Micah Lee micahlee

Keybase proof

I hereby claim:

I am micahlee on github.
I am micahlee (https://keybase.io/micahlee) on keybase.
I have a public key whose fingerprint is 150E F782 F4CC 1EAC 4147 3C35 C837 BC3C 4E04 4853

To claim this, I am signing this object:

LDAP Authenticator Configuration

The LDAP authenticator is a built-in Conjur service and will authenticate users to Conjur using their LDAP credentials. The LDAP authenticator uses configuration defined in policy to connect to an LDAP server and bind against a directory using an LDAP username and password.

Prequisites

LDAP authenticator configuration requires these pre-conditions:

When Conjur is configured with the LDAP authenticator, there are two environment variables that must be set on the appliance (Master and Followers) for the Conjur UI to use the LDAP authenticator:

The first is the CONJUR_AUTHENTICATORS variable which configures which defined authenticators are enabled to use, which may include the built-in default, 'authn'.

CONJUR_AUTHENTICATORS="authn-ldap/ldap-server,authn"

CF Policy Updates

Policy for CF structure

Define and load policy branch for Cloud Foundry

# cf.yml
- !policy
   id: cf
   annotations:
     description: Base policy branch for all Cloud Foundry resources

Initial state

$ cf service-brokers
Getting service brokers as admin...

name             url
app-autoscaler   https://autoscale.sys.pcf.itd.conjur.net
nfsbroker        https://nfsbroker.sys.pcf.itd.conjur.net

Display role bindings for conjur-cluster service account token

oc get clusterrolebindings -o json \
  | jq '.items | map(select(any(.subjects[]; .name | contains("conjur-cluster"))))'

Display conjur-authenticator role information

oc describe clusterrole conjur-authenticator

Auto-failover Cluster Recovery Procedure

Overview

This document describes a procedure for recovering an auto-failover cluster that has more than 1 failed node.

When multiple nodes need to be re-added to a cluster, the etcd state needs to be carefully managed to manage member and quorum consistency throughout.

ETCD Heartbeat Update Procedure

Stop Cluster Service

On each Standby:
```
sv stop cluster
```
On the Master:

	# example-org.yml
	- !policy
	id: example-org
	body:
	- !layer
	annotations:
	org-id: 83a5b409-f5e0-4db7-8036-e342cafe358c

	# Main container
	FROM alpine:3.9

	RUN apk add --no-cache bash \
	jq \
	wget

	ENV CONJUR_VERSION=5 \
	CONTAINER_MODE=init