Managing Access Federation

Setting Up Access Federation

Setting up access federation through Mission Control requires the following main steps:

1. Configuring Access for Authentication from Mission Control 
   In this step, you will enable Mission Control to send commands to any of the Access services connected to Artifactory services under its control.
2. Establishing the Circle of Trust 
   In this step, you will establish the basis for your access federation topology by providing synchronization target services with the root certificate of the synchronization source service.
3. Configuring Access Federation Topologies 
   In this step, you will establish the connections required so that source Artifactory services will be able to synchronize security entities to target services (i.e. those that have been furnished with the source service's root certificate). 

Configuring Access for Authentication from Mission Control

Configuring Access Federation through Mission Control requires setting an Artifactory service as an authentication provider. The Access service installed with that Artifactory is the one that Mission Control sets up when you configure Access Federation through the Mission Control UI.

Establishing the Circle of Trust

Mission Control can only configure synchronization of security entities from a source Artifactory service to a target service, if the source is trusted by the target. This trust is established by providing the target service with the source service's root certificate.

Examples

Setting Up a Star Topology

Consider the example of three Access services that should be set up in a Star topology where Access-A synchronizes to Access-B and Access-C.

In this case, you need to provide Access-B and Access-C the root certificate of Access-A so that A becomes trusted by B and C.

Setting Up A Full Mesh Topology

Consider the example of three Access services that should be set up in a Full Mesh topology where each service should be able to synchronize changes to security entities to both other services.

In this case, you need to provide each Access service with the root certificates of both other services so that both are trusted.

Configuring Access Federation Topologies

Once your circle of trust is established by providing target access services with the root certificates of source access services, you need to configure the topology by setting up the relationship in Mission Control.

To configure Access Federation topologies in Mission Control, from the Admin module, select Access Federation | Configuration. Mission Control will display the list of Access (Artifactory) services it manages.

Mesh Topology

To set up access federation, click Add Mesh Topology. Mission Control will display a wizard that will take you through the steps of the process which are:

1. Selecting services
2. Selecting security entities to synchronize
3. Summary

Selecting Services

In this step, you select the services that will be part of the federated group. To include services in the federated group, select them from the Available Access Services list and use the arrows to transfer them to the Selected Access Services list.

Selecting Security Entities

Once you have set the Artifactory services that are in the federated group, you select the set of security entities that should be synchronized out of the following:

• Users
• Groups
• Permissions 
• Access tokens

Simply check the entities that should be synchronized (by default, they are all checked) and click Next.

Summary

Finally, Mission Control displays a summary of your setup. To apply the configuration, click Finish. 

Mission Control will display the results of the action.

The example above shows that a mesh topology that was set up allowing synchronization of security entities from artifactory1 to artifactory-edge1, artifactory-edge2 and artifactory-edge3. In other words, artifactory-edge1, artifactory-edge2 and artifactory-edge3 were all furnished with the the root certificate of artifactory1 and therefore trust it as a source. The red message at the end does not indicate an error, but rather that artifactory1 was NOT furnished with the root certificate of artifactory-edge1, so you cannot synchronize security entities from artifactory-edge1 back to artifactory1 which is consistent with the star topology in this example.

Star Topology

To set up access federation, click Apply Topology and select Star. Mission Control will display a wizard that will take you through the steps of the process which are:

1. Selecting services
2. Selecting security entities to synchronize
3. Summary

Selecting Services

In this step, you select the services that will be part of the federated group. To include services in the federated group, select them from the Available Access Services list and use the arrows to transfer them to the Selected Access Services list.

Selecting Security Entitiies

Once you have set the Artifactory services that are in the federated group, proceed Select Entity Types tab to set the entity types to be synched from the source site to the target sites. 

From Mission Control version 3.2, you have more flexibility when setting entity types from source services to target services.

To sync security entities:

1. Select the method for assigning entity types to targets.
   
   • Manually assign entities to different targets: This provides flexibility as it allows you to assign different entity types to different targets. For example: You decide to synchronize users and groups from Access A to Access B,  choose to only synchornize users, groups and permission from Access A to Access C, and synchrnize all the entities from Access A to Access E. Available only for source Artifactory with version 6.3 and above. 
     
   • Apply on all Targets: For versions below Artifactory 6.2, the Targets list is disabled and only the Entity Types selection is available for configuration. Any selection made applies to all targets and selecting Permissions applies to all permissions. This option is enabled when selecting the Star Topology.
2. Select the entity types to be synched.
   

   • Users

   • Groups

   • Permissions 
   • Include/exclude Patterns: Applies on Artifactory above version 6.2. When assigning entity types to targes, you can assign specific permissions to be synchronized using the Include/Exclue regular expressions.
   • Tokens

The following example shows how to manually select specific Entity types to target services:

 The following example shows how to automatically apply the selected Entity types automatically to all the targets:

Summary

Finally, Mission Control displays a summary of your setup. To apply the configuration, click Finish. 

Mission Control will display the results of the action.

The example above shows that a star topology that was set up allowing synchronization of security entities from artifactory1 to artifactory-edge1, artifactory-edge2 and artifactory-edge3. In other words, artifactory-edge1, artifactory-edge2 and artifactory-edge3 were all furnished with the the root certificate of artifactory1 and therefore trust it as a source. 

REST API

Mission Control supports managing Access Federation through the REST API.