awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: Improve docs and add docs button

Browse Source
This commit is contained in:
Meet
2024-10-03 09:56:27 +05:30
parent 859c556425
commit 25f694bbdb
4 changed files with 44 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

46
docs/documentation/platform/dynamic-secrets/ldap.mdx
View File

@@ -53,12 +53,14 @@ The Infisical LDAP dynamic secret allows you to generate user credentials on dem
</ParamField>
<ParamField path="Creation LDIF" type="text" required>
LDIF file to run while creating a user in LDAP. This can include extra steps to assign the user to groups or set permissions.
LDIF to run while creating a user in LDAP. This can include extra steps to assign the user to groups or set permissions.
Here `{{Username}}`, `{{Password}}` and `{{EncodedPassword}}` are templatized variables for the username and password generated by the dynamic secret.
`{{EncodedPassword}}` is the encoded password required for the `unicodePwd` field in Active Directory as described [here](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/change-windows-active-directory-user-password).
**OpenLDAP** Example:
```
dn: uid={{Username}},dc=acme,dc=com
dn: uid={{Username}},dc=infisical,dc=com
changetype: add
objectClass: top
objectClass: person
@@ -67,51 +69,53 @@ The Infisical LDAP dynamic secret allows you to generate user credentials on dem
cn: John Doe
sn: Doe
uid: jdoe
mail: jdoe@jumpcloud.com
mail: jdoe@infisical.com
userPassword: {{Password}}
```
**Active Directory** Example:
```
dn: CN={{Username}},OU=Test Create,DC=mcs19,DC=tech
dn: CN={{Username}},OU=Test Create,DC=infisical,DC=com
changetype: add
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
userPrincipalName: {{Username}}@mcs19.tech
userPrincipalName: {{Username}}@infisical.com
sAMAccountName: {{Username}}
unicodePwd::{{EncodedPassword}}
userAccountControl: 66048
dn: CN=test-group,OU=Test Create,DC=mcs19,DC=tech
dn: CN=test-group,OU=Test Create,DC=infisical,DC=com
changetype: modify
add: member
member: CN={{Username}},OU=Test Create,DC=mcs19,DC=tech
member: CN={{Username}},OU=Test Create,DC=infisical,DC=com
-
```
</ParamField>
<ParamField path="Revocation LDIF" type="text" required>
LDIF file to run while revoking a user in LDAP. This can include extra steps to remove the user from groups or set permissions.
LDIF to run while revoking a user in LDAP. This can include extra steps to remove the user from groups or set permissions.
Here `{{Username}}` is a templatized variable for the username generated by the dynamic secret.
**OpenLDAP** Example:
**OpenLDAP / Active Directory** Example:
```
dn: uid={{Username}},dc=acme,dc=com
changetype: delete
```
**Active Directory** Example:
```
dn: CN={{Username}},OU=Test Create,DC=mcs19,DC=tech
dn: CN={{Username}},OU=Test Create,DC=infisical,DC=com
changetype: delete
```
</ParamField>
<ParamField path="Rollback LDIF" type="text">
LDIF file to run incase create fails midway.
LDIF to run incase Creation LDIF fails midway.
For the creation example shown above, if the user is created successfully but not added to a group, this LDIF can be used to remove the user.
Here `{{Username}}`, `{{Password}}` and `{{EncodedPassword}}` are templatized variables for the username generated by the dynamic secret.
**OpenLDAP / Active Directory** Example:
```
dn: CN={{Username}},OU=Test Create,DC=infisical,DC=com
changetype: delete
```
</ParamField>
</Step>
@@ -136,7 +140,7 @@ The Infisical LDAP dynamic secret allows you to generate user credentials on dem
</Tip>
Once you click the `Submit` button, a new secret lease will be generated and the credentials from it will be shown to you. With an array of DN's depending on the LDIF file.
Once you click the `Submit` button, a new secret lease will be generated and the credentials from it will be shown to you with an array of DN's altered depending on the Creation LDIF.
![Provision Lease](/images/platform/dynamic-secrets/dynamic-secret-ldap-lease.png)
@@ -146,12 +150,12 @@ The Infisical LDAP dynamic secret allows you to generate user credentials on dem
## Active Directory Integration
- Passwords in Active Directory are set using the `unicodePwd` field. This must be proceeded by two colons `::` as shown in the example.
- Active directory uses the `userAccountControl` field to enable account.
- Passwords in Active Directory are set using the `unicodePwd` field. This must be proceeded by two colons `::` as shown in the example. [Source](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/change-windows-active-directory-user-password)
- Active directory uses the `userAccountControl` field to enable account. [Read More](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/useraccountcontrol-manipulate-account-properties)
- `userAccountControl` set to `512` enables a user.
- To disable AD's password expiration for this dynamic user account. The `userAccountControl` value for this is: `65536`.
- Since `userAccountControl` flag is cumulative set it to `512 + 65536` = `66048` to do both.
- Active Directory does not permit direct modification of a user's `memberOf` attribute. The member attribute of a group and the `memberOf` attribute of a user are linked attributes, where the member attribute represents the forward link, which can be modified. In the context of AD group membership, the group's member attribute serves as the forward link. Therefore, to add a newly created dynamic user to a group, a modification request must be issued to the desired group, updating its membership to include the new user.
- Active Directory does not permit direct modification of a user's `memberOf` attribute. The member attribute of a group and the `memberOf` attribute of a user are [linked attributes](https://learn.microsoft.com/en-us/windows/win32/ad/linked-attributes), where the member attribute represents the forward link, which can be modified. In the context of AD group membership, the group's `member` attribute serves as the forward link. Therefore, to add a newly created dynamic user to a group, a modification request must be issued to the desired group, updating its membership to include the new user.
## LDIF Entries