Ingabe i-VPN SSO ingena abasebenzisi ngokuzenzakalela ezinhlelweni zangaphakathi?

Ukungena okukodwa kungahlanganisa umhubhe kanye nezinhlelo ezilandelayo, kodwa kuphela uma uhlelo ngalunye lunokuzethemba kwalo. Nansi indlela yokuxhuma nokuhlola.

Isango le-VPN eliqinisekisa ngomhlinzeki wobunikazi likhombisa into eyodwa: umhlinzeki waqinisekisa umsebenzisi phambi kwesango. Aliniki lowo msebenzisi ubufakazi bokungena be-wiki yenethiwekhi yangaphakathi, idashibhodi yokuqapha noma iseva yokwakha. Lezo zinsizakalo zingisa abantu ngokuhlanganyela kwazo futhi zisebenzisa igunya lazo, futhi umhubhe unquma kuphela ukuthi yimaphi amaphakethe angafinyelela kuzo.

Izikhathi ezintathu, izinqumo ezintathu ezihlukene

Hlukanisa izimo, ngoba ngayinye iphela ngokohlelo lwayo. Isikhathi se-VPN ukwamukelwa kobunikazi yisango kanye nokufinyelela kwenethiwekhi okukunikezile. Isikhathi sesiphequluli kumhlinzeki wobunikazi yilokho isiphequluli sisakugcinile kulo mhlinzeki futhi singakusebenzisa futhi ngokwenqubomgomo yaso. Isikhathi sohlelo singesensizakalo eyodwa eqinisekise impendulo eyayithunyelwe kuyo.

Ukuhlanganisa lezo zimo kuveza umbuzo ongafanele, ngokuvamile obuzwa ngokuthi kungani umhubhe ungangeni umsebenzisi yonke indawo. Phinda uwubhale: yiluphi uhlelo olungenayo ingxenye yokuhlanganyela, yiluphi olwenqaba umsebenzisi, futhi yiluphi oluntula indlela. Isicelo esisodwa sokungena esivula uhlelo lwenethiwekhi yangaphakathi singase sibuyele kumhlinzeki, ngoba ukuhambisa kabusha kwesibili isicelo esisha segunya sababukeli abehlukile.

Xhuma isango njengohlelo lwaso

Bhalisa i-VPN njengohlelo olugunyaziwe kumhlinzeki, ngesikhombisi sayo, i-URI yokuhambisa kabusha nokwabiwa kwabasebenzisi. Bese unquma ukuthi lokho kungena kunikeza ziphi izigunyazo zenethiwekhi, ngoba inqubomgomo ye-VPN, hhayi isici somhlinzeki. Abasebenzisi okufanele bafinyelele kuphela isubnet yokuqapha bathola enye inqubomgomo yesango, hhayi elinye igama lokugqithisa.

Impendulo yokuqinisekisa yomhubhe akuyona ubufakazi obungasetshenziswa futhi. Amathokheni e-ID e-OIDC aphethe isimangalo sababukeli esisho iklayenti elakhelwe lona, futhi izitatimende ze-SAML ezithwalayo zikhawulela ababukeli kumhlinzeki wensizakalo owamukelayo. Insizakalo yesibili eyamukela impendulo yeyokuqala ayilungiswanga kahle, futhi ukukopisha ithokheni kwenye inhlelo akuyona ukuhlanganisa.

Bhalisa uhlelo ngalunye lwangaphakathi, bese usetha umongo wesiphequluli

Insizakalo ngayinye idinga amanani e-SAML noma e-OIDC asekelwayo: umkhiphi, isikhombisi seeklayenti, i-URL yokubuyela emuva noma yomsebenzisi wesitatimende, izimangalo ezidingekayo nokwabiwa. Ukufinyeleleka kuza phezulu, ngoba ukuhlola ubunikazi akunikezi indlela noma impendulo ye-DNS.

  1. Dala ingxenye yohlelo futhi qinisekisa ukuthi i-ID yebhizinisi noma yeklayenti iyahambisana nalokho okuthunyelwa uhlelo.
  2. Bhalisa i-URL eqondile yokubuyela emuva kufaka phakathi isikimu nechweba; iphutha elincane lehluleka ngemva kokuba umsebenzisi eqinisekisile.
  3. Aba abasebenzisi noma amaqembu, bese uqinisekisa ukuthi izimangalo ezidingekayo ziyakhishwa.
  4. Vumela amaphoyinti okugcina omhlinzeki wobunikazi kanye nohlelo oluyimfihlo, ngaphandle kwalokho ukuhambisa kabusha ngeke kuqede.

Umongo wesiphequluli unquma ukuthi isikhathi somhlinzeki esivele sikhona sizosetshenziswa futhi yini. Iklayenti lendabuko elivula isiphequluli sohlelo lingabelana ngaleyo simo, kuyilapho umbono oshumekiwe onomgqomo wamakhukhi wawo ngokuvamile ungeke ukwazi. Isiphequluli esisha, amawindi ayimfihlo nephrofayili yesibili konke kuqala kusukela kuqanda, lokho kulindelekile hhayi ukumiswa kwe-SSO okuphukile.

Gijimisa ukugeleza bese ufunda lapho kuma khona

Phinda ukhiqize ngephaneli yenethiwekhi yesiphequluli futhi ubuke uchungechunge lokuhambisa kabusha. Uhambo olusizayo lulandela ukugxuma okukodwa ngesikhathi: isango kuya kumhlinzeki, umhlinzeki abuyele ohlelweni enekhodi noma isitatimende, uhlelo luya endaweni yokugcina yamathokheni omhlinzeki, isikhathi sohlelo sikhishiwe. Ukugxuma lapho uchungechunge luma khona kusho ingxenye okufanele ilungiswe.

Ukuhlola okubili komugqa womyalo kuxazulula ukungabaza okuvamile, futhi kokubili kuphephile ukukugijimisa kusuka kusibungu somlawuli:

curl -s https://idp.example.com/.well-known/openid-configuration | jq -r '.authorization_endpoint, .token_endpoint'
curl -sI https://app.example.net/ | grep -iE '^(HTTP/|location:)'

Lapho imethadatha ibala amaphoyinti okugcina ongakaze uwabhalise, uhlelo lukhomba kumqashi noma umkhiphi ohlukile. Lapho isicelo sokuqala sohlelo siphendula nge-302 kuya kusibungu esingalindelekile, indawo okufanele ibhekwe inqubo yokuhlanganyela yohlelo, hhayi iphrofayili ye-VPN.

Lungisa izicelo ngokuthola ukuthi ubani uzicelile

Isicelo sesibili segama lokugqithisa akusona iphutha ngokuzenzakalela. Uhlelo lungase lufune izinga eliphezulu lokuqinisekisa, noma umhlinzeki angase aphoqelele iminyaka ephezulu yesikhathi kanye nenselelo entsha. Ukususa lezo zidingo ukuze ukugeleza kuthule kakhulu kwenza buthaka ukulawula okuhlosiwe, ngakho thola ukuthi iyiphi ingxenye eyacela ngaphambi kokushintsha inqubomgomo.

Bese unquma ukuthi yini okufanele ithuthukiswe. Uma isicelo sivela ohlelweni, lungisa ingxenye yalo yokuhlanganyela. Uma sivela kumhlinzeki ngokwenqubomgomo, bhala phansi isidingo. Uma uhlelo lungafinyeleleki ngemva kokungena okuphumelelayo, umzila womhubhe uyasolwa, ngoba ubunikazi nokulethwa kwamaphakethe kwehluleka ezindaweni ezihlukene futhi kubonakala kufana esihlalweni somsebenzisi.

Izihloko ezihlobene