynamicSecretListView/CreateDynamicSecretLease.tsx b/frontend/src/views/SecretMainPage/components/DynamicSecretListView/CreateDynamicSecretLease.tsx index 83cffdbf2..a8dce8290 100644 --- a/frontend/src/views/SecretMainPage/components/DynamicSecretListView/CreateDynamicSecretLease.tsx +++ b/frontend/src/views/SecretMainPage/components/DynamicSecretListView/CreateDynamicSecretLease.tsx @@ -209,7 +209,7 @@ const renderOutputForm = (provider: DynamicSecretProviders, data: unknown) => { value={PASSWORD} helperText="Important: Copy these credentials now. You will not be able to see them again after you close the modal." /> - +