Configure external identity providers

Overview

API Manager provides sample external identity providers for Local Directory Access Protocol (LDAP) based on Apache Directory and Microsoft Active Directory. This chapter explains how to configure these sample providers using the Policy Studio and API Manager tools.

Sample configuration

The following sample external identity provider configuration is available in the Policy Studio tree:

• LDAP authentication and account retrieval policies in Policies > Sample Policies > API Management Identity Provider > LDAP
• Active Directory authentication and account retrieval policies in Policies >Sample Policies > API Management Identity Provider > Active Directory
• Common account creation success and failure policies in Policies > Sample Policies > API Management Identity Provider
• Sample LDAP repositories in External Connections > Authentication Repositories > LDAP Repositories
• Sample LDAP Connections in External Connections > LDAP Connections

Configure an Apache Directory LDAP external identity provider

This section explains how to configure an Apache Directory LDAP external identity provider.

Prerequisites

The sample LDAP configuration assumes that an Apache Directory LDAP server is running locally (on localhost:10389), and configured with a sample partition (Seven Seas). This sample partition is available from:

http://directory.apache.org/apacheds/basic-ug/1.4.3-adding-partition.html

When the partition has been configured, you must import the sample LDAP Data Interchange Format (LDIF) data to populate the directory with users. The sample LDIF data is available from:

http://directory.apache.org/apacheds/basic-ug/1.5-sample-configuration.html#the-sample-data-sailors-of-the-seven-seas

Note

All user passwords are set to pass.

For more details, see the Apache Directory Studio User Guide.

Configuration steps

To set up LDAP as an external identity provider, perform the following steps:

1. In the Policy Studio tree, select Server Settings > API Manager > Identity Provider > Use external identity provider.
2. Ensure that the sample LDAP account policies are configured. These policies are selected by default. For example:
3. 
3. Click Apply Changes at the bottom right.
4. Optionally, if the community organization is not named Community, or if you wish to on-board users to a specific organization, edit the Set.extidentity.organization filter in the Read LDAP Account Information policy. For example:
5. 
5. Enter the appropriate value in the Organization selector field (for example, Community).  
6. Click Deploy in the toolbar to deploy the updated configuration.
7. Connect to API Manager in your browser:
8. https://localhost:8075/
8. On-board a user from the Apache Directory LDAP server by logging in with the appropriate user credentials (for example, the wbligh user).
9. Select Settings > Account to view the on-boarded account details. For example:
10. 

Note

The Login name for an external user (provisioned by an external identity provider) is read-only and cannot be changed.

Configure an Active Directory external identity provider

This section explains how to configure a Microsoft Active Directory external identity provider.

To set up Active Directory as an external identity provider, perform the following steps:

1. In the Policy Studio tree, select Server Settings >API Manager > Identity Provider > Use external identity provider.
2. Ensure that the sample Active Directory account policies are configured. For example:
3. 
3. Click Apply Changes at the bottom right.
4. In the Policy Studio tree, select External Connections >LDAP Connections > API Management Sample Active Directory Connection.
5. Right-click, select Edit, and enter the following settings:
   • URL: Enter the URL for your LDAP server (for example, ldap://127.0.0.1:389).
   • User Name: Enter the distinguished name of the user to connect to the Active Directory (for example, CN=Joe Bloggs,OU=DUBL,OU=IE,OU=Employees,DC=company,DC=com).

   Note

   This user must have Read MemberOf (search) privileges.

   • Password: Enter the user password.
   • 
6. Click Test Connection to verify that the configuration details are correct.
7. Select External Connections >Authentication Repositories > LDAP Repositories >API Management Sample Active Directory Repository.
8. Right-click, select Edit Repository, and enter the Base Criteria (for example, OU=Employees,DC=company,DC=com). This is the starting point in the Active Directory hierarchy at which the search for users will begin.
9. Optionally, if the community organization is not named Community, or if you wish to on-board users to a specific organization, edit the Set.extidentity.organization filter in the Read Active Directory Account Information policy.
10. Enter the appropriate value in the Organization selector field (for example, Community).  
11. Click Deploy in the toolbar to deploy the updated configuration.  
12. Connect to API Manager in your browser:
13. https://localhost:8075/
13. On-board a user from the Active Directory server by logging in with the appropriate user credentials (for example, a jbloggs user).
14. Select Settings > Account to view the on-boarded account details. For example:
15. 

Note

The Login name for an external user (provisioned by an external identity provider) is read-only and cannot be changed.

Account information policy

You can configure the Account information policy in Policy Studio in Server Settings > API Manager > Identity Provider. This policy returns the user information to API Manager using the following attributes:

Attribute	Description
extidentity.organization.id	The organization ID (required).
extidentity.role	The user’s role (required). This is one of the following: user: Client appplication developer oadmin: Organization administrator admin: API administrator
extidentity.enabled	User is enabled only if the selector evaluates to 1 or true.
extidentity.name	The user’s name (required).
extidentity.description	A description of the user.
extidentity.email	The user’s email address.
extidentity.phone	The user’s phone number.

 

Further information

For more details, see Configure API management settings in Policy Studio.

For details on how to create custom policies, see the API Gateway Policy Developer Guide.