MarkLogic 9 Product Documentation
POST /manage/v2/external-securitySummary
This resource address creates a new external-security configuration in the
security database.
For more information on external security, see
External Security in the Security Guide.
| URL Parameters |
| format |
The format of the posted data. Can be either
html, json, or xml (default). This value overrides
the Accept header if both are present. |
| Request Headers |
| Accept |
The expected MIME type of the request body. If
the format? parameter is present, it takes precedence over the Accept header. |
| Content-type |
The MIME type of the data in the request
body. Depending upon the value of the format parameter or Accept header, one of
application/xml, application/json, or text/html. |
| Response Headers |
| Content-type |
The MIME type of the data in the response
body. Depending upon the value of the format parameter or Accept header, one of
application/xml, application/json, or text/html. |
| Location |
If the request causes a restart, a Location
header is included in the reponse. The header contains a path with which to construct a URL
to usable to test when the restart has completed. |
Response
Upon success, MarkLogic Server returns status code 201 (Created). If the
external-security configuration already exists or if the payload is malformed, a status code
of 400 (Bad Request) is returned. A status code of 401 (Unauthorized) is returned if the user
does not have the necessary privileges.
Required Privileges
This operation requires the
security and
manage-admin roles.
Usage Notes
The structure of the data in the request body is as follows. The name,
authentication, and authorization properties are required. If
either the authentication or authorization is ldap,
then all of the ldap-* properties are also required.
external-security-id
An external security id (unique key).
external-security-name
External security name (unique)
description
An object's description.
authentication
Authentication
cache-timeout
The login cache timeout, in seconds.
authorization
An authorization scheme.
ldap-server-uri
URI of the ldap server. Required if authentication or authorization is ldap.
ldap-base
starting point for search. Required if authentication or authorization is ldap.
ldap-attribute
ldap attribute for user lookup. Required if authentication or authorization is ldap.
ldap-default-user
ldap user used by MarkLogic server.
Required if authentication is kerberos and authorization is ldap or bind method is simple.
ldap-password
password of the default ldap user.
Required if authentication is kerberos and authorization is ldap or bind method is simple.
ldap-bind-method
ldap bind method.
ldap-memberof-attribute
ldap attribute for group lookup. This is optional. If it is not specified,
"memberOf" will be used for search for the groups of a user.
ldap-member-attribute
ldap attribute for group lookup. This is optional. If it is not specified,
"member" will be used for search for the group of a group.
ldap-start-tls
Whether or not to use start TLS request to the ldap server.
ldap-certificate
The PEM encoded X509 certificate for MarkLogic server to connect the LDAP server.
It can be used for mutual authentication if bind method is MD5 or simple.
Or it can be used for external binding.
ldap-private-key
The PEM encoded private key corresponding to the certificate.
ldap-nested-lookup
Whether or not to perform nested group lookup.
ldap-remove-domain
Whether or not to remove domain before matching with ldap-attribute.
ldap-server
An LDAP server configuration.
This is a complex structure with the following children:
ldap-server-uri
URI of the ldap server. Required if authentication or authorization is ldap.
ldap-base
starting point for search. Required if authentication or authorization is ldap.
ldap-attribute
ldap attribute for user lookup. Required if authentication or authorization is ldap.
ldap-default-user
ldap user used by MarkLogic server.
Required if authentication is kerberos and authorization is ldap or bind method is simple.
ldap-password
password of the default ldap user.
Required if authentication is kerberos and authorization is ldap or bind method is simple.
ldap-bind-method
ldap bind method.
ldap-memberof-attribute
ldap attribute for group lookup. This is optional. If it is not specified,
"memberOf" will be used for search for the groups of a user.
ldap-member-attribute
ldap attribute for group lookup. This is optional. If it is not specified,
"member" will be used for search for the group of a group.
ldap-start-tls
Whether or not to use start TLS request to the ldap server.
ldap-certificate
The PEM encoded X509 certificate for MarkLogic server to connect the LDAP server.
It can be used for mutual authentication if bind method is MD5 or simple.
Or it can be used for external binding.
ldap-private-key
The PEM encoded private key corresponding to the certificate.
ldap-nested-lookup
Whether or not to perform nested group lookup.
ldap-remove-domain
Whether or not to remove domain before matching with ldap-attribute.
saml-server
An SAML server configuration.
This is a complex structure with the following children:
saml-entity-id
SAML entity id. Required if authorization is SAML.
saml-destination
SAML destination.
saml-issuer
SAML issuer.
saml-idp-certificate-authority
The PEM encoded X509 certificate authority for SAML IDP.
saml-sp-certificate
The PEM encoded X509 certificate for SAML SP.
saml-sp-private-key
The PEM encoded private key for SAML SP.
saml-attribute-names
A list of SAML attribute names.
This is a complex structure with the following children:
saml-attribute-name
SAML attribute name.
saml-privilege-attribute-name
SAML privilege attribute name.
http-options
The HTTP options to use when connecting to the
replication application server.
This is a complex structure with the following children:
timeout
The timeout
dataheaders
The headers.
method
The method to use.
username
password
credential-id
The credential id.
client-cert
client-key
pass-phrase
verify-cert
Whether the server's certificate should be verified.
proxy
The network location of the proxy server.
kerberos-ticket-forwarding
The option for kerberos ticket forwarding.
If it is "disabled", the user ticket is not used. This is the default.
If it is "required", the user ticket is forwarded. If the user ticket is not
forwardable, XDMP-NOFORWARDTICKET is thrown.
If it is "optional", the user ticket is forwarded if it is forwardable.
But no error if it is not forwardable.
ssl-client-certificate-authorities
Certificate authorities that may sign client certificates for this
server. Selecting one or more certificate authorities when SSL is
enabled will require all clients to present a valid certificate signed
by one of the selected authorities. Clicking on an organization below
will reveal the certificate authorities for that organization.
This is a complex structure with the following children:
ssl-client-certificate-authority
An SSL certificate authority
ssl-require-client-certificate
Whether or not a client certificate is required. This only has an
effect when one or more more client certificate authorities are
specified, in which case a value of true will fail client authentication
if a valid client certificate is not provided.
Example
cat ExternalConfig.json
==>
{
"external-security-name": "LDAP-security",
"description": "Some description",
"authentication": "ldap",
"cache-timeout": "300",
"authorization": "ldap",
"ldap-server-uri": "LDAP uri",
"ldap-base": "LDAP base for user lookup",
"ldap-attribute": "LDAP attribute for user lookup",
"ldap-default-user": "default",
"ldap-password": "password",
"ldap-bind-method": "simple"
}
curl -X POST --anyauth -u admin:admin -H "Content-Type:application/json" \
-d @ExternalConfig.json http://localhost:8002/manage/v2/external-security
==> Creates an LDAP external security configuration, named "LDAP-security,"
in the Security database.
Stack Overflow: Get the most useful answers to questions from the MarkLogic community, or ask your own question.