首页
学习
活动
专区
圈层
工具
发布
首页
学习
活动
专区
圈层
工具
MCP广场
社区首页 >问答首页 >如何实现F5 saas_idp模板在BigIP上的自动化

如何实现F5 saas_idp模板在BigIP上的自动化
EN

Server Fault用户
提问于 2018-08-20 07:47:15
回答 1查看 181关注 0票数 1

我将在BigIP IdP SAML虚拟服务器上部署IdP启动模式,这要归功于基于https://www.f5.com/pdf/deployment-guides/saml-idp-saas-dg.pdf指令的iApps模板f5.saas_idp.v1.0.1rc1。

它在BigIP向导中运行得很好,但是我希望通过一个Ansible剧本实现自动化和文档化部署。

代码语言:javascript
运行
复制
- name: Deploy {{ idp_host }} with f5.saas_idp iApp template
  bigip_iapp_service:
    name: "saas_idp_{{ idp_host }}"
    template: f5.saas_idp.v1.0.1rc1
    parameters:
      tables:
        - name: saas_apps__saas_choice
          columnNames:
            - app_name
            - app_selection
            - app_sp
            - sp_initiated
          rows:
            - row:
                - "{{ saml_saas_name }}"
                - "/#zendesk#"
                - "{{ saml_saas_sp }}"
                - no # which means "Yes, IdP and SP"
        - name: saas_apps__saas_attributes
          # Empty
      variables:
        - name: options__advanced_mode
          value: yes
        - name: saas_virtual__addr
          value: "{{ idp_address }}"
        - name: saas_virtual__port
          value: 443
        - name: idp_encryption__cert
          value: /Common/{{ idp_host }}_saml_idp_metadata_cert.crt
        - name: idp_encryption__key
          value: /Common/{{ idp_host }}_saml_idp_metadata_cert.key
        - name: saas_virtual__vlan_listening
          value: enabled
        - name: saas_virtual__vlan_selections
          value: /Common/Internal
        - name: saas_virtual__lan_or_wan
          value: LAN
        - name: saas_virtual__tcp_lan_opt
          value: tcp-lan-optimized
        - name: saas_virtual__http
          value: http
        - name: saas_virtual__clientssl
          value: /Common/clientssl_wildcard_2017-2020
        - name: saas_virtual__chainssl
          name: "/#do_not_use#"
        - name: apm__apm_policy
          value: "/#create_new#"
        - name: apm__saml_entity_id_format
          value: url
        - name: apm__saml_entity_id
          value: https://{{ idp_host }}
        - name: apm__aaa_profile
          value: /Common/AAA_myAD
        - name: apm__logging
          value: /Common/default-log-setting
    force: no
    state: present
    strict_updates: no

但是脚本失败,需要saas_virtual__keysaas_virtual__certsaas_virtual__chainssl,而它们并不是预期的,因为我在高级模式下提供了一个现有的saas_virtual__clientssl

代码语言:javascript
运行
复制
message":"script did not successfully complete: (can't read "::saas_virtual__key": no such variable
    while executing
"iapp_conf create $cssl_cmd key $::saas_virtual__key cert $::saas_virtual__cert  chain none"
    invoked from within
"subst $substa_out"
    invoked from within
"if { [info exists [set substa_in]] } {
            set substa_out [subst $substa_in]
            set substa_out [subst $substa_out]
        } else {
..."
    ("uplevel" body line 3)
    invoked from within
"uplevel {
        append ::substa_debug "
$substa_in"
        if { [info exists [set substa_in]] } {
            set substa_out [subst $substa_in]
 ..."
    (procedure "iapp_substa" line 9)
    invoked from within
"iapp_substa client_ssl_arr($new_client_ssl,$do_chain_cert)"
    invoked from within
"iapp_conf create ltm virtual ${app}_vs  destination [iapp_destination $::saas_virtual__addr $::saas_virtual__port]  ip-protocol tcp  profiles replace-..."

如果提供这些变量没有帮助,脚本无法加载,因为我无法提供密钥密码:

代码语言:javascript
运行
复制
Error reading key PEM file /Common/wildcard_2017-2020.key
for profile /Common/saas_idp.app/saas_idp_myidphost_client-
ssl: error:0906A068:PEM routines:PEM_do_header:bad password read

因此,从我的观点来看,最好的选择是使用我现有的clientssl配置文件获得模板。怎么继续?有没有一种“调试”iApps模板脚本的方法,至少可以检查变量?

EN

回答 1

Server Fault用户

发布于 2018-08-20 09:15:56

我找到了要避免的陷阱--在提交变量之前,Ansible用True python布尔对象替换了yes值,因此丢弃了预期的字符串:

代码语言:javascript
运行
复制
variables:
  - name: options__advanced_mode
    value: "yes"

因此,高级模式没有启用,这就是为什么TCL iApps执行尝试创建新的clientssl配置文件的原因:

代码语言:javascript
运行
复制
# Client SSL Profile
set new_client_ssl [expr { !$advanced || [iapp_is ::saas_virtual__clientssl "/#create_new#"] }]
set do_chain_cert  [expr { $advanced && \
    [info exists ::saas_virtual__chainssl] && \
    ![iapp_is ::saas_virtual__chainssl "/#do_not_use#"] }]

所以iApps模板绝对是好的..。但是,为了简化REST或Ansible的自动化,可以改进输入参数验证,以便在错误消息和堆栈跟踪失败之前提交相关警告。

票数 1
EN
页面原文内容由Server Fault提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接:

https://serverfault.com/questions/927150

复制
相关文章

相似问题

领券
问题归档专栏文章快讯文章归档关键词归档开发者手册归档开发者手册 Section 归档