Page History

...

• get-service
  • If the --service option is used, returns the indicated Identity Service and otherwise returns the list of Identity Services.
• store-service
  • Stores the indicated Identity Service.
  • The following options and switches can be used: 
    • The --service-type option specifies the capabilities of the Identity Service such as LDAP, OIDC, FIDO. For the full list of service types see JS7 - Identity Services, Matrix.
    • The --required switch specifies that successful authentication using the Identity Service is required. If the switch is not used, then JOC Cockpit will switch to using the next Identity Service in case of unsuccessful authentication.
    • The --disabled switch can be used to deactivate an Identity Serivce which denies login by any accounts using the Identity Service.
    • The --ordering option can be used to specifiy the position of the Identity Service in the list of Identity Services.
    • The --second-service option specifies a second Identity Service for multi-factor authentication. Use of this option implicitly specifies the --authentication-scheme=TWO-FACTOR option.
    • The --authentication-scheme option allows to specify the following values: SINGLE-FACTOR, TWO-FACTOR.
      • Single-factor authentication specifies that the Identity Service is used as a single factor for authentication.
        • The --single-factor-certificate switch is used for the JS7 - Certificate Identity Service to specify that a certificate acts as the single factor for authentication.
        • The --single-factor-password switch is used to specify that a password is used as the single factor for authentication.
      • Two-factor authentication specifies that a second Identity Service is used and that successful authentication with both Identity Services is required. For example an Identity Serivce using the LDAP service type can use FIDO as a second factor. This implies that secrets are stored on different media: the LDAP password is stored with the user's brain while the FIDO secret is stored on the user's device, for example on a USB key or in an authenticator application on a smartphone. 
• rename-service
  • Renames the indicated Identity Service.
• remove-service
  • Removes the indicated Identity Service.
  • Users should check that after removal an Identity Service remains that allows to login. To restore access to JOC Cockpit consider JS7 - Rescue in case of lost access to JOC Cockpit.
• get-service-settings
  • Returns settings from an Identity Service. For example, the LDAP, OIDC and FIDO Identity Services hold confiugration items with their service settings.
  • Settings are returned in JSON format and can be stored to environment variables or to files, for example
    • settings=$(./deploy-identity-service.sh get-service-settings "${request_options[@]}" --service=My-Service --service-type=LDAP)
    • ./deploy-identity-service.sh get-service-settings "${request_options[@]}" --service=My-Service --service-type=LDAP > /tmp/ldap.settings.json
• store-service-settings
  • Stores Identity Service settings that have previously been retrieved using the get-service-settings command.
  • Settings are expected in JSON format from the value of the --settings option. If settings have previously been stored to a file, then they can be assigned like this:
    • settings=$(cat ./examples/ldap-settings.json)
    • ./deploy-identity-service.sh get-service-settings ... --settings="$settings"

...

# common options for connection to JS7 REST API
request_options=(--url=http://localhost:4446 --user=root --password=root) 

# enable account
./deploy-identity-service.sh enable-account "${request_options[@]}" --service=JOC-INITIAL --account=test-account

# disable account
./deploy-identity-service.sh disable-account "${request_options[@]}" --service=JOC-INITIAL --account=test-account

Blocking and Unblocking Accounts

# common options for connection to JS7 REST API
request_options=(--url=http://localhost:4446 --user=root --password=root) 

# block account
./deploy-identity-service.sh block-account "${request_options[@]}" --service=JOC-INITIAL --account=test-account

# get blocked account
./deploy-identity-service.sh get-account "${request_options[@]}" --service=JOC-INITIAL --account=test-account --blocked

# unblock account
./deploy-identity-service.sh unblock-account "${request_options[@]}" --service=JOC-INITIAL --account=test-account

# get list of blocked accounts
./deploy-identity-service.sh get-account "${request_options[@]}" --service=JOC-INITIAL --blocked

Renaming and Removing Accounts

...