mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
misc: updated docs
This commit is contained in:
Sheen Capadngan
@@ -10,143 +10,253 @@ The Infisical LDAP dynamic secret allows you to generate user credentials on dem
|
|||||||
1. Create a user with the necessary permissions to create users in your LDAP server.
|
1. Create a user with the necessary permissions to create users in your LDAP server.
|
||||||
2. Ensure your LDAP server is reachable via Infisical instance.
|
2. Ensure your LDAP server is reachable via Infisical instance.
|
||||||
|
|
||||||
## Set up Dynamic Secrets with LDAP
|
## Create LDAP Credentials
|
||||||
|
|
||||||
<Steps>
|
<Tabs>
|
||||||
<Step title="Open Secret Overview Dashboard">
|
<Tab title="Dynamic">
|
||||||
Open the Secret Overview dashboard and select the environment in which you would like to add a dynamic secret.
|
<Steps>
|
||||||
</Step>
|
<Step title="Open Secret Overview Dashboard">
|
||||||
<Step title="Click on the 'Add Dynamic Secret' button">
|
Open the Secret Overview dashboard and select the environment in which you would like to add a dynamic secret.
|
||||||
|
</Step>
|
||||||
</Step>
|
<Step title="Click on the 'Add Dynamic Secret' button">
|
||||||
<Step title="Select 'LDAP'">
|
|
||||||
|
</Step>
|
||||||
</Step>
|
<Step title="Select 'LDAP'">
|
||||||
|
|
||||||
|
</Step>
|
||||||
|
|
||||||
<Step title="Provide the inputs for dynamic secret parameters">
|
<Step title="Provide the inputs for dynamic secret parameters">
|
||||||
<ParamField path="Secret Name" type="string" required>
|
<ParamField path="Secret Name" type="string" required>
|
||||||
Name by which you want the secret to be referenced
|
Name by which you want the secret to be referenced
|
||||||
</ParamField>
|
</ParamField>
|
||||||
|
|
||||||
<ParamField path="Default TTL" type="string" required>
|
<ParamField path="Default TTL" type="string" required>
|
||||||
Default time-to-live for a generated secret (it is possible to modify this value when a secret is generate)
|
Default time-to-live for a generated secret (it is possible to modify this value when a secret is generate)
|
||||||
</ParamField>
|
</ParamField>
|
||||||
|
|
||||||
<ParamField path="Max TTL" type="string" required>
|
<ParamField path="Max TTL" type="string" required>
|
||||||
Maximum time-to-live for a generated secret.
|
Maximum time-to-live for a generated secret.
|
||||||
</ParamField>
|
</ParamField>
|
||||||
|
|
||||||
<ParamField path="URL" type="string" required>
|
<ParamField path="URL" type="string" required>
|
||||||
LDAP url to connect to. _(Example: ldap://your-ldap-ip:389 or ldaps://domain:636)_
|
LDAP url to connect to. _(Example: ldap://your-ldap-ip:389 or ldaps://domain:636)_
|
||||||
</ParamField>
|
</ParamField>
|
||||||
|
|
||||||
<ParamField path="BIND DN" type="string" required>
|
<ParamField path="BIND DN" type="string" required>
|
||||||
DN to bind to. This should have permissions to create a new users.
|
DN to bind to. This should have permissions to create a new users.
|
||||||
</ParamField>
|
</ParamField>
|
||||||
|
|
||||||
<ParamField path="BIND Password" type="string" required>
|
<ParamField path="BIND Password" type="string" required>
|
||||||
Password for the given DN.
|
Password for the given DN.
|
||||||
</ParamField>
|
</ParamField>
|
||||||
|
|
||||||
<ParamField path="CA" type="text">
|
<ParamField path="CA" type="text">
|
||||||
CA certificate to use for TLS in case of a secure connection.
|
CA certificate to use for TLS in case of a secure connection.
|
||||||
</ParamField>
|
</ParamField>
|
||||||
|
|
||||||
<ParamField path="Creation LDIF" type="text" required>
|
<ParamField path="Credential Type" type="enum">
|
||||||
LDIF to run while creating a user in LDAP. This can include extra steps to assign the user to groups or set permissions.
|
The type of LDAP credential - select Dynamic.
|
||||||
Here `{{Username}}`, `{{Password}}` and `{{EncodedPassword}}` are templatized variables for the username and password generated by the dynamic secret.
|
</ParamField>
|
||||||
|
|
||||||
`{{EncodedPassword}}` is the encoded password required for the `unicodePwd` field in Active Directory as described [here](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/change-windows-active-directory-user-password).
|
<ParamField path="Creation LDIF" type="text" required>
|
||||||
|
LDIF to run while creating a user in LDAP. This can include extra steps to assign the user to groups or set permissions.
|
||||||
|
Here `{{Username}}`, `{{Password}}` and `{{EncodedPassword}}` are templatized variables for the username and password generated by the dynamic secret.
|
||||||
|
|
||||||
**OpenLDAP** Example:
|
`{{EncodedPassword}}` is the encoded password required for the `unicodePwd` field in Active Directory as described [here](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/change-windows-active-directory-user-password).
|
||||||
```
|
|
||||||
dn: uid={{Username}},dc=infisical,dc=com
|
|
||||||
changetype: add
|
|
||||||
objectClass: top
|
|
||||||
objectClass: person
|
|
||||||
objectClass: organizationalPerson
|
|
||||||
objectClass: inetOrgPerson
|
|
||||||
cn: John Doe
|
|
||||||
sn: Doe
|
|
||||||
uid: jdoe
|
|
||||||
mail: jdoe@infisical.com
|
|
||||||
userPassword: {{Password}}
|
|
||||||
```
|
|
||||||
|
|
||||||
**Active Directory** Example:
|
**OpenLDAP** Example:
|
||||||
```
|
```
|
||||||
dn: CN={{Username}},OU=Test Create,DC=infisical,DC=com
|
dn: uid={{Username}},dc=infisical,dc=com
|
||||||
changetype: add
|
changetype: add
|
||||||
objectClass: top
|
objectClass: top
|
||||||
objectClass: person
|
objectClass: person
|
||||||
objectClass: organizationalPerson
|
objectClass: organizationalPerson
|
||||||
objectClass: user
|
objectClass: inetOrgPerson
|
||||||
userPrincipalName: {{Username}}@infisical.com
|
cn: John Doe
|
||||||
sAMAccountName: {{Username}}
|
sn: Doe
|
||||||
unicodePwd::{{EncodedPassword}}
|
uid: jdoe
|
||||||
userAccountControl: 66048
|
mail: jdoe@infisical.com
|
||||||
|
userPassword: {{Password}}
|
||||||
|
```
|
||||||
|
|
||||||
dn: CN=test-group,OU=Test Create,DC=infisical,DC=com
|
**Active Directory** Example:
|
||||||
changetype: modify
|
```
|
||||||
add: member
|
dn: CN={{Username}},OU=Test Create,DC=infisical,DC=com
|
||||||
member: CN={{Username}},OU=Test Create,DC=infisical,DC=com
|
changetype: add
|
||||||
-
|
objectClass: top
|
||||||
```
|
objectClass: person
|
||||||
</ParamField>
|
objectClass: organizationalPerson
|
||||||
|
objectClass: user
|
||||||
|
userPrincipalName: {{Username}}@infisical.com
|
||||||
|
sAMAccountName: {{Username}}
|
||||||
|
unicodePwd::{{EncodedPassword}}
|
||||||
|
userAccountControl: 66048
|
||||||
|
|
||||||
<ParamField path="Revocation LDIF" type="text" required>
|
dn: CN=test-group,OU=Test Create,DC=infisical,DC=com
|
||||||
LDIF to run while revoking a user in LDAP. This can include extra steps to remove the user from groups or set permissions.
|
changetype: modify
|
||||||
Here `{{Username}}` is a templatized variable for the username generated by the dynamic secret.
|
add: member
|
||||||
|
member: CN={{Username}},OU=Test Create,DC=infisical,DC=com
|
||||||
|
-
|
||||||
|
```
|
||||||
|
</ParamField>
|
||||||
|
|
||||||
**OpenLDAP / Active Directory** Example:
|
<ParamField path="Revocation LDIF" type="text" required>
|
||||||
```
|
LDIF to run while revoking a user in LDAP. This can include extra steps to remove the user from groups or set permissions.
|
||||||
dn: CN={{Username}},OU=Test Create,DC=infisical,DC=com
|
Here `{{Username}}` is a templatized variable for the username generated by the dynamic secret.
|
||||||
changetype: delete
|
|
||||||
```
|
|
||||||
</ParamField>
|
|
||||||
|
|
||||||
<ParamField path="Rollback LDIF" type="text">
|
**OpenLDAP / Active Directory** Example:
|
||||||
LDIF to run incase Creation LDIF fails midway.
|
```
|
||||||
|
dn: CN={{Username}},OU=Test Create,DC=infisical,DC=com
|
||||||
|
changetype: delete
|
||||||
|
```
|
||||||
|
</ParamField>
|
||||||
|
|
||||||
For the creation example shown above, if the user is created successfully but not added to a group, this LDIF can be used to remove the user.
|
<ParamField path="Rollback LDIF" type="text">
|
||||||
Here `{{Username}}`, `{{Password}}` and `{{EncodedPassword}}` are templatized variables for the username generated by the dynamic secret.
|
LDIF to run incase Creation LDIF fails midway.
|
||||||
|
|
||||||
**OpenLDAP / Active Directory** Example:
|
For the creation example shown above, if the user is created successfully but not added to a group, this LDIF can be used to remove the user.
|
||||||
```
|
Here `{{Username}}`, `{{Password}}` and `{{EncodedPassword}}` are templatized variables for the username generated by the dynamic secret.
|
||||||
dn: CN={{Username}},OU=Test Create,DC=infisical,DC=com
|
|
||||||
changetype: delete
|
|
||||||
```
|
|
||||||
</ParamField>
|
|
||||||
|
|
||||||
</Step>
|
**OpenLDAP / Active Directory** Example:
|
||||||
|
```
|
||||||
|
dn: CN={{Username}},OU=Test Create,DC=infisical,DC=com
|
||||||
|
changetype: delete
|
||||||
|
```
|
||||||
|
</ParamField>
|
||||||
|
</Step>
|
||||||
|
|
||||||
<Step title="Click `Submit`">
|
<Step title="Click `Submit`">
|
||||||
After submitting the form, you will see a dynamic secret created in the dashboard.
|
After submitting the form, you will see a dynamic secret created in the dashboard.
|
||||||
</Step>
|
</Step>
|
||||||
<Step title="Generate dynamic secrets">
|
<Step title="Generate dynamic secrets">
|
||||||
Once you've successfully configured the dynamic secret, you're ready to generate on-demand credentials.
|
Once you've successfully configured the dynamic secret, you're ready to generate on-demand credentials.
|
||||||
To do this, simply click on the 'Generate' button which appears when hovering over the dynamic secret item.
|
To do this, simply click on the 'Generate' button which appears when hovering over the dynamic secret item.
|
||||||
Alternatively, you can initiate the creation of a new lease by selecting 'New Lease' from the dynamic secret lease list section.
|
Alternatively, you can initiate the creation of a new lease by selecting 'New Lease' from the dynamic secret lease list section.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
When generating these secrets, it's important to specify a Time-to-Live (TTL) duration. This will dictate how long the credentials are valid for.
|
When generating these secrets, it's important to specify a Time-to-Live (TTL) duration. This will dictate how long the credentials are valid for.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<Tip>
|
<Tip>
|
||||||
Ensure that the TTL for the lease fall within the maximum TTL defined when configuring the dynamic secret.
|
Ensure that the TTL for the lease fall within the maximum TTL defined when configuring the dynamic secret.
|
||||||
</Tip>
|
</Tip>
|
||||||
|
|
||||||
|
|
||||||
Once you click the `Submit` button, a new secret lease will be generated and the credentials from it will be shown to you with an array of DN's altered depending on the Creation LDIF.
|
Once you click the `Submit` button, a new secret lease will be generated and the credentials from it will be shown to you with an array of DN's altered depending on the Creation LDIF.
|
||||||
|
|
||||||
|
|
||||||
|
</Step>
|
||||||
|
|
||||||
</Step>
|
</Steps>
|
||||||
|
|
||||||
</Steps>
|
</Tab>
|
||||||
|
<Tab title="Static">
|
||||||
|
<Steps>
|
||||||
|
<Step title="Open Secret Overview Dashboard">
|
||||||
|
Open the Secret Overview dashboard and select the environment in which you would like to add a dynamic secret.
|
||||||
|
</Step>
|
||||||
|
<Step title="Click on the 'Add Dynamic Secret' button">
|
||||||
|
|
||||||
|
</Step>
|
||||||
|
<Step title="Select 'LDAP'">
|
||||||
|
|
||||||
|
</Step>
|
||||||
|
|
||||||
|
<Step title="Provide the inputs for dynamic secret parameters">
|
||||||
|
<ParamField path="Secret Name" type="string" required>
|
||||||
|
Name by which you want the secret to be referenced
|
||||||
|
</ParamField>
|
||||||
|
|
||||||
|
<ParamField path="Default TTL" type="string" required>
|
||||||
|
Default time-to-live for a generated secret (it is possible to modify this value when a secret is generate)
|
||||||
|
</ParamField>
|
||||||
|
|
||||||
|
<ParamField path="Max TTL" type="string" required>
|
||||||
|
Maximum time-to-live for a generated secret.
|
||||||
|
</ParamField>
|
||||||
|
|
||||||
|
<ParamField path="URL" type="string" required>
|
||||||
|
LDAP url to connect to. _(Example: ldap://your-ldap-ip:389 or ldaps://domain:636)_
|
||||||
|
</ParamField>
|
||||||
|
|
||||||
|
<ParamField path="BIND DN" type="string" required>
|
||||||
|
DN to bind to. This should have permissions to create a new users.
|
||||||
|
</ParamField>
|
||||||
|
|
||||||
|
<ParamField path="BIND Password" type="string" required>
|
||||||
|
Password for the given DN.
|
||||||
|
</ParamField>
|
||||||
|
|
||||||
|
<ParamField path="CA" type="text">
|
||||||
|
CA certificate to use for TLS in case of a secure connection.
|
||||||
|
</ParamField>
|
||||||
|
|
||||||
|
<ParamField path="Credential Type" type="enum">
|
||||||
|
The type of LDAP credential - select Static.
|
||||||
|
</ParamField>
|
||||||
|
|
||||||
|
<ParamField path="Rotation LDIF" type="text" required>
|
||||||
|
LDIF to run for rotating the credentals of an LDAP user. This can include extra LDAP steps based on your needs.
|
||||||
|
Here `{{Password}}` and `{{EncodedPassword}}` are templatized variables for the password generated by the dynamic secret.
|
||||||
|
|
||||||
|
Note that the `-` characters and the empty lines found at the end of the examples are necessary based on the LDIF format.
|
||||||
|
|
||||||
|
**OpenLDAP** Example:
|
||||||
|
```
|
||||||
|
dn: cn=sheencaps capadngan,ou=people,dc=acme,dc=com
|
||||||
|
changetype: modify
|
||||||
|
replace: userPassword
|
||||||
|
password: {{Password}}
|
||||||
|
-
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
**Active Directory** Example:
|
||||||
|
```
|
||||||
|
dn: cn=sheencaps capadngan,ou=people,dc=acme,dc=com
|
||||||
|
changetype: modify
|
||||||
|
replace: unicodePwd
|
||||||
|
unicodePwd::{{EncodedPassword}}
|
||||||
|
-
|
||||||
|
|
||||||
|
```
|
||||||
|
`{{EncodedPassword}}` is the encoded password required for the `unicodePwd` field in Active Directory as described [here](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/change-windows-active-directory-user-password).
|
||||||
|
|
||||||
|
</ParamField>
|
||||||
|
</Step>
|
||||||
|
|
||||||
|
<Step title="Click `Submit`">
|
||||||
|
After submitting the form, you will see a dynamic secret created in the dashboard.
|
||||||
|
</Step>
|
||||||
|
<Step title="Generate dynamic secrets">
|
||||||
|
Once you've successfully configured the dynamic secret, you're ready to generate on-demand credentials.
|
||||||
|
To do this, simply click on the 'Generate' button which appears when hovering over the dynamic secret item.
|
||||||
|
Alternatively, you can initiate the creation of a new lease by selecting 'New Lease' from the dynamic secret lease list section.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
When generating these secrets, it's important to specify a Time-to-Live (TTL) duration. This will dictate how long the credentials are valid for.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<Tip>
|
||||||
|
Ensure that the TTL for the lease fall within the maximum TTL defined when configuring the dynamic secret.
|
||||||
|
</Tip>
|
||||||
|
|
||||||
|
|
||||||
|
Once you click the `Submit` button, a new secret lease will be generated and the credentials from it will be shown to you with an array of DN's altered depending on the Creation LDIF.
|
||||||
|
|
||||||
|
|
||||||
|
</Step>
|
||||||
|
|
||||||
|
</Steps>
|
||||||
|
|
||||||
|
</Tab>
|
||||||
|
</Tabs>
|
||||||
|
|
||||||
## Active Directory Integration
|
## Active Directory Integration
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user