如何实现F5 saas_idp模板在BigIP上的自动化
如何实现F5 saas_idp模板在BigIP上的自动化
提问于 2018-08-20 07:47:15
我将在BigIP IdP SAML虚拟服务器上部署IdP启动模式，这要归功于基于https://www.f5.com/pdf/deployment-guides/saml-idp-saas-dg.pdf指令的iApps模板f5.saas_idp.v1.0.1rc1。
它在BigIP向导中运行得很好，但是我希望通过一个Ansible剧本实现自动化和文档化部署。
- name: Deploy {{ idp_host }} with f5.saas_idp iApp template
bigip_iapp_service:
name: "saas_idp_{{ idp_host }}"
template: f5.saas_idp.v1.0.1rc1
parameters:
tables:
- name: saas_apps__saas_choice
columnNames:
- app_name
- app_selection
- app_sp
- sp_initiated
rows:
- row:
- "{{ saml_saas_name }}"
- "/#zendesk#"
- "{{ saml_saas_sp }}"
- no # which means "Yes, IdP and SP"
- name: saas_apps__saas_attributes
# Empty
variables:
- name: options__advanced_mode
value: yes
- name: saas_virtual__addr
value: "{{ idp_address }}"
- name: saas_virtual__port
value: 443
- name: idp_encryption__cert
value: /Common/{{ idp_host }}_saml_idp_metadata_cert.crt
- name: idp_encryption__key
value: /Common/{{ idp_host }}_saml_idp_metadata_cert.key
- name: saas_virtual__vlan_listening
value: enabled
- name: saas_virtual__vlan_selections
value: /Common/Internal
- name: saas_virtual__lan_or_wan
value: LAN
- name: saas_virtual__tcp_lan_opt
value: tcp-lan-optimized
- name: saas_virtual__http
value: http
- name: saas_virtual__clientssl
value: /Common/clientssl_wildcard_2017-2020
- name: saas_virtual__chainssl
name: "/#do_not_use#"
- name: apm__apm_policy
value: "/#create_new#"
- name: apm__saml_entity_id_format
value: url
- name: apm__saml_entity_id
value: https://{{ idp_host }}
- name: apm__aaa_profile
value: /Common/AAA_myAD
- name: apm__logging
value: /Common/default-log-setting
force: no
state: present
strict_updates: no但是脚本失败，需要saas_virtual__key、saas_virtual__cert和saas_virtual__chainssl，而它们并不是预期的，因为我在高级模式下提供了一个现有的saas_virtual__clientssl：
message":"script did not successfully complete: (can't read "::saas_virtual__key": no such variable
while executing
"iapp_conf create $cssl_cmd key $::saas_virtual__key cert $::saas_virtual__cert chain none"
invoked from within
"subst $substa_out"
invoked from within
"if { [info exists [set substa_in]] } {
set substa_out [subst $substa_in]
set substa_out [subst $substa_out]
} else {
..."
("uplevel" body line 3)
invoked from within
"uplevel {
append ::substa_debug "
$substa_in"
if { [info exists [set substa_in]] } {
set substa_out [subst $substa_in]
..."
(procedure "iapp_substa" line 9)
invoked from within
"iapp_substa client_ssl_arr($new_client_ssl,$do_chain_cert)"
invoked from within
"iapp_conf create ltm virtual ${app}_vs destination [iapp_destination $::saas_virtual__addr $::saas_virtual__port] ip-protocol tcp profiles replace-..."如果提供这些变量没有帮助，脚本无法加载，因为我无法提供密钥密码：
Error reading key PEM file /Common/wildcard_2017-2020.key
for profile /Common/saas_idp.app/saas_idp_myidphost_client-
ssl: error:0906A068:PEM routines:PEM_do_header:bad password read因此，从我的观点来看，最好的选择是使用我现有的clientssl配置文件获得模板。怎么继续？有没有一种“调试”iApps模板脚本的方法，至少可以检查变量？
回答 1
Server Fault用户
发布于 2018-08-20 09:15:56
我找到了要避免的陷阱--在提交变量之前，Ansible用True python布尔对象替换了yes值，因此丢弃了预期的字符串：
variables:
- name: options__advanced_mode
value: "yes"因此，高级模式没有启用，这就是为什么TCL iApps执行尝试创建新的clientssl配置文件的原因：
# Client SSL Profile
set new_client_ssl [expr { !$advanced || [iapp_is ::saas_virtual__clientssl "/#create_new#"] }]
set do_chain_cert [expr { $advanced && \
[info exists ::saas_virtual__chainssl] && \
![iapp_is ::saas_virtual__chainssl "/#do_not_use#"] }]所以iApps模板绝对是好的..。但是，为了简化REST或Ansible的自动化，可以改进输入参数验证，以便在错误消息和堆栈跟踪失败之前提交相关警告。
页面原文内容由Server Fault提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接：
https://serverfault.com/questions/927150
复制相关文章
相似问题
腾讯云开发者
