Yuav Ua Li Cas Teeb Halbytes VPN Authentication
Introduction
Tam sim no koj muaj HailBytes VPN teeb tsa thiab teeb tsa, koj tuaj yeem pib tshawb xyuas qee qhov kev ruaj ntseg nta HailBytes yuav tsum muaj. Koj tuaj yeem tshawb xyuas peb qhov blog rau kev teeb tsa cov lus qhia thiab nta rau VPN. Hauv tsab xov xwm no, peb yuav hais txog cov txheej txheem kev lees paub uas txhawb nqa los ntawm HailBytes VPN thiab yuav ua li cas ntxiv ib qho kev lees paub.
Txheej txheem cej luam
HailBytes VPN muaj ntau txoj hauv kev authentication dua li kev lees paub hauv zos ib txwm muaj. Txhawm rau txo qhov kev pheej hmoo ntawm kev nyab xeeb, peb pom zoo kom kaw cov ntawv pov thawj hauv zos. Hloov chaw, peb pom zoo kom muaj ntau yam kev lees paub (MFA), OpenID Txuas, lossis SAML 2.0.
- MFA ntxiv ib txheej ntxiv ntawm kev ruaj ntseg nyob rau sab saum toj ntawm lub zos authentication. HailBytes VPN suav nrog cov qauv tsim hauv zos thiab kev txhawb nqa rau sab nraud MFA rau ntau tus neeg muab kev pabcuam nrov xws li Okta, Azure AD, thiab Onelogin.
- OpenID Connect yog txheej txheej tus kheej tsim los ntawm OAuth 2.0 raws tu qauv. Nws muab txoj hauv kev nyab xeeb thiab tsim nyog rau kev lees paub thiab tau txais cov ntaub ntawv siv los ntawm tus kws kho mob yam tsis tas yuav nkag mus rau ntau zaus.
- SAML 2.0 yog XML-raws li tus qauv qhib rau kev sib pauv cov ntaub ntawv pov thawj thiab kev tso cai ntawm ob tog. Nws tso cai rau cov neeg siv tuaj yeem lees paub ib zaug nrog tus neeg muab kev paub txog tus kheej yam tsis tas yuav rov txheeb xyuas dua kom nkag mus rau cov ntawv thov sib txawv.
OpenID Txuas nrog Azure Teeb
Hauv seem no, peb yuav piav qhia luv luv txog yuav ua li cas koom nrog koj tus kws kho mob tus kheej siv ODDC Multi-Factor Authentication. Cov lus qhia no yog npaj rau kev siv Azure Active Directory. Cov neeg muab kev qhia paub tus kheej sib txawv tuaj yeem muaj qhov tsis sib xws thiab lwm yam teeb meem.
- Peb pom zoo kom koj siv ib qho ntawm cov chaw muab kev pabcuam uas tau txais kev txhawb nqa thiab sim: Azure Active Directory, Okta, Onelogin, Keycloak, Auth0, thiab Google Workspace.
- Yog tias koj tsis siv tus kws kho mob ODC pom zoo, yuav tsum muaj kev teeb tsa hauv qab no.
a) discovery_document_uri: OpenID Connect tus neeg zov me nyuam teeb tsa URI uas xa rov qab cov ntaub ntawv JSON siv los tsim cov kev thov tom ntej rau ODC tus kws kho mob. Qee tus neeg muab kev pabcuam xa mus rau qhov no yog "zoo-paub URL".
b) client_id: Tus neeg siv khoom ID ntawm daim ntawv thov.
c) client_secret: Tus neeg siv khoom zais cia ntawm daim ntawv thov.
d) redirect_uri: Qhia ODC tus kws kho mob qhov twg kom hloov pauv tom qab kev lees paub. Qhov no yuav tsum yog koj qhov Firezone EXTERNAL_URL + /auth/oidc/ /callback/, xws li https://firezone.example.com/auth/oidc/google/callback/.
e) response_type: Teem rau code.
f) Scope: ODC cov peev txheej kom tau txais los ntawm koj tus kws kho mob ODC. Yam tsawg kawg nkaus, Firezone xav tau qhov qhib thiab email scopes.
g) daim ntawv lo: Cov ntawv khawm khawm tso tawm ntawm Firezone portal nplooj ntawv nkag.
- Nkag mus rau Azure Active Directory nplooj ntawv ntawm Azure portal. Xaiv lub App sau npe txuas hauv qab Tswj cov ntawv qhia zaub mov, nyem New Registration, thiab sau npe tom qab nkag mus rau hauv qab no:
a) Lub npe: Firezone
b) Cov hom nyiaj txhawb nqa: (Cov Ntawv Teev Npe Default nkaus xwb - Ib tus neeg xauj tsev)
c) Redirect URI: Qhov no yuav tsum yog koj qhov Firezone EXTERNAL_URL + /auth/oidc/ /callback/, xws li https://firezone.example.com/auth/oidc/azure/callback/.
- Tom qab sau npe, qhib cov ntsiab lus saib ntawm daim ntawv thov thiab luam daim ntawv thov (tus neeg siv) ID. Qhov no yuav yog tus nqi client_id.
- Qhib cov ntawv qhia zaub mov kawg kom rov qab tau cov ntaub ntawv OpenID Txuas metadata. Qhov no yuav yog tus nqi discovery_document_uri.
- Xaiv daim ntawv pov thawj & zais cia txuas hauv qab Tswj cov ntawv qhia zaub mov thiab tsim cov neeg siv khoom zais cia tshiab. Luam tus neeg siv khoom zais cia. Qhov no yuav yog tus client_secret tus nqi.
- Xaiv qhov API tso cai txuas hauv qab Tswj cov ntawv qhia zaub mov, nyem Ntxiv kev tso cai, thiab xaiv Microsoft Graph. Ntxiv email, openid, offline_access thiab profile rau qhov yuav tsum tau tso cai.
- Mus rau nplooj ntawv / nqis / kev ruaj ntseg hauv qhov chaw tswj hwm, nyem "Add OpenID Connect Provider" thiab sau cov ntsiab lus koj tau txais hauv cov kauj ruam saum toj no.
- Pab lossis lov tes taw Auto tsim cov neeg siv kev xaiv los tsim ib tus neeg siv tsis tau txais txiaj ntsig thaum kos npe los ntawm qhov kev lees paub no.
Nrog koj zoo siab! Koj yuav tsum pom Ib Daim Ntawv Sau Npe nrog Azure khawm ntawm koj nplooj ntawv kos npe.
xaus
HailBytes VPN muaj ntau yam kev lees paub, suav nrog ntau qhov kev lees paub, OpenID Txuas, thiab SAML 2.0. Los ntawm kev sib koom ua ke OpenID Txuas nrog Azure Active Directory raws li tau pom hauv tsab xov xwm, koj cov neeg ua haujlwm tuaj yeem nkag mus tau yooj yim thiab nyab xeeb rau koj cov peev txheej ntawm Huab lossis AWS.
