API Connect

API Connect

Join this online group to communicate across IBM product users and experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#API Connect
#Applicationintegration
#APIConnect
 View Only

  • 1.  LDAP issue while Integration with API Manager

    Posted 08/21/23 03:10 AM
    Edited by Anusha Pudari 08/21/23 03:11 AM

    Hi All,

    We are configured LDAP in cloud-admin. Our LDAP Team created service group in that they created one group in that they added some users. 

    1.Given title LDAP IP and PORT.

    2.Authentication method Search DN, used Authentication bind

    3.Given all required things and we are tried test configuration i given user and password that user is in group it showed -->Test Configuration Successful.

    we are enabled User group authentication--> static group given group DN prefix and suffix

    when hitting test configuration i given same user and password it showing -->test Configuration failed(An internal error failed.

    I am uploading screenshots about configuration. Kindly check and provide a solution ASAP.



    ------------------------------
    Anusha Pudari
    ------------------------------



  • 2.  RE: LDAP issue while Integration with API Manager

    Posted 08/22/23 09:57 AM

    With that check box you still need to configure the LDAP Group mapping. If this has not been done it may be the cause of your error.

     https://www.ibm.com/docs/en/api-connect/10.0.x?topic=aua-configuring-ldap-group-mappings-api-manager-user-roles



    ------------------------------
    Dan Temkin
    Product Management - IBM API Connect
    ------------------------------



  • 3.  RE: LDAP issue while Integration with API Manager

    Posted 08/22/23 01:49 PM

    Looks like the group prefix and suffix might be wrong.
    It should be that of the group field in the user entry.

    Eg: 

    group_authentication_method: 'static',
    static_group_dn: 'CN=Users,DC=apim,DC=ibm,DC=com',
    static_group_filter_prefix: '(&(member=',
    static_group_filter_suffix: ')(cn=apimsvt))',


    ------------------------------
    Nisha Narayanan
    ------------------------------



  • 4.  RE: LDAP issue while Integration with API Manager

    Posted 08/25/23 03:17 AM

    Hi Nisha,

    From your last reply we added sufix and prefix -->we got test configuration successful.I added users in LDAP and assigned roles, but some user ID's with numbers like 5781, 8744 while adding users id's it showing users are not in user registry,but this users are in group. some users ID's like V222PRONT it adding successfully.Is there any other suffix and prefix types to add numerical id's in to LDAP.Kindly suggest a solution for the above mentioned issue.



    ------------------------------
    Anusha Pudari
    ------------------------------

    Original Message


  • 5.  RE: LDAP issue while Integration with API Manager

    Posted 08/28/23 02:34 PM

    Anusha,

    Glad that part worked.

    When you say adding users, do you mean when they login? Can you please add the exact steps you followed?

    As for the configuration, more detailed info can be found here: 
    https://www.ibm.com/docs/en/api-connect/10.0.x?topic=aua-configuring-ldap-group-mappings-api-manager-user-roles

    Note that you will need to enable the setting on user registry + configure registry for login for that context (admin vs provider). In addition, you will need to map the roles you want users to have to the correct LDAP groups. 

    The LDAP filters you use for mapping the roles in APIM must be valid across all the users you want to assign to that role. For example: 

    external_group_mapping:
      user_registry_url: https://server.com/api/user-registries/3d58ce7e-16a8-493b-9684-xxxxxx/35e75bad-1d89-4a65-a70f-xxxxxx
      ldap_groups:
        - 'cn=apic-administrators,ou=ibmgroups,o=ibm.com'
        - 'cn=apic-developers,ou=ibmgroups,o=ibm.com'
      user_group_filter_prefix: (&(uniquemember=
      user_group_filter_suffix: )(objectClass=groupOfUniqueNames))

    You can verify that by opening the user record in LDAP and making sure they have the correct group memberships and group attributes. 



    ------------------------------
    Nisha Narayanan
    ------------------------------

    Original Message


  • 6.  RE: LDAP issue while Integration with API Manager

    Posted 01/24/24 02:16 PM

    Hi Nisha,

    I use Active Directory on Windows 2016. The LDAP registry test works without using group authentication. If I enabled it and use Static group, I got unauthorized error even used your suggestion. Any more tip?

    user DN: CN=frank,CN=Users,DC=demo,DC=com

    group DN: CN=API_MANAGER_GROUP,CN=Users,DC=demo,DC=com

    Group Based DN --> CN=Users,DC=demo,DC=com

    Prefix --> (&(member=

    Suffix --> )(CN=API_MANAGER_GROUP))

    Thanks a lot in advance

    Frank



    ------------------------------
    Frank Ning
    Technical consultant - solution architect
    Toronto ON
    ------------------------------

    Original Message


  • 7.  RE: LDAP issue while Integration with API Manager

    Posted 01/24/24 06:24 PM

    Sorry, it works now. Just realized that I have to put in the password of the query user each time when I do the "test configuration"



    ------------------------------
    Frank Ning
    Technical consultant - solution architect
    Toronto ON
    ------------------------------

    Original Message


Related Content