mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
feat: Improve docs and add docs button
This commit is contained in:
@@ -53,12 +53,14 @@ The Infisical LDAP dynamic secret allows you to generate user credentials on dem
|
||||
</ParamField>
|
||||
|
||||
<ParamField path="Creation LDIF" type="text" required>
|
||||
LDIF file to run while creating a user in LDAP. This can include extra steps to assign the user to groups or set permissions.
|
||||
LDIF to run while creating a user in LDAP. This can include extra steps to assign the user to groups or set permissions.
|
||||
Here `{{Username}}`, `{{Password}}` and `{{EncodedPassword}}` are templatized variables for the username and password generated by the dynamic secret.
|
||||
|
||||
`{{EncodedPassword}}` is the encoded password required for the `unicodePwd` field in Active Directory as described [here](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/change-windows-active-directory-user-password).
|
||||
|
||||
**OpenLDAP** Example:
|
||||
```
|
||||
dn: uid={{Username}},dc=acme,dc=com
|
||||
dn: uid={{Username}},dc=infisical,dc=com
|
||||
changetype: add
|
||||
objectClass: top
|
||||
objectClass: person
|
||||
@@ -67,51 +69,53 @@ The Infisical LDAP dynamic secret allows you to generate user credentials on dem
|
||||
cn: John Doe
|
||||
sn: Doe
|
||||
uid: jdoe
|
||||
mail: jdoe@jumpcloud.com
|
||||
mail: jdoe@infisical.com
|
||||
userPassword: {{Password}}
|
||||
```
|
||||
|
||||
**Active Directory** Example:
|
||||
```
|
||||
dn: CN={{Username}},OU=Test Create,DC=mcs19,DC=tech
|
||||
dn: CN={{Username}},OU=Test Create,DC=infisical,DC=com
|
||||
changetype: add
|
||||
objectClass: top
|
||||
objectClass: person
|
||||
objectClass: organizationalPerson
|
||||
objectClass: user
|
||||
userPrincipalName: {{Username}}@mcs19.tech
|
||||
userPrincipalName: {{Username}}@infisical.com
|
||||
sAMAccountName: {{Username}}
|
||||
unicodePwd::{{EncodedPassword}}
|
||||
userAccountControl: 66048
|
||||
|
||||
dn: CN=test-group,OU=Test Create,DC=mcs19,DC=tech
|
||||
dn: CN=test-group,OU=Test Create,DC=infisical,DC=com
|
||||
changetype: modify
|
||||
add: member
|
||||
member: CN={{Username}},OU=Test Create,DC=mcs19,DC=tech
|
||||
member: CN={{Username}},OU=Test Create,DC=infisical,DC=com
|
||||
-
|
||||
```
|
||||
</ParamField>
|
||||
|
||||
<ParamField path="Revocation LDIF" type="text" required>
|
||||
LDIF file to run while revoking a user in LDAP. This can include extra steps to remove the user from groups or set permissions.
|
||||
LDIF to run while revoking a user in LDAP. This can include extra steps to remove the user from groups or set permissions.
|
||||
Here `{{Username}}` is a templatized variable for the username generated by the dynamic secret.
|
||||
|
||||
**OpenLDAP** Example:
|
||||
**OpenLDAP / Active Directory** Example:
|
||||
```
|
||||
dn: uid={{Username}},dc=acme,dc=com
|
||||
changetype: delete
|
||||
```
|
||||
|
||||
**Active Directory** Example:
|
||||
```
|
||||
dn: CN={{Username}},OU=Test Create,DC=mcs19,DC=tech
|
||||
dn: CN={{Username}},OU=Test Create,DC=infisical,DC=com
|
||||
changetype: delete
|
||||
```
|
||||
</ParamField>
|
||||
|
||||
<ParamField path="Rollback LDIF" type="text">
|
||||
LDIF file to run incase create fails midway.
|
||||
LDIF to run incase Creation LDIF fails midway.
|
||||
|
||||
For the creation example shown above, if the user is created successfully but not added to a group, this LDIF can be used to remove the user.
|
||||
Here `{{Username}}`, `{{Password}}` and `{{EncodedPassword}}` are templatized variables for the username generated by the dynamic secret.
|
||||
|
||||
**OpenLDAP / Active Directory** Example:
|
||||
```
|
||||
dn: CN={{Username}},OU=Test Create,DC=infisical,DC=com
|
||||
changetype: delete
|
||||
```
|
||||
</ParamField>
|
||||
|
||||
</Step>
|
||||
@@ -136,7 +140,7 @@ The Infisical LDAP dynamic secret allows you to generate user credentials on dem
|
||||
</Tip>
|
||||
|
||||
|
||||
Once you click the `Submit` button, a new secret lease will be generated and the credentials from it will be shown to you. With an array of DN's depending on the LDIF file.
|
||||
Once you click the `Submit` button, a new secret lease will be generated and the credentials from it will be shown to you with an array of DN's altered depending on the Creation LDIF.
|
||||
|
||||

|
||||
|
||||
@@ -146,12 +150,12 @@ The Infisical LDAP dynamic secret allows you to generate user credentials on dem
|
||||
|
||||
## Active Directory Integration
|
||||
|
||||
- Passwords in Active Directory are set using the `unicodePwd` field. This must be proceeded by two colons `::` as shown in the example.
|
||||
- Active directory uses the `userAccountControl` field to enable account.
|
||||
- Passwords in Active Directory are set using the `unicodePwd` field. This must be proceeded by two colons `::` as shown in the example. [Source](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/change-windows-active-directory-user-password)
|
||||
- Active directory uses the `userAccountControl` field to enable account. [Read More](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/useraccountcontrol-manipulate-account-properties)
|
||||
- `userAccountControl` set to `512` enables a user.
|
||||
- To disable AD's password expiration for this dynamic user account. The `userAccountControl` value for this is: `65536`.
|
||||
- Since `userAccountControl` flag is cumulative set it to `512 + 65536` = `66048` to do both.
|
||||
- Active Directory does not permit direct modification of a user's `memberOf` attribute. The member attribute of a group and the `memberOf` attribute of a user are linked attributes, where the member attribute represents the forward link, which can be modified. In the context of AD group membership, the group's member attribute serves as the forward link. Therefore, to add a newly created dynamic user to a group, a modification request must be issued to the desired group, updating its membership to include the new user.
|
||||
- Active Directory does not permit direct modification of a user's `memberOf` attribute. The member attribute of a group and the `memberOf` attribute of a user are [linked attributes](https://learn.microsoft.com/en-us/windows/win32/ad/linked-attributes), where the member attribute represents the forward link, which can be modified. In the context of AD group membership, the group's `member` attribute serves as the forward link. Therefore, to add a newly created dynamic user to a group, a modification request must be issued to the desired group, updating its membership to include the new user.
|
||||
|
||||
## LDIF Entries
|
||||
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 156 KiB After Width: | Height: | Size: 490 KiB |
Reference in New Issue
Block a user