DocsKnowledge BaseAPI Explorer
Documentation›ZCF›ZStack Cloud›Explore more›CLI Command ManualZCF
Document navigation

AD/LDAP/OAuth

Overview

LDAP is a lightweight version of Directory Access Protocol (DAP) and provides a standard for directory services in a network. Many software, such as Microsoft Windows Active Directory (AD) and OpenLDAP provided in many popular Linux distributions, are all implementations of LDAP. They provide a set of independent and standard login authentication systems for increasingly diverse enterprise office applications.

ZStack Cloud allows you to seamlessly integrate with the AD/LDAP unified authentication service. You can add an AD/LDAP server based on custom rules and obtain the member information. If an AD/LDAP member (user or user group) is successfully attached to a ZStack Cloud account (ordinary account or admin account), the member can directly log in to ZStack Cloud by using the member attributes.

Inventory

Properties

Name Description Optional Valid Value Starting Version
uuid The UUID. For more information, see Resource Property. 0.6
accountUuid The account UUID. 0.6
ldapUid The LDAP UID. 0.6
ldapServerUuid The LDAP server UUID. 0.6
createDate The creation date. For more information, see Resource Property. 0.6
lastOpDate The last operation date. For more information, see Resource Property. 0.6

Sample

{
    "inventories": [],
    "success": true
}

Operations

AddLdapServer

Adds an AD/LDAP server. For example,
AddLdapServer name=ldap-server url=ldap://172.20.197.44:389 base="dc=mevoco,dc=com" \
encryption=TLS username="cn=Manager,dc=mevoco,dc=com" password=password description="ldapserver"

Parameters

Name Description Optional Valid Value Starting Version
name The resource UUID. 0.6
description The detailed description of the resource. 0.6
url The URL of the LDAP server. 0.6
base The base DN of the LDAP server. 0.6
username The username used to access the LDAP server. 0.6
password The password. 0.6
encryption The encryption method.
  • None
  • TLS
 0.6
userTags The user tags. For more information, see CreateUserTag. Yes 0.6
systemTags The system tags. For more information, see CreateSystemTag. Yes 0.6
timeout Yes
Note:
  • When you add an AD/LDAP server in ZStack Cloud, you can synchronize users by adding the virtualIDSyncConfiguration option to SystemTags.
    • Format of the virtualIDSyncConfiguration option: virtualIDSyncConfiguration::{\"rules\":[{\"name\":\"name\",\"attribute\":\"cn\",\"type\":\"SYSTEM\",\"optional\":\"true\"},{\"name\":\"fullname\",\"attribute\":\"cn\",\"type\":\"CUSTOM\",\"optional\":\"true\"}]}
    • Example: virtualIDSyncConfiguration::{\"rules\":[{\"name\":\"name\",\"attribute\":\"cn\",\"type\":\"SYSTEM\",\"optional\":\"true\"},{\"name\":\"fullname\",\"attribute\":\"cn\",\"type\":\"CUSTOM\",\"optional\":\"true\"}]}
  • When you add an AD/LDAP server in ZStack Cloud, you can synchronize organizations by adding the organizationSyncConfiguration option to SystemTags.
    • Format of the organizationSyncConfiguration option: organizationSyncConfiguration::{\"rules\":[{\"name\":\"name\",\"attribute\":\"distinguishedName\",\"type\":\"SYSTEM\",\"optional\":\"true\"},{\"name\":\"description\",\"attribute\":description,\"type\":\"SYSTEM\",\"optional\":\"true\"}],\"strategy\":\"Group\"}
    • Example: organizationSyncConfiguration::{\"rules\":[{\"name\":\"name\",\"attribute\":\"distinguishedName\",\"type\":\"SYSTEM\",\"optional\":\"true\"},{\"name\":\"description\",\"attribute\":description,\"type\":\"SYSTEM\",\"optional\":\"true\"}],\"strategy\":\"Group\"}
Note:
  • When you add AD/LDAP, the system will automatically check whether the server, port, base DN, login attribute, user DN, and password are correct. The waiting time does not exceed 5 seconds.

DeleteLdapServer

Deletes an AD/LDAP server. For example,
DeleteLdapServer uuid=b2750052c1e34b9c868c84e645eed79a

Parameters

Name Description Optional Valid Value Starting Version
uuid The resource UUID. 0.6
deleteMode The delete mode. For more information, see Delete Resources. Yes
  • Permissive
  • Enforcing
 0.6
userTags The user tags. For more information, see CreateUserTag. Yes 0.6
systemTags The system tags. For more information, see CreateSystemTag. Yes 0.6
timeout Yes

QueryLdapServer

Queries an AD/LDAP server. For example,
QueryLdapServer uuid=b2750052c1e34b9c868c84e645eed79a

Primitive Fields of Query

See LDAP Server Inventory.

UpdateLdapServer

Updates an AD/LDAP server. For example,
UpdateLdapServer ldapServerUuid=ba240fbba3e541b4ab9db4b221cc6e7a

Parameters

Name Description Optional Valid Value Starting Version
ldapServerUuid The LDAP server UUID. 0.6
name The resource name. Yes 0.6
description The detailed description of the resource. Yes 0.6
url The URL of the LDAP server. Yes 0.6
base The base DN of the LDAP server. Yes 0.6
username The username used to access the LDAP server. Yes 0.6
password The password. Yes 0.6
encryption The encryption method. Yes
  • None
  • TLS
userTags The user tags. For more information, see CreateUserTag. Yes 0.6
systemTags The system tags. For more information, see CreateSystemTag. Yes 0.6
timeout Yes

CreateLdapBinding

Creates an AD/LDAP binding. For example,
CreateLdapBinding ldapUid=mevoco accountUuid=2cfc587668474aa9ae544c014bfbd36e

Parameters

Name Description Optional Valid Value Starting Version
ldapUid The LDAP UID. 0.6
accountUuid The account UUID. 0.6
userTags The user tags. For more information, see CreateUserTag. Yes 0.6
systemTags The system tags. For more information, see CreateSystemTag. Yes 0.6
timeout Yes

DeleteLdapBinding

Deletes an AD/LDAP binding. For example,
DeleteLdapBinding uuid=d70c0ef1b57043beaffcfcf9b0216ac1

Parameters

Name Description Optional Valid Value Starting Version
uuid The resource UUID. 0.6
userTags The user tags. For more information, see CreateUserTag. Yes 0.6
systemTags The system tags. For more information, see CreateSystemTag. Yes 0.6
timeout Yes

QueryLdapBinding

Queries an AD/LDAP binding. For example,
QueryLdapBinding ldapUid=mevoco

Primitive Fields of Query

See LDAP Binding Inventory.

CleanInvalidLdapBinding

Clears an invalid AD/LDAP binding. Sample response:
{
    "success": true
}

Parameters

Name Description Optional Valid Value Starting Version
userTags The user tags. For more information, see CreateUserTag. Yes 0.6
systemTags The system tags. For more information, see CreateSystemTag. Yes 0.6
timeout Yes

LogInByLdap

Performs login by using an AD/LDAP identity. For example,
LogInByLdap uid=mevoco password=password

Parameters

Name Description Optional Valid Value Starting Version
uid The LDAP UID. 0.6
password The password. 0.6
captchaUuid The verification code UUID. Yes 2.6.0
verifyCode The verification code. Yes 2.6.0
clientInfo The client information. Yes 3.5.0
userTags The user tags. For more information, see CreateUserTag. Yes 0.6
systemTags The system tags. For more information, see CreateSystemTag. Yes 0.6
timeout Yes

GetLdapEntry

Obtains AD/LDAP entries. For example,
GetLdapEntry ldapFilter=(cn=mevoco)

Parameters

Name Description Optional Valid Value Starting Version
ldapFilter The query condition. 2.2
limit The maximum number of returned records. This parameter is similar to the limit field of MySQL. Yes 2.2
userTags The user tags. For more information, see CreateUserTag. Yes 2.2
systemTags The system tags. For more information, see CreateSystemTag. Yes 2.2
timeout Yes

GetCandidateLdapEntryForBinding

Obtains the candidate AD/LDAP entries for binding (excluding the bound AD/LDAP entries). For example,
GetCandidateLdapEntryForBinding ldapFilter=(cn=mevoco)

Parameters

Name Description Optional Valid Value Starting Version
ldapFilter The query condition. 2.2
limit The maximum number of returned records. This parameter is similar to the limit field of MySQL. Yes 2.2
userTags The user tags. For more information, see CreateUserTag. Yes 2.2
systemTags The system tags. For more information, see CreateSystemTag. Yes 2.2
timeout Yes

CreateOAuthClient

Create an OAuth client. For example, 
CreateOAuthClient name=test clientId=756770202fcd36bfbaa00ea7dea7f5ff tokenUrl=http://zstack.com/token loginType=oauth2-iam2 clientType=OAuth2 grantType=authorization_code

Parameters

Name Description Optional Valid Value Starting Version
name The resource name. 4.5.0
description The detailed information of the resource. Yes 4.5.0
clientId The client ID. 4.5.0
clientSecret The client key. Yes 4.5.0
authorizationUrl The authentication url. Yes 4.5.0
tokenUrl The authentication token url. 4.5.0
loginType The login type.
  • cas-iam1
  • cas-iam2
  • oauth2-iam1
  • oauth2-iam2
 4.5.0
clientType The client type. 4.5.0
grantType The authentication type. 4.5.0
urlTemplate The address jumped to after authentication. Yes 4.5.0
resourceUuid The resource UUID. Yes 4.5.0
tagUuids The tag UUID list. Yes 4.5.0
systemTags The system tags. For more information, see CreateSystemTag. Yes 4.5.0
userTags The user tags. For more information, see CreateUserTag. Yes 4.5.0
userinfoUrl The user information url. Yes 4.7.21
redirectUrl The redirect url. Yes 4.7.21
logoutUrl The logout url. Yes 4.7.21
scopeList The permission scope. Yes 5.1.8
identityProvider The identity provider. Yes 5.1.8
pluginUuid The plugin UUID. Yes 5.3.28

Tags

You can create a user tag on an LDAP server by using CreateUserTag resourceType=LdapServerVO. For example,
CreateUserTag resourceType=LdapServerVO tag=Test1 \
resourceUuid=3214e0dcd01d4e2aa8407968e1ccreatee51d58
PreviousAdvanced Monitoring Server (Observability Server)NextSNMP
CLI Command Manual | 5.4.12 | ZStack Cloud · ZCF | ZStack Resource Center