Authentication API
Operational Insights supports authentication via local and external domains.
Authenticating Locally and Externally
Users may be given an identity locally on a cluster. This allows their credentials to be maintained and updated on the local cluster. A password policy is enforced for the cluster: the defaults for this policy can be modified. A local user can change their own password.
Enterprises frequently centralize directory services, allowing all user-authentication to be handled by a single server or server-group. LDAP is frequently used in support of such centralization. The authentication handled in this way is therefore external to Operational Insights.
Operational Insights supports external authentication. Users are registered as external, for authentication purposes. When such users pass their credentials to Operational Insights, Operational Insights recognizes the user as external, and duly passes the credentials to the external authentication facility: if the authentication succeeds there, Operational Insights is informed, and the user is given appropriate access, based on the roles and privileges on Operational Insights that they have been assigned.
The password policy, and how to change it, is described in Set Password Policy. For further information about local and external domains, see Authentication.
LDAP Groups
LDAP supports groups, of which multiple users can be members. Operational Insights supports the association of LDAP groups with Operational Insights groups: a user successfully authenticated on an LDAP server may have their LDAP group information duly returned to Operational Insights. If Operational Insights has configured an association between one or more of the user’s LDAP groups and corresponding groups defined on Operational Insights, the user is assigned the roles and privileges for the corresponding Operational Insights groups.
Configuration Options
Operational Insights provides a recommended REST method for simple and expedited configuration of LDAP-based authentication. This is described in Configure LDAP.
Alternatively, a legacy REST API for establishing SASL administrator credentials can be used. Note that this requires prior, manual set-up of saslauthd for the cluster: see Configure saslauthd.
APIs in this section
A complete list of APIs described in this section is provided in the table below.
Authentication
| HTTP Method | URI | Documented at |
|---|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|