The Linux connector enables provisioning/de-provisioning of users on a Linux server.

Configure Linux OS

Create Linux user for password authentication

Create the user in Linux

$ useradd linuxuser -m -G sudo
$ passwd  linuxuser

$ sudo sh -c "echo 'linuxuser ALL=(ALL) ALL' >> /etc/sudoers"

Install openssh-server if needed

sudo apt install openssh-server

Configure /etc/ssh/sshd_config

PasswordAuthentication yes

Restart ssh

$ sudo systemctl restart ssh

Create linux user for certificate authentication

$ useradd linuxusercert -m -G sudo
 $ passwd linuxusercert
 $ su linuxuser
$ cd /home/linuxusercert/
$ mkdir .ssh
$ cd .ssh
$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/linuxusercert/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/linuxusercert/.ssh/id_rsa.
Your public key has been saved in /home/linuxusercert/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:e9UfDRqIIvwImE1kWIbeQjfcqendHw2MyO+cuTDAYJ0 linuxusercert@gnenny-MS-7C37
The key's randomart image is:
+---[RSA 2048]----+
| =B . .          |
|oO.=.o   . .     |
|=o=EB o + . . .  |
|.oo= * o o   + ..|
|  ooo + S o o ...|
|   ... o o o   ..|
|     oo = o     .|
|      o= o       |
|       ..        |
+----[SHA256]-----+

$ sudo sh -c "echo 'linuxusercert ALL=NOPASSWD: ALL' >> /etc/sudoers"

$ ssh-copy-id linuxusercert@localhost

OpenIAM

1 Connector settings

configure additional fields (Left menu → Connector Configuration) :

2 Managed system settings

Example

Object Rules : bash scripts with attributes, which will be run on server. Default scripts:

First parameter - type : “user” / “group”

add_script.sh type login password groupsadd groupsdel

#!/bin/bash

if [ $1 = "user" ]; then
  useradd -N  $2
  printf "$3\n$3" | passwd $2
  if [ ! -z $5 ]; then
    IFS=',' ;
    for i in $5; do
      gpasswd -d $2 $i;
    done
  fi
  if [ ! -z $4 ]; then
    IFS=',' ;
    for i in $4; do
      gpasswd -a $2 $i;
    done
  fi
  echo $2
fi

if [ $1 = "group" ]; then
  groupadd -f $2
fi

modify_script.sh type login oldlogin groupsadd groupsdel

#!/bin/bash

if [ $1 = "user" ]; then
  usermod -l $2 $3

  if [ ! -z $5 ]; then
    IFS=',' ;
    for i in $5; do
      gpasswd -d $2 $i;
    done
  fi
  if [ ! -z $4 ]; then
    IFS=',' ;
    for i in $4; do
      gpasswd -a $1 $i;
    done
  fi
  echo $1
fi

if [ $1 = "group" ]; then
  groupmod --new-name $2 $3
fi

delete_script.sh type login :

#!/bin/bash

if [ $1 = "user" ]; then
  userdel $2
  echo $2
fi

if [ $1 = "group" ]; then
  groupdel -f $2
fi

3. User policy map

For v.4.2.1 was added new field for provision ssh keys :

default groovy for this field :

package org.openiam

import org.openiam.api.connector.groovy.AbstractIPolicyMapGroovy
import org.openiam.api.connector.model.ConnectorAttribute
import org.openiam.api.connector.model.StringOperationalConnectorValue
import org.openiam.base.AttributeOperationEnum
import org.openiam.idm.provisioning.diff.model.user.ProvisionUserObjectDiff
import org.openiam.idm.searchbeans.UserSshKeySearchBean
import org.openiam.idm.srvc.user.dto.UserSshKey
import org.openiam.mq.constants.api.user.UserServiceAPI
import org.openiam.base.response.list.UserSshKeyListResponse
import org.openiam.base.request.UserSshKeySearchRequest
import org.springframework.beans.factory.annotation.Autowired
import org.openiam.mq.constants.queue.user.UserServiceQueue;
import org.openiam.mq.constants.api.OpenIAMAPI

class UserSshKeyGroovy extends AbstractIPolicyMapGroovy<ProvisionUserObjectDiff> {

    @Autowired
    protected UserServiceQueue userServiceQueue


    @Override
    boolean isPerform(ProvisionUserObjectDiff diffObject) {
        return true
    }

    @Override
    void perform(ConnectorAttribute attribute, ProvisionUserObjectDiff diffObject) {
        UserSshKeySearchBean sb = new UserSshKeySearchBean(diffObject.getValue().getId(), null, null);
        final UserSshKeyListResponse response = rabbitMQSender.sendAndReceive(userServiceQueue, (OpenIAMAPI)UserServiceAPI.GET_USER_SSH_KEYS,
                new UserSshKeySearchRequest(sb, 0, Integer.MAX_VALUE), UserSshKeyListResponse.class);
        if (response.isSuccess()) {
            List<UserSshKey> keyList = response.getList()
                    Date curDate = new Date()
            for (UserSshKey key : keyList) {
                if (key.getExpirationDate().after(curDate)) {
                    attribute.addValue(new StringOperationalConnectorValue(mapper.mapToStringQuietly(key), AttributeOperationEnum.ADD))
                } else {
                    key.setPkValue(null)
                    key.setPubValue(null)
                    attribute.addValue(new StringOperationalConnectorValue(mapper.mapToStringQuietly(key), AttributeOperationEnum.DELETE))
                }
            }
        }
    }

    @Override
    void getActualValue(final ConnectorAttribute attribute, final ProvisionUserObjectDiff diffObject) {

    }
}

4. Synchronization settings :

Required fields on Managed system page :

Example sync configuration page :

Provision to target systems?

• if unchecked - you need add login to user in transformation script.

Example :

if (isNewUser) {
            pUser.id = null
            def attrVal = columnMap.get("login")
            if (attrVal) {
                // PRE-POPULATE THE USER LOGIN. IN SOME CASES THE COMPANY WANTS TO KEEP THE LOGIN THAT THEY HAVE
                // THIS SHOWS HOW WE CAN DO THAT
                Login linuxLogin = new Login()
                linuxLogin.operation = AttributeOperationEnum.ADD
                linuxLogin.login = attrVal.value
                linuxLogin.managedSysId = "105"
                pUser.principalList.add(linuxLogin)

                /*   primary identity  */
                Login lg = new Login()
                lg.operation = AttributeOperationEnum.ADD
                lg.login = attrVal.value
                lg.managedSysId = "0"
                pUser.principalList.add(lg)
            }
        }

SQL Query / Directory Filter used for filter required users by login. There are two ways for filter :

1. Field value = '*' - select all records from linux

2.1. For 4.1.x versions.

Field value = 'any_string' - select users whith login, which contain 'any_string' anywhere (at the : begin , middle or end).

2.2. For 4.2.x versions.

Field value = ' login=any_string ' - select users whith login, which exact = 'any_string' Field value = ' login=any_string% ' - select users whith login, which contain 'any_string' anywhere

###ATTENTION !!!!!!!!

ADD provision role / group / resource to sync object in Transformation script. If don’t do it, on second sync process for such object will send DELETE comand on connector.

5. Reconciliation

Required fields on Managed system page :

Example reconciliation configuration page :

6. Linux ssh commands used in connector

Example ssh requests :

sudo -S sh add_script.sh user "jFvlmjYZ30sC854Sk"  "" "" ""
sudo -S sh modify_script.sh user "CPpLMGQDkP33R2gFj"  "jFvlmjYZ30sC854Sk"  "" ""
sudo -S sh delete_script.sh user "CPpLMGQDkP33R2gFj"

For reset pasword we use :

sudo -S passwd <login>

after that we send

sudoPassword
newPassword
newPassword

So need to check, that linux set password working as :

$ sudo -S passwd Test.Linux001
[sudo] password for gnenny:
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
gnenny@gnenny-MS-7C37:~$

7. SSH Key manager

1. Configure Policy Map for provision ssh keys to linux system.

Add new field to policy map : ssh_keys - with defalt groovy script - /provision/linux/ssh_keys.groovy

2. Open SSH Key manager page and add ssh key.

Selfsevice → Sellf Service Center → SSH Keys

Click "Add SSH Key" button :

• select or copy/past public key.
• type public key file name which will be used for create key on linux system.
• select expiration date for key.

• Public key is mandatory for save "SSH key" record.
• Private key is not mandatory. Will use in future version for : "SSH key/certificate can be obtained dynamically obtained from a company CA."

3. On provision user, key will be checked

• Key will be added to system if "expiration date" will not be less than current date
• Key will be deleted from linux system, if "expiration date" will be less than current date