簡介
本文說明如何將單一登入(SSO)設定為安全網路分析管理員上的空白/預設值。
必要條件
需求
本文件沒有特定需求。
採用元件
本檔案中的資訊是根據Secure Network Analytics Manager (SMC) 7.1版及更新版本。
本文建議使用具有複製和貼上功能的SSH客戶端/應用程式。
本文中的資訊是根據特定實驗室環境內的裝置所建立。文中使用到的所有裝置皆從已清除（預設）的組態來啟動。如果您的網路運作中，請確保您瞭解任何指令可能造成的影響。
問題
配置的SSO設定無效或過時，或者儲存無效或過時的SSO配置後，中央管理顯示Configuration Changes Failed
解決方案
SSO配置分為兩個部分，即集中管理和聯合管理器。
如果需要比較原始配置和最終配置，請執行所有列出的步驟。
如果不需要比較，則僅執行未標籤為（可選）的命令。 本文末尾的「單行」命令為您執行這些步驟。
步驟1. （可選）如果要將當前中央管理配置與最終結果進行比較，請運行 jq '.configurableElements.sso' /lancope/var/services/cm/configuration/$(awk -F\" '{print $8}' /lancope/var/services/cm-agent/configuration/managementChannel.json)/config.json > jqdoldcm.json命令。
741smc:~# jq '.configurableElements.sso' /lancope/var/services/cm/configuration/$(awk -F\" '{print $8}' /lancope/var/services/cm-agent/configuration/managementChannel.json)/config.json > jqdoldcm.json
741smc:~#
第2步：（可選）如果要將當前配置與最終結果進行比較，請運行jq . /lancope/var/fedlet-manager/conf/fedlet-manager.json > jqdoldfm.json命令。
741smc:~# jq . /lancope/var/fedlet-manager/conf/fedlet-manager.json > jqdoldfm.json
741smc:~#
步驟 3.使用tmpfile=$(mktemp) 命令建立一個臨時變數。
741smc:~# tmpfile=$(mktemp)
741smc:~#
步驟 4.使用cm_file=$(echo /lancope/var/services/cm/configuration/$(awk -F\" '{print $8}' /lancope/var/services/cm-agent/configuration/managementChannel.json)/config.json)命令建立一個臨時變數。
741smc:~# cm_file=$(echo /lancope/var/services/cm/configuration/$(awk -F\" '{print $8}' /lancope/var/services/cm-agent/configuration/managementChannel.json)/config.json)
741smc:~#
步驟 5.使用echo $SWINFO_version命令確定您當前的安全網路分析版本。
741smc:~# echo $SWINFO_version
7.4.1
如果SMC版本是7.4.1，請運行以下命令：
741smc:~# cp $cm_file $tmpfile && jq --arg foo "" --argjson bar false '.configurableElements.sso.ssoEnabled = $bar|.configurableElements.sso.ssoDescription = $foo|.configurableElements.sso.idpXml = $foo|.configurableElements.sso.ssoProxy = $foo|.configurableElements.sso.ssoOnly = $bar|.configurableElements.sso.downloadIdpXml = $bar' "$tmpfile" > $cm_file && rm -f -- $tmpfile
741smc:~# cp /lancope/var/fedlet-manager/conf/fedlet-manager.json $tmpfile && jq --arg foo "" --argjson bar false '.ssoEnabled = $bar|.ssoDescription = $foo|.idpXml = $foo|.ssoProxy = $foo|.state = "NO_CONFIGURATION"|.message="Single Sign-On is not configured."' $tmpfile >/lancope/var/fedlet-manager/conf/fedlet-manager.json && rm -f -- $tmpfile
741smc:~#
如果SMC版本早於7.4.1，請運行以下命令：
711smc:~# cp $cm_file $tmpfile && jq --arg foo "" --argjson bar false '.configurableElements.sso.ssoEnabled = $bar|.configurableElements.sso.ssoDescription = $foo|.configurableElements.sso.idpXml = $foo|.configurableElements.sso.ssoOnly = $bar|.configurableElements.sso.downloadIdpXml = $bar' "$tmpfile" > $cm_file && rm -f -- $tmpfile
711smc:~# cp /lancope/var/fedlet-manager/conf/fedlet-manager.json $tmpfile && jq --arg foo "" --argjson bar false '.ssoEnabled = $bar|.ssoDescription = $foo|.idpXml = $foo|.state = "NO_CONFIGURATION"|.message="Single Sign-On is not configured."' $tmpfile >/lancope/var/fedlet-manager/conf/fedlet-manager.json && rm -f -- $tmpfile
711smc:~#
步驟6. （可選）如果要將最終結果配置與原始配置進行比較，請運行以下命令：
741smc:~# jq '.configurableElements.sso' $cm_file > jqdnewcm.json
741smc:~# jq . /lancope/var/fedlet-manager/conf/fedlet-manager.json > jqdnewfm.json
741smc:~# diff -y jqdoldcm.json jqdnewcm.json
741smc:~# diff -y jqdoldfm.json jqdnewfm.json
步驟7. （可選）刪除在最後一個步驟中作為此比較過程一部分建立的json檔案。
741smc:~# rm -f jqdoldcm.json jqdnewcm.json
741smc:~# rm -f jqdoldfm.json jqdnewfm.json
步驟 8.取消設定在此文檔開始時建立的變數。
711smc:~# unset tmpfile
711smc:~# unset cm_file
711smc:~#
使用docker central-management命令重新啟動中央管理進程。
741smc:~# docker restart svc-central-management
svc-central-management
741smc:~#
單線自動
運行此命令以執行本文中介紹的所有步驟。輸出包含一些附加格式。
bash <(base64 -d <<< "H4sIALoa7mQAA+1WbW/aMBD+vl9xiqLSTk1Qt06bhKg00VLxoWQq7TapVJXrXGhKYqe2gaGx/75zAuG19GVfpmkSQfjx+V4eP+EO+Z0ED8Hpiq7oGNZDOAAPWiI28JWpmN0mqIGJEE6ZuUMFzZiArjhj/Vj0wGCaQUQQ+L4PDtRMmtll3d1N+3ZzD2o8vZlCaINVEya4zLA6ZKqqUQ1jjrrK0yqXIop7A8VMLEXV3WWjPnjNrgOVn5mKhQH306/Ko8c9Sl2YFScpEwSntNG4Y0Jg4t9rKfamVsUCajpBzMD/ADUs2TDHUmBXnKIxtk4+UIq8QIO+FEvgrHQM2jCDVPn9A1T8MjzRdpLkBtrXWlbAndIAR3D/EMok5Gke/0XhmxgmaKBjQ1rfRVh/mZQoN/KK2lVe6wpWBJ4lEj0jkbkyuEwzcoVzvbwj9EyGcTTOU128ABLKZRayvIYN1FlZTUsqUAWNxeNUXhzB1RW4nW+tdjO4GaLShEO9Dh/9Q//gLUwma5tHxR5cX0MNSLMCeDan350qFHZ2qH7wPKZ6EEkJjlMsci5umYKIJRq33Kl9ToRFQ6iDS0cmW22PUXMVZyYvAFyKucU+DrPvafK0HT1flPwxfpZlIJLx06mGciQSycJWmQLZV8CZMecQwyWdxKJKwYuIuyVqifJXifLl17PhFh4he4XTNeryN5lWTju4aQTtZuv08vzzRStoOxM/Ra0py7rTIS1Tep24J7xAQKxBSFOqHkPfqcyLOHoVBxs5rQHaev9tKf8X6JJA/249RvELm57AUdn0/rBtkavnty3boBprbev9FGWKwOJH3qbO1lpYWxrcp05C3I4kta1Eyj71rjFQz4swb8wDQVORhk4ngBGjeYmbAUtIy/N7gEzhMJYDTahUhTf63CrZR8opSEIbumh/MIE2jmZr6oI2EHjjlclhhdJNPCwUtjo76CLoKjyNvWHSWE4iWkqivIwy9DLJy9QfEnopNPkfzkbMfQjRGuUTpVRMjfOxknA7JCikd0HRrDWd9yibQpFbCVk0eSTdQZ5FqeliORNtUYxzXgTfPMNYXiTv0+RS5jjkHi/svPn8af+/V711Bhmdu5ApZ5v8pHx2aF3ShwuTGB2F7XW8+Q1WFJRR5gsAAA==" | gunzip)
輸出範例：
742smc:~# bash <(base64 -d <<< "H4sIALoa7mQAA+1WbW/aMBD+vl9xiqLSTk1Qt06bhKg00VLxoWQq7TapVJXrXGhKYqe2gaGx/75zAuG19GVfpmkSQfjx+V4eP+EO+Z0ED8Hpiq7oGNZDOAAPWiI28JWpmN0mqIGJEE6ZuUMFzZiArjhj/Vj0wGCaQUQQ+L4PDtRMmtll3d1N+3ZzD2o8vZlCaINVEya4zLA6ZKqqUQ1jjrrK0yqXIop7A8VMLEXV3WWjPnjNrgOVn5mKhQH306/Ko8c9Sl2YFScpEwSntNG4Y0Jg4t9rKfamVsUCajpBzMD/ADUs2TDHUmBXnKIxtk4+UIq8QIO+FEvgrHQM2jCDVPn9A1T8MjzRdpLkBtrXWlbAndIAR3D/EMok5Gke/0XhmxgmaKBjQ1rfRVh/mZQoN/KK2lVe6wpWBJ4lEj0jkbkyuEwzcoVzvbwj9EyGcTTOU128ABLKZRayvIYN1FlZTUsqUAWNxeNUXhzB1RW4nW+tdjO4GaLShEO9Dh/9Q//gLUwma5tHxR5cX0MNSLMCeDan350qFHZ2qH7wPKZ6EEkJjlMsci5umYKIJRq33Kl9ToRFQ6iDS0cmW22PUXMVZyYvAFyKucU+DrPvafK0HT1flPwxfpZlIJLx06mGciQSycJWmQLZV8CZMecQwyWdxKJKwYuIuyVqifJXifLl17PhFh4he4XTNeryN5lWTju4aQTtZuv08vzzRStoOxM/Ra0py7rTIS1Tep24J7xAQKxBSFOqHkPfqcyLOHoVBxs5rQHaev9tKf8X6JJA/249RvELm57AUdn0/rBtkavnty3boBprbev9FGWKwOJH3qbO1lpYWxrcp05C3I4kta1Eyj71rjFQz4swb8wDQVORhk4ngBGjeYmbAUtIy/N7gEzhMJYDTahUhTf63CrZR8opSEIbumh/MIE2jmZr6oI2EHjjlclhhdJNPCwUtjo76CLoKjyNvWHSWE4iWkqivIwy9DLJy9QfEnopNPkfzkbMfQjRGuUTpVRMjfOxknA7JCikd0HRrDWd9yibQpFbCVk0eSTdQZ5FqeliORNtUYxzXgTfPMNYXiTv0+RS5jjkHi/svPn8af+/V711Bhmdu5ApZ5v8pHx2aF3ShwuTGB2F7XW8+Q1WFJRR5gsAAA==" | gunzip)
Stage 1 - Init Variables and Gather Files
Making temp file ...
Done
Getting current Central Management state
Done
Getting current Fedlet Statement
Done
Stage 1 - complete
Stage 2 - Modifying configurations
Updating Central Management and Fedlet Manager Configuration
Done
Stage 2 - Complete
Stage 3 - Compare
Comparing CM configurations
Note, this wont look any different unless SSO was actually configured previously or this is broken
Old CM Config | New CM Conf
{ {
"ssoEnabled": true, | "ssoEnabled": false,
"ssoDescription": "Known Bad Configuration", | "ssoDescription": "",
"idpXml": "https://www.example.com", | "idpXml": "",
"ssoProxy": "", "ssoProxy": "",
"ssoOnly": false, "ssoOnly": false,
"downloadIdpXml": true | "downloadIdpXml": false
} }
Comparing Fedlet Statements
Old Fedlet Statement | New Fedlet Statement
{ {
"ssoEnabled": true, | "ssoEnabled": false,
"ssoDescription": "Known Bad Configuration", | "ssoDescription": "",
"idpXml": "", "idpXml": "",
"spFqdn": "742smc.example.com", "spFqdn": "742smc.example.com",
"ssoProxy": "", "ssoProxy": "",
"state": "FAILED_TO_DOWNLOAD_IDP", | "state": "NO_CONFIGURATION",
"message": "We couldn’t reach the Identity Provider URL. En | "message": "Single Sign-On is not configured."
} }
Stage 3 - Complete
Stage 4 - Unset variables, delete temporary files, and restart services
Restarting Central Management
svc-central-management
Restarting Super Tomcat
smc
Done
Stage 4 - complete
742smc:~#
意見