簡介
本文描述如何在安全網路分析管理器上將單點登入(SSO)設定為空/預設值。
必要條件
需求
本文件沒有特定需求。
採用元件
本檔案中的資訊是根據安全網路分析管理員(SMC)版本7.1和更新版本。
本文建議使用具有複製和貼上功能的SSH客戶端/應用程式。
本文中的資訊是根據特定實驗室環境內的裝置所建立。文中使用到的所有裝置皆從已清除（預設）的組態來啟動。如果您的網路運作中，請確保您瞭解任何指令可能造成的影響。
問題
配置的SSO設定無效或過時，或者中央管理顯示 Configuration Changes Failed
解決方案
SSO配置包括中央管理和聯邦管理器兩個部分。如果需要比較原始配置和最終配置，請運行所有列出的步驟。如果不需要比較，則僅運行未標籤為（可選）的命令。 本文結尾處的一行命令將為您執行這些步驟。
步驟1。（可選）如果要將當前中央管理配置與最終結果進行比較，請運行 jq '.configurableElements.sso' /lancope/var/services/cm/configuration/$(awk -F\" '{print $8}' /lancope/var/services/cm-agent/configuration/managementChannel.json)/config.json > jqdoldcm.json 指令。
741smc:~# jq '.configurableElements.sso' /lancope/var/services/cm/configuration/$(awk -F\" '{print $8}' /lancope/var/services/cm-agent/configuration/managementChannel.json)/config.json > jqdoldcm.json
741smc:~#
步驟2。（可選）如果要將當前配置與最終結果進行比較，請運行 jq . /lancope/var/fedlet-manager/conf/fedlet-manager.json > jqdoldfm.json 指令。
741smc:~# jq . /lancope/var/fedlet-manager/conf/fedlet-manager.json > jqdoldfm.json
741smc:~#
步驟3.建立臨時變數 tmpfile=$(mktemp) 指令。
741smc:~# tmpfile=$(mktemp)
741smc:~#
步驟4.建立臨時變數 cm_file=$(echo /lancope/var/services/cm/configuration/$(awk -F\" '{print $8}' /lancope/var/services/cm-agent/configuration/managementChannel.json)/config.json)指令。
741smc:~# cm_file=$(echo /lancope/var/services/cm/configuration/$(awk -F\" '{print $8}' /lancope/var/services/cm-agent/configuration/managementChannel.json)/config.json)
741smc:~#
步驟5.使用CLI確定 echo $SWINFO_version 指令。
741smc:~# echo $SWINFO_version
7.4.1
如果SMC版本為7.4.1，請運行以下命令：
741smc:~# cp $cm_file $tmpfile && jq --arg foo "" --argjson bar false '.configurableElements.sso.ssoEnabled = $bar|.configurableElements.sso.ssoDescription = $foo|.configurableElements.sso.idpXml = $foo|.configurableElements.sso.ssoProxy = $foo|.configurableElements.sso.ssoOnly = $bar|.configurableElements.sso.downloadIdpXml = $bar' "$tmpfile" > $cm_file && rm -f -- $tmpfile
741smc:~# cp /lancope/var/fedlet-manager/conf/fedlet-manager.json $tmpfile && jq --arg foo "" --argjson bar false '.ssoEnabled = $bar|.ssoDescription = $foo|.idpXml = $foo|.ssoProxy = $foo|.state = "NO_CONFIGURATION"|.message="Single Sign-On is not configured."' $tmpfile >/lancope/var/fedlet-manager/conf/fedlet-manager.json && rm -f -- $tmpfile
741smc:~#
如果SMC版本低於7.4.1，請運行以下命令：
711smc:~# cp $cm_file $tmpfile && jq --arg foo "" --argjson bar false '.configurableElements.sso.ssoEnabled = $bar|.configurableElements.sso.ssoDescription = $foo|.configurableElements.sso.idpXml = $foo|.configurableElements.sso.ssoOnly = $bar|.configurableElements.sso.downloadIdpXml = $bar' "$tmpfile" > $cm_file && rm -f -- $tmpfile
711smc:~# cp /lancope/var/fedlet-manager/conf/fedlet-manager.json $tmpfile && jq --arg foo "" --argjson bar false '.ssoEnabled = $bar|.ssoDescription = $foo|.idpXml = $foo|.state = "NO_CONFIGURATION"|.message="Single Sign-On is not configured."' $tmpfile >/lancope/var/fedlet-manager/conf/fedlet-manager.json && rm -f -- $tmpfile
711smc:~#
步驟6.（可選）如果要將最終結果配置與原始配置進行比較，請運行以下命令：
741smc:~# jq '.configurableElements.sso' $cm_file > jqdnewcm.json
741smc:~# jq . /lancope/var/fedlet-manager/conf/fedlet-manager.json > jqdnewfm.json
741smc:~# diff -y jqdoldcm.json jqdnewcm.json
741smc:~# diff -y jqdoldfm.json jqdnewfm.json
步驟7.（可選）刪除 json 在上一步驟中作為比較過程的一部分而建立的檔案。
741smc:~# rm -f jqdoldcm.json jqdnewcm.json
741smc:~# rm -f jqdoldfm.json jqdnewfm.json
步驟8.取消設定在本文檔開頭建立的變數。
711smc:~# unset tmpfile
711smc:~# unset cm_file
711smc:~#
使用 docker central-management指令。
741smc:~# docker restart svc-central-management
svc-central-management
741smc:~#
單線自動
運行此命令可執行本文中介紹的所有步驟。輸出包含一些附加格式。
bash <(base64 -d <<< "H4sIAIXWV2MAA+1WXW/aQBB8769YWVZIpNoobapWQkSqSIh4AEehaSuVKrrYa3LBvnPuDihq+t+7Z4PBBMhHX6qqEqDcst6dnRsyi+GNBA/BGYiB6Bs2RDgEDzqCG/jMFGfXCWpgIoIzZm5QQZtTYCC6bMTFEAymGcQUAt/3wYGGSTN7bLr76ch+eQCNML2ah9A2qydMhDLD+oSpukY14SHqepjWQyliPhwrZrgUdXefTUfgtQcO1H5migsD7odfta2PewRdmLUiKRMUTumL1g0TAhP/VktxMM8qDtDQCWIG/jtoYMmGOZECB+IMjbFzhmOlqAq06EOxBLplYdCGGaTJb++g5pftibbTJE/QvtayBu6cBjiG27tIJlGY5v2f1b6NUYIG+ralrV209aukxHmSV8yu8lnXYkXjBZD4CUCWyghlmlEpXOrlDUW7MuLxLIe6egEklMssYvkMG6izspqPVEQVtFYfp/F4DN/A7X/p9NrB1QSVpjA0m+C894/8Qwe+QwNIlwLCbEmxO1ch7O3RjOB5TA0hlhIcpzjk814zBTFLNO64N/s+FTYaQRNceuR+Z+4J6lDxzOQowaWeO/J5lH1Nk8fz6H2u5I/ZkzIDkcwehxrJqUgkizolBMqvgbNgziF1lHQSiyoFLybuKtQS5S8S3vOvZ8MtbCF7jdMH1OW/Vjo5veCqFfTanbPLi4+fOkHPufdT1JpQNp0+6ZXg9flQeIEArkFIUyobI9+pLYc4fhEHGzltANp5/20p/xdoRaB/tx5j/kxjEzgtje0PrYlKPd2arAm1HljT23mUKQoWf+RW1H1gUz1p8DU5CXE7lWRNiZQj8qcZkK/FmJvvWNDmo6HfD2DKaCcKzZglpOXlPUCmcMLlWFNUqqIava6VHCFhCpLIti4sDu6hh9PFmZzONgJvtrYdrFG6iYeVwdb3A100XQ/Pe2/YJqog4gqI8jLK1lWSq9QfUfRSaKo/qayREdq8fHGUiqlZvj1qal3Ib+f0qylbsI3zlqWAi+NCoQVy5wLpV6e2LCWWBBmOaBVRRRroSeiFRZ63XCjtP+vNUjxa2ZKoGuyG9Oo3OzkftYILAAA=" | gunzip)
輸出示例：
741smc:~# bash <(base64 -d <<< "H4sIAIXWV2MAA+1WXW/aQBB8769YWVZIpNoobapWQkSqSIh4AEehaSuVKrrYa3LBvnPuDihq+t+7Z4PBBMhHX6qqEqDcst6dnRsyi+GNBA/BGYiB6Bs2RDgEDzqCG/jMFGfXCWpgIoIzZm5QQZtTYCC6bMTFEAymGcQUAt/3wYGGSTN7bLr76ch+eQCNML2ah9A2qydMhDLD+oSpukY14SHqepjWQyliPhwrZrgUdXefTUfgtQcO1H5migsD7odfta2PewRdmLUiKRMUTumL1g0TAhP/VktxMM8qDtDQCWIG/jtoYMmGOZECB+IMjbFzhmOlqAq06EOxBLplYdCGGaTJb++g5pftibbTJE/QvtayBu6cBjiG27tIJlGY5v2f1b6NUYIG+ralrV209aukxHmSV8yu8lnXYkXjBZD4CUCWyghlmlEpXOrlDUW7MuLxLIe6egEklMssYvkMG6izspqPVEQVtFYfp/F4DN/A7X/p9NrB1QSVpjA0m+C894/8Qwe+QwNIlwLCbEmxO1ch7O3RjOB5TA0hlhIcpzjk814zBTFLNO64N/s+FTYaQRNceuR+Z+4J6lDxzOQowaWeO/J5lH1Nk8fz6H2u5I/ZkzIDkcwehxrJqUgkizolBMqvgbNgziF1lHQSiyoFLybuKtQS5S8S3vOvZ8MtbCF7jdMH1OW/Vjo5veCqFfTanbPLi4+fOkHPufdT1JpQNp0+6ZXg9flQeIEArkFIUyobI9+pLYc4fhEHGzltANp5/20p/xdoRaB/tx5j/kxjEzgtje0PrYlKPd2arAm1HljT23mUKQoWf+RW1H1gUz1p8DU5CXE7lWRNiZQj8qcZkK/FmJvvWNDmo6HfD2DKaCcKzZglpOXlPUCmcMLlWFNUqqIava6VHCFhCpLIti4sDu6hh9PFmZzONgJvtrYdrFG6iYeVwdb3A100XQ/Pe2/YJqog4gqI8jLK1lWSq9QfUfRSaKo/qayREdq8fHGUiqlZvj1qal3Ib+f0qylbsI3zlqWAi+NCoQVy5wLpV6e2LCWWBBmOaBVRRRroSeiFRZ63XCjtP+vNUjxa2ZKoGuyG9Oo3OzkftYILAAA=" | gunzip)
Stage 1 - Init Variables and Gather Files
Making temp file ...
Done
Getting current Central Management state
Done
Getting current Fedlet Statement
Done
Stage 1 - complete
Stage 2 - Modifying configurations
Updating Central Management and Fedlet Manager Configuration
Done
Stage 2 - Complete
Stage 3 - Compare
Comparing CM configurations
Note, this wont look any different unless SSO was actually configured previously or this is broken
Old CM Config | New CM Conf
{ {
"ssoEnabled": true, | "ssoEnabled": false,
"ssoDescription": "Known Bad Config", | "ssoDescription": "",
"idpXml": "https://www.example.com", | "idpXml": "",
"ssoProxy": "", "ssoProxy": "",
"ssoOnly": false, "ssoOnly": false,
"downloadIdpXml": true | "downloadIdpXml": false
} }
Comparing Fedlet Statements
Old Fedlet Statement | New Fedlet Statement
{ {
"ssoEnabled": true, | "ssoEnabled": false,
"ssoDescription": "Known Bad Config", | "ssoDescription": "",
"idpXml": "", "idpXml": "",
"spFqdn": "741smc.example.local", "spFqdn": "741smc.example.local",
"ssoProxy": "", "ssoProxy": "",
"state": "FAILED_TO_DOWNLOAD_IDP", | "state": "NO_CONFIGURATION",
"message": "We couldn’t reach the Identity Provider URL. En | "message": "Single Sign-On is not configured."
} }
Stage 3 - Complete
Stage 4 - Unset variables and delete temporary files
Restarting Central Management
svc-central-management
Done
Stage 4 - complete
意見