feat: Improve docs and add docs button

This commit is contained in:
Meet
2024-10-03 09:56:27 +05:30
parent 859c556425
commit 25f694bbdb
4 changed files with 44 additions and 22 deletions
@@ -53,12 +53,14 @@ The Infisical LDAP dynamic secret allows you to generate user credentials on dem
</ParamField> </ParamField>
<ParamField path="Creation LDIF" type="text" required> <ParamField path="Creation LDIF" type="text" required>
LDIF file to run while creating a user in LDAP. This can include extra steps to assign the user to groups or set permissions. LDIF to run while creating a user in LDAP. This can include extra steps to assign the user to groups or set permissions.
Here `{{Username}}`, `{{Password}}` and `{{EncodedPassword}}` are templatized variables for the username and password generated by the dynamic secret. Here `{{Username}}`, `{{Password}}` and `{{EncodedPassword}}` are templatized variables for the username and password generated by the dynamic secret.
`{{EncodedPassword}}` is the encoded password required for the `unicodePwd` field in Active Directory as described [here](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/change-windows-active-directory-user-password).
**OpenLDAP** Example: **OpenLDAP** Example:
``` ```
dn: uid={{Username}},dc=acme,dc=com dn: uid={{Username}},dc=infisical,dc=com
changetype: add changetype: add
objectClass: top objectClass: top
objectClass: person objectClass: person
@@ -67,51 +69,53 @@ The Infisical LDAP dynamic secret allows you to generate user credentials on dem
cn: John Doe cn: John Doe
sn: Doe sn: Doe
uid: jdoe uid: jdoe
mail: jdoe@jumpcloud.com mail: jdoe@infisical.com
userPassword: {{Password}} userPassword: {{Password}}
``` ```
**Active Directory** Example: **Active Directory** Example:
``` ```
dn: CN={{Username}},OU=Test Create,DC=mcs19,DC=tech dn: CN={{Username}},OU=Test Create,DC=infisical,DC=com
changetype: add changetype: add
objectClass: top objectClass: top
objectClass: person objectClass: person
objectClass: organizationalPerson objectClass: organizationalPerson
objectClass: user objectClass: user
userPrincipalName: {{Username}}@mcs19.tech userPrincipalName: {{Username}}@infisical.com
sAMAccountName: {{Username}} sAMAccountName: {{Username}}
unicodePwd::{{EncodedPassword}} unicodePwd::{{EncodedPassword}}
userAccountControl: 66048 userAccountControl: 66048
dn: CN=test-group,OU=Test Create,DC=mcs19,DC=tech dn: CN=test-group,OU=Test Create,DC=infisical,DC=com
changetype: modify changetype: modify
add: member add: member
member: CN={{Username}},OU=Test Create,DC=mcs19,DC=tech member: CN={{Username}},OU=Test Create,DC=infisical,DC=com
- -
``` ```
</ParamField> </ParamField>
<ParamField path="Revocation LDIF" type="text" required> <ParamField path="Revocation LDIF" type="text" required>
LDIF file to run while revoking a user in LDAP. This can include extra steps to remove the user from groups or set permissions. LDIF to run while revoking a user in LDAP. This can include extra steps to remove the user from groups or set permissions.
Here `{{Username}}` is a templatized variable for the username generated by the dynamic secret. Here `{{Username}}` is a templatized variable for the username generated by the dynamic secret.
**OpenLDAP** Example: **OpenLDAP / Active Directory** Example:
``` ```
dn: uid={{Username}},dc=acme,dc=com dn: CN={{Username}},OU=Test Create,DC=infisical,DC=com
changetype: delete
```
**Active Directory** Example:
```
dn: CN={{Username}},OU=Test Create,DC=mcs19,DC=tech
changetype: delete changetype: delete
``` ```
</ParamField> </ParamField>
<ParamField path="Rollback LDIF" type="text"> <ParamField path="Rollback LDIF" type="text">
LDIF file to run incase create fails midway. LDIF to run incase Creation LDIF fails midway.
For the creation example shown above, if the user is created successfully but not added to a group, this LDIF can be used to remove the user.
Here `{{Username}}`, `{{Password}}` and `{{EncodedPassword}}` are templatized variables for the username generated by the dynamic secret. Here `{{Username}}`, `{{Password}}` and `{{EncodedPassword}}` are templatized variables for the username generated by the dynamic secret.
**OpenLDAP / Active Directory** Example:
```
dn: CN={{Username}},OU=Test Create,DC=infisical,DC=com
changetype: delete
```
</ParamField> </ParamField>
</Step> </Step>
@@ -136,7 +140,7 @@ The Infisical LDAP dynamic secret allows you to generate user credentials on dem
</Tip> </Tip>
Once you click the `Submit` button, a new secret lease will be generated and the credentials from it will be shown to you. With an array of DN's depending on the LDIF file. Once you click the `Submit` button, a new secret lease will be generated and the credentials from it will be shown to you with an array of DN's altered depending on the Creation LDIF.
![Provision Lease](/images/platform/dynamic-secrets/dynamic-secret-ldap-lease.png) ![Provision Lease](/images/platform/dynamic-secrets/dynamic-secret-ldap-lease.png)
@@ -146,12 +150,12 @@ The Infisical LDAP dynamic secret allows you to generate user credentials on dem
## Active Directory Integration ## Active Directory Integration
- Passwords in Active Directory are set using the `unicodePwd` field. This must be proceeded by two colons `::` as shown in the example. - Passwords in Active Directory are set using the `unicodePwd` field. This must be proceeded by two colons `::` as shown in the example. [Source](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/change-windows-active-directory-user-password)
- Active directory uses the `userAccountControl` field to enable account. - Active directory uses the `userAccountControl` field to enable account. [Read More](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/useraccountcontrol-manipulate-account-properties)
- `userAccountControl` set to `512` enables a user. - `userAccountControl` set to `512` enables a user.
- To disable AD's password expiration for this dynamic user account. The `userAccountControl` value for this is: `65536`. - To disable AD's password expiration for this dynamic user account. The `userAccountControl` value for this is: `65536`.
- Since `userAccountControl` flag is cumulative set it to `512 + 65536` = `66048` to do both. - Since `userAccountControl` flag is cumulative set it to `512 + 65536` = `66048` to do both.
- Active Directory does not permit direct modification of a user's `memberOf` attribute. The member attribute of a group and the `memberOf` attribute of a user are linked attributes, where the member attribute represents the forward link, which can be modified. In the context of AD group membership, the group's member attribute serves as the forward link. Therefore, to add a newly created dynamic user to a group, a modification request must be issued to the desired group, updating its membership to include the new user. - Active Directory does not permit direct modification of a user's `memberOf` attribute. The member attribute of a group and the `memberOf` attribute of a user are [linked attributes](https://learn.microsoft.com/en-us/windows/win32/ad/linked-attributes), where the member attribute represents the forward link, which can be modified. In the context of AD group membership, the group's `member` attribute serves as the forward link. Therefore, to add a newly created dynamic user to a group, a modification request must be issued to the desired group, updating its membership to include the new user.
## LDIF Entries ## LDIF Entries
Binary file not shown.

Before

Width:  |  Height:  |  Size: 156 KiB

After

Width:  |  Height:  |  Size: 490 KiB

@@ -1,4 +1,7 @@
import { Controller, useForm } from "react-hook-form"; import { Controller, useForm } from "react-hook-form";
import Link from "next/link";
import { faArrowUpRightFromSquare, faBookOpen } from "@fortawesome/free-solid-svg-icons";
import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
import { zodResolver } from "@hookform/resolvers/zod"; import { zodResolver } from "@hookform/resolvers/zod";
import ms from "ms"; import ms from "ms";
import { z } from "zod"; import { z } from "zod";
@@ -160,6 +163,21 @@ export const LdapInputForm = ({
<div> <div>
<div className="mb-4 mt-4 border-b border-mineshaft-500 pb-2 pl-1 font-medium text-mineshaft-200"> <div className="mb-4 mt-4 border-b border-mineshaft-500 pb-2 pl-1 font-medium text-mineshaft-200">
Configuration Configuration
<Link
href="https://infisical.com/docs/documentation/platform/dynamic-secrets/ldap"
passHref
>
<a target="_blank" rel="noopener noreferrer">
<div className="ml-2 mb-1 inline-block cursor-default rounded-md bg-yellow/20 px-1.5 pb-[0.03rem] pt-[0.04rem] text-sm text-yellow opacity-80 hover:opacity-100">
<FontAwesomeIcon icon={faBookOpen} className="mr-1.5" />
Docs
<FontAwesomeIcon
icon={faArrowUpRightFromSquare}
className="ml-1.5 mb-[0.07rem] text-xxs"
/>
</div>
</a>
</Link>
</div> </div>
<div className="flex flex-col"> <div className="flex flex-col">
<div className="flex items-center space-x-2"> <div className="flex items-center space-x-2">
@@ -209,7 +209,7 @@ const renderOutputForm = (provider: DynamicSecretProviders, data: unknown) => {
value={PASSWORD} value={PASSWORD}
helperText="Important: Copy these credentials now. You will not be able to see them again after you close the modal." helperText="Important: Copy these credentials now. You will not be able to see them again after you close the modal."
/> />
<FormControl label={"DNs"} className="flex-grow"> <FormControl label="DNs" className="flex-grow">
<SecretInput <SecretInput
isReadOnly isReadOnly
isVisible isVisible