Adding a login warning banner for the Ops Center Portal

Use this command to start or stop Analyzer server services. The command also displays the Analyzer server service status or changes the service start method.

Format

To start, stop, or display only the status of a specific service:

hcmds64srv
     {-start | -stop | -check | -status}
     [-server service-name]

To display the status of services of Analyzer server and products that use Common component:

hcmds64srv
        -statusall

To change the start method of a service:

hcmds64srv
        -starttype {auto | manual}
        {-server service-name | -all}

Options

start

Starts the service and database you specified in the server option.

stop

Stops the service and database you specified in the server option.

status

Displays the status of the server and database you specified in the server option.

server service-name

To start, stop, or display the status of Analyzer server product services only, specify AnalyticsWebService as the service name. By running this command by specifying AnalyticsWebService in the server option, you can start, stop, or display the status of the following services:

Service display name and process	Start	Stop	Status display
HAnalytics Engine Web Service	Y	Y	Y
HBase 64 Storage Mgmt Web Service	Y	N	N
HBase 64 Storage Mgmt Web SSO Service	Y	N	N
Database process*	Y	N	N
Legend: Y: Processed N: Not processed
* An Analyzer server internal process corresponding to the service HiRDB/EmbeddedEdition _HD1

If you omit the server option, the next service is started, stopped, or the status of the next service displays.

Service display name and process	Start	Stop	Status display
HAnalytics Engine Web Service	Y	Y	Y
HBase 64 Storage Mgmt SSO Service	Y	Y	Y
HBase 64 Storage Mgmt Web Service	Y	Y	Y
HBase 64 Storage Mgmt Web SSO Service	Y	Y	Y
Database process*	Y	Y	Y
Service of products that use Common component	Y	Y	Y
Legend: Y: Processed
* An Analyzer server internal process corresponding to the service HiRDB/EmbeddedEdition _HD1

statusall

Displays the service and data statuses, and the status of the products registered in Common component. If you omit the server option, this argument is used.

starttype {auto | manual}

Specify the start type of the service with the server option. Specify auto for an automatic start. Specify manual for a manual start.

all

If you specify this option, the command runs for all services of Analyzer server and other products that use Common component.

Execution Permission

root permission

Location

In Windows

Common-component-installation-folder\bin

In Linux

Common-component-installation-directory/bin

Notes

• If you start or stop Analyzer server services as a daily operation, omit the server option to start or stop all the services. To start only Analyzer server services by specifying the server option, specify AnalyticsWebService for the server option to start Common component service.
• If you run the command with the stop option and the termination processing does not end within three minutes, an error occurs and a message is displayed to indicate a time-out. In this case, wait a while, and then rerun the command with the stop option.
• If you start or stop a service with the start or stop option, the command might end while the service does not start or stop completely. To confirm that the service has completely started or stopped, use either of the following operations:
  • Confirm that either of the following messages has been output to a disclosed log or the event logsyslog:

    At startup

    KNAQ10086-I Application is running.

    When stopped

    KNAQ10089-I Application is stopped.

  • Specify the statusall option to check the status of the service.

Return values

The following table shows the return values of the command with start option or stop option:

The following table shows the return values of the command with the check, status, or statusall option:

The following table shows the return values of the command with the starttype option:

Examples

hcmds64srv -start

hcmds64srv -stop

hcmds64srv -status

hcmds64srv -start -server AnalyticsWebService

diagdata is a CLI tool that is used to aid diagnostic testing of Ops Center Protector. It provides the following functions:

• Stopping and starting of Ops Center Protector services
• Resetting the Ops Center Protector system state
• Raising and lowering of trace level for diagnostics
• Collection of Ops Center Protector state information to aid investigation of issues

Command line options

You create backups by running Protector and selecting one or more Ops Center product components.

The restoration process consists of two stages, restore and recovery:

1. Restoring backup archives to the proper node using Protector.
2. Recovering each application by manually extracting the archive and running the required commands to bring it back online.

Accessing the RPM packages using the Linux OS media

1. Mount the Linux OS media and obtain the RPM packages:

   mkdir /media/OSImage
   mount /dev/cdrom /media/OSImage

2. Configure the yum repository.

   touch /etc/yum.repos.d/OSImage.repo
   echo [dvd-baseos]>>/etc/yum.repos.d/OSImage.repo
   echo name=dvd-baseos>>/etc/yum.repos.d/OSImage.repo
   echo baseurl=file:///media/OSImage/BaseOS/>>/etc/yum.repos.d/OSImage.repo
   echo gpgcheck=0>>/etc/yum.repos.d/OSImage.repo
   echo enabled=1>>/etc/yum.repos.d/OSImage.repo
   echo >>/etc/yum.repos.d/OSImage.repo
   echo [dvd-appstream]>>/etc/yum.repos.d/OSImage.repo
   echo name=dvd-appstream>>/etc/yum.repos.d/OSImage.repo
   echo baseurl=file:///media/OSImage/AppStream/>>/etc/yum.repos.d/OSImage.repo
   echo gpgcheck=0>>/etc/yum.repos.d/OSImage.repo
   echo enabled=1>>/etc/yum.repos.d/OSImage.repo

Accessing the RPM packages using the distribution website

1. Specify the repository to which the yum command will connect.
   • For Red Hat Enterprise Linux, register the system by using Red Hat Subscription Management. For details, see https://access.redhat.com/articles/11258.
   • For Oracle Linux, the initial settings are set by default (the file repo is already located in the directory /etc/yum.repos.d). For details, see http://yum.oracle.com/getting-started.html.
2. If you are using a proxy, specify the proxy for the yum command:
   1. Add the following information to the /etc/yum.conf file:

      proxy=http://host-name:port-number
      proxy_username=user-name
      proxy_password=password

   2. Clear the cache for the yum command.

      yum clean all

Using the yum command

To update all packages for which security-related errata are available (including packages with bug fixes or new features without security errata):

yum --security --exclude kernel* --exclude *podman* --exclude *containers-common* upgrade

To update all packages for which security-related errata are available (ignoring any newer packages without security errata):

yum --security --exclude kernel* --exclude *podman* --exclude *containers-common* upgrade-minimal

To update all kernel and podman packages to the latest supported versions that contain security errata, follow these examples.

For Red Hat kernel (must specify supported kernel version):

yum --security upgrade-minimal kernel-4.18.0-305.*

For Unbreakable Enterprise kernel (must specify supported uek kernel version):

yum --security upgrade-minimal kernel-uek-5.4.17-2102.*

For podman (must specify supported podman version):

yum --security upgrade-minimal podman-3.3.*

You can also update only those packages that correspond to a CVE or erratum, as in the following examples:

yum --cve CVE-2021-37576 upgrade-minimal

For Red Hat Enterprise Linux:

yum --advisory RHSA-2021:4056 upgrade-minimal

For Oracle Linux:

yum --advisory ELSA-2021-9474 upgrade-minimal

The following table provides the commands for collecting log files from Ops Center component products.

Three types of log files are output for Common Services.

Output-destination directory

/var/log/hitachi/CommonService

Log files

Log file	Description
error.log	The Common Services error log is output to this file. Check the contents of this file as needed.
debug.log	This log file is necessary for customer support to analyze the cause of a failure when, for example, you cannot identify the cause or cannot perform recovery.
server.log	This log file is necessary for customer support to analyze the cause of a failure when, for example, you cannot identify the cause or cannot perform recovery.

The following items are output to error.log.

Output destination

The audit log is output to the syslog.

Output items

The following items are output to the audit log.

The auditing event types that are output and their corresponding severity levels are as follows. You can change the properties of the audit log to narrow down the severity levels that are output.

Auditing events output to the audit log

Common Services outputs the following types of auditing events to the audit log. A message to be output consists of a message ID and message text.

The following shows the message ID format:

prefixNNNNN-x

A message ID consists of the following elements:

prefix

Indicates the component from which the message is output. The prefix of audit log messages is KAOP.

NNNNN

Indicates the serial number of the message. The serial number differs depending on the type.

• KAOP9800N: Authentication message
• KAOP90NNN: ConfigurationAccess message

x

Indicates the message type. The following shows the message types and their meanings:

• E (Error): Message that notifies users of an error that prevents processing from continuing
• I (Information): Message that notifies users of information

If the auditing event type is Authentication:

If the auditing event type is ConfigurationAccess:

In Linux

• You must have root permission.
• To interrupt a running command, press Ctrl C and make sure that you read any messages and check for problems. If necessary, repeat the command. If you interrupt a command, the return value might be undefined.
• If the maximum output size of the core file is set to 0, core dumps are effectively disabled. To output a core dump when a failure occurs, run the ulimit command before running each command, and set the maximum output size to unlimited.

In Windows

Note the following when using commands with RAID Agent on a Windows host:

• You must have Administrator permission.
• Run the commands in the administrator console.
  1. From the desktop, display the Start window.
  2. In the Analyzer RAID Agent folder, select Ops Center Analyzer Administrator Console.
     Note: The display might vary depending on the OS version.
• If you enable Quick Edit Mode in the command prompt and then click the mouse in the window, the window output stops until Quick Edit Mode is canceled. For best results, do not use Quick Edit Mode.

The hcmds64getlogs command acquires maintenance information on the management server.

The syntax is:

hcmds64getlogs /dir folder-name [/types Automation] [/arc archive-file-name] [/logtypes log-file-type[ log-file-type ...]] 

where:

• /dir specifies the absolute path to the folder on a local disk that contains collected maintenance information. If the folder has already been created, empty the folder.

  The maximum length of a path name that can be specified is 100 bytes. You can specify any printable ASCII character excluding certain special characters. You cannot specify the following characters:

  \ / : , ; * ? " < > | $ % & ' `

  However, you can specify backslashes (\), colons (:), and forward slashes (/) in Windows, or forward slashes (/) in Linux as a path delimiter. Do not specify a path delimiter at the end of a path name.

  In Windows, to specify a space character in a path name, enclose the path name in double quotation marks ("). In Linux, you cannot specify a space character in a path name.

• /types Automation specify Automation if the maintenance information for only Ops Center Automator can be collected. When specifying this option, also specify the log file type log for the /logtypes option. If this option is not specified, the Ops Center Automator server and all products using Common Component installed on the same management server is collected.
• /arc specifies the name of the archive files to be created. If you do not specify this option, the default file name is HiCommand_log_64.

  For the file name, you can specify any printable ASCII character excluding certain special characters. You cannot specify the following characters:

  \ / : , ; * ? " < > | $ % & ' `

  In Linux, you cannot specify a space character in a file name.

• /logtypes specifies the types of log files to acquire when log files of a particular type cannot be collected due to a failure.
  • log: Specify this to acquire .jar files and .hdb.jar files only.
  • db: Specify this to acquire .db.jar files only.
  • csv: Specify this to acquire .csv.jar files only.

  To specify multiple types, separate them by a space.

  If you omit this option, all log files will be acquired.

Remarks

• Do not interrupt this command while it is running.
• If the hcmds64getlogs command is interrupted, this command has ended before this command completed due to insufficient free space in the folder specified in the /dir option. In this case, make sure that the folder has enough free space, and then execute this command again.
• Do not run more than one hcmds64getlogs command at the same time.
• When Ops Center Automator is running in a cluster configuration, execute this command on both the active host and standby host. You can run this command even if the Ops Center Automator server is not running. Therefore, even if an error occurs in a cluster configuration, you can collect log information without switching nodes. However, if the database is not running, you cannot obtain the database information.
• If the same option is specified more than one time, only the first option is effective.

Execution permission

None.

Request line

POST base-URL/auth/v1/providers/builtin/token

Request message

Object ID

None.

Query parameters

None.

Body

{
  "username" : "TestUser",
  "password" : "password"
}

Attribute	Type	Description
username	string	(Required) Username of the user who wants to acquire an access token
password	string	(Required) Password of the user who wants to acquire an access token

Response message

Body

{
  "access_token" : "access token",
  "expires_in" : 300,
  "token_type" : "bearer"
}

Attribute	Type	Description
access_token	string	Character string that serves as the access token
expires_in	int	Period of validity (in seconds) of the access token
token_type	string	Access token type A fixed string (bearer) is returned.

Coding example

curl -v -X POST -H "Content-Type:application/json" -s "https://example.com:443/portal/auth/v1/providers/builtin/token" -d @./request.json

Execution permission

None.

Request line

GET base-URL/auth/v1/providers/builtin/userinfo

Request message

Object ID

None.

Query parameters

None.

Body

None.

Response message

Body

{
    "sub": "63583645-fc6f-416d-94a1-1e0719247f4d",
    "name": "john smith",
    "given_name": "john",
    "family_name": "smith",
    "preferred_username": "john_smith",
    "email": "john_smith@example.com",
    "email_verified": false,
    "https://opscenter/user_groups": [
        "92d2677b-a3a2-4643-a908-49ade439e0d4"
    ],
    "https://opscenter/user_is_enabled": true,
    "https://opscenter/roles": [
        "opscenter-user",
        "offline_access",
        "uma_authorization"
    ]
}

Attribute	Type	Description
sub	string	Object ID of the user
name	string	Full name of the user
given_name	string	First name of the user
family_name	string	Last name of the user
preferred_username	string	Username
email	string	Email address
email_verified	boolean	Whether or not the email address is verified true: Verified false: Not verified
https://opscenter/user_groups	string[]	ID of the user group that the user belongs to
https://opscenter/user_is_enabled	boolean	Whether the user account is enabled true: The user account is enabled. false: The user account is disabled.
https://opscenter/roles	string[]	ID of the role that was assigned to the user

Coding example

curl -v -X GET -s "https://example.com:443/portal/auth/v1/providers/builtin/userinfo" -H "Authorization:Bearer eyJhbxxx"

Execution permission

You must be a system administrator or a security administrator.

Request line

POST base-URL/security/v1/external-user-storage-test-connection

Request message

Object ID

None.

Query parameters

None.

Body

To perform only a connection test:

{
    "action": "testConnection",
    "connectionUrl": "ldaps://example.com"
}

To perform both a connection test and an authentication test:

{
    "action": "testAuthentication",
    "connectionUrl": "ldaps://example.com",
    "bindDn": "admin@example.com",
    "bindCredential": "password"
}

Attribute	Type	Description
action	string	(Required) Type of test Specify either of the following: testConnection: Specify this attribute to test whether the connection destination specified by the connectionUrl attribute is accessible. testAuthentication: Specify this attribute to test whether the connection destination specified by the connectionUrl attribute is accessible and whether authentication can be performed by using the authentication information specified by the bindDn and bindCredential attributes.
connectionUrl	string	(Required) URL of the connection-destination Active Directory server Specify a URL that starts with ldaps:// or ldap://.
bindDn	string	(Optional) Bind DN If you specified testAuthentication for the action attribute, you must specify this attribute.
bindCredential	string	(Optional) Password for the bind DN If you specified testAuthentication is specified for the action attribute, you must specify this attribute.

Response message

Body

None.

Coding example

curl -v -X POST -H "Content-Type:application/json" -s "https://example.com:443/portal/security/v1/external-user-storage-test-connection" -d @./request.json  -H "Authorization:Bearer eyJhbxxx"

Execution permission

You must be a system administrator or a security administrator.

Request line

GET base-URL/security/v1/external-user-storage

Request message

Object ID

None.

Query parameters

None.

Body

None.

Response message

Body

For Active Directory servers

[
    {
        "id": "1022c8b2-934e-4097-8112-64b0274a3653",
        "name": "ldap-srv2",
        "priority": 1,
        "userAuthenticationProtocol": "LDAP",
        "vendor": "ACTIVE_DIRECTORY",
        "connectionUrl": "ldaps://vm.ldap-srv2.soft.example.co.jp",
        "baseDn": "CN=Users,DC=ldap-srv2,DC=soft,DC=example,DC=co,DC=jp",
        "bindDn": "admin@ldap-srv2.soft.example.co.jp",
        "bindPassword": null,
        "groupBaseDn": "CN=Users,DC=ldap-srv2,DC=soft,DC=example,DC=co,DC=jp",
        "groupEntryDnList": [
            "CN=admins,CN=Users,DC=ldap-srv2,DC=soft,DC=example,DC=co,DC=jp",
            "CN=users,CN=Users,DC=ldap-srv2,DC=soft,DC=example,DC=co,DC=jp"
        ],
        "kerberosRealm": null,
        "enabled": true,
        "defaultGroupMappingEnabled": false,
        "config": {
            "customUserSearchFilter": "(ou=Ops Center*)"
        }
    }
]

For LDAP servers

[
    {
        "id": "1022c8b2-934e-4097-8112-64b0274a3653",
        "name": "ldap-srv2",
        "priority": 1,
        "userAuthenticationProtocol": "LDAP",
        "vendor": "GENERAL",
        "connectionUrl": "ldaps://vm.ldap-srv2.soft.example.co.jp",
        "baseDn": "CN=Users,DC=ldap-srv2,DC=soft,DC=example,DC=co,DC=jp",
        "bindDn": "admin@ldap-srv2.soft.example.co.jp",
        "bindPassword": null,
        "groupEntryDnList": null,
        "kerberosRealm": null,
        "enabled": true,
        "defaultGroupMappingEnabled": true,
        "config": {
            "usernameLDAPAttribute": "userPrincipalName",
            "rdnLDAPAttribute": "cn",
            "customUserSearchFilter": "(ou=Ops Center*)",
            "lastNameLDAPAttribute": "sn",
            "emailLDAPAttribute": "mail",
            "fullNameLDAPAttribute": "cn",
            "searchScope": "2",
            "uuidLDAPAttribute": "objectGUID",
            "userObjectClasses": "person, organizationalPerson"
        }
    }
]

Attribute	Type	Description
id	string	Object ID
name	string	Server name
priority	int	Priority
userAuthenticationProtocol	string	Authentication method LDAP Kerberos
vendor	string	Type of directory service ACTIVE_DIRECTORY: Active Directory GENERAL: Not Active Directory
connectionUrl	string	URL of the connection-destination Active Directory or LDAP server
baseDn	string	User base DN
bindDn	string	Bind DN
bindPassword	string	Password for the bind DN
groupBaseDn	string	Group base DN When the vendor attribute is ACTIVE_DIRECTORY, this attribute is displayed.
groupEntryDnList	string[]	List of DNs of the groups to be synchronized If the value of the vendor attribute is GENERAL, the value null is always returned.
kerberosRealm	string	Realm name for Kerberos authentication If the value of the userAuthenticationProtocol attribute is LDAP, the value null is always returned.
enabled	boolean	Whether the server setting is enabled true: Enabled false: Disabled
defaultGroupMappingEnabled	boolean	Whether all the users under the User base DN of the Active Directory or LDAP server are allocated to the opscenter-users group true: The users are allocated to the group. false: The users are not allocated to the group.
config	object	Configuration information of the Active Directory or LDAP server When the vendor attribute is ACTIVE_DIRECTORY, the following configuration information of the Active Directory server is displayed. customUserSearchFilter (string) The search filter for narrowing down the users to be displayed in the Users window of the Hitachi Ops Center Portal When the vendor attribute is GENERAL, the following configuration information of the LDAP server is displayed. usernameLDAPAttribute (string) The LDAP attribute allocated to the user ID emailLDAPAttribute (string) The LDAP attribute allocated to the email address of the user account lastNameLDAPAttribute (string) The LDAP attribute allocated to the last name of the user account fullNameLDAPAttribute (string) The LDAP attribute allocated to the full name of the user account When information is set for the firstNameLDAPAttribute attribute, this attribute is not displayed. firstNameLDAPAttribute (string) The LDAP attribute allocated to the first name of the user account When information is set for the fullNameLDAPAttribute attribute, this attribute is not displayed. rdnLDAPAttribute (string) The LDAP attribute used as the RDN uuidLDAPAttribute (string) The LDAP attribute used as the UUID userObjectClasses (string) The object class of the users to be imported searchScope (string) The range of hierarchy levels in which to search for the users to be imported 1: One level 2: Subtree customUserSearchFilter (string) The search filter for narrowing down the users to be imported

Coding example

curl -v -X GET -s "https://example.com:443/portal/security/v1/external-user-storage" -H "Authorization:Bearer eyJhbxxx"

Execution permission

You must be a system administrator or a security administrator.

Request line

GET base-URL/security/v1/external-user-storage/object-ID-of-the-server

Request message

Object ID of the server

Specify the value of id acquired by using the request for getting a list of Active Directory or LDAP servers.

Attribute	Type	Description
id	string	(Required) Object ID of the Active Directory or LDAP server

Query parameters

None.

Body

None.

Response message

Body

For an Active Directory server

{
    "id": "1022c8b2-934e-4097-8112-64b0274a3653",
    "name": "ldap-srv2",
    "priority": 1,
    "userAuthenticationProtocol": "LDAP",
    "vendor": "ACTIVE_DIRECTORY",
    "connectionUrl": "ldaps://vm.ldap-srv2.soft.example.co.jp",
    "baseDn": "CN=Users,DC=ldap-srv2,DC=soft,DC=example,DC=co,DC=jp",
    "bindDn": "admin@ldap-srv2.soft.example.co.jp",
    "bindPassword": null,
    "groupBaseDn": "CN=Users,DC=ldap-srv2,DC=soft,DC=example,DC=co,DC=jp",
    "groupEntryDnList": [
        "CN=admins,CN=Users,DC=ldap-srv2,DC=soft,DC=example,DC=co,DC=jp",
        "CN=users,CN=Users,DC=ldap-srv2,DC=soft,DC=example,DC=co,DC=jp"
    ],
    "kerberosRealm": null,
    "enabled": true,
    "defaultGroupMappingEnabled": false,
    "config": {
            "customUserSearchFilter": "(ou=Ops Center*)"
        }
}

For an LDAP server

{
    "id": "1022c8b2-934e-4097-8112-64b0274a3653",
    "name": "ldap-srv2",
    "priority": 1,
    "userAuthenticationProtocol": "LDAP",
    "vendor": "GENERAL",
    "connectionUrl": "ldaps://vm.ldap-srv2.soft.example.co.jp",
    "baseDn": "CN=Users,DC=ldap-srv2,DC=soft,DC=example,DC=co,DC=jp",
    "bindDn": "admin@ldap-srv2.soft.example.co.jp",
    "bindPassword": null,
    "groupEntryDnList": null,
    "kerberosRealm": null,
    "enabled": true,
    "defaultGroupMappingEnabled": true,
    "config": {
        "usernameLDAPAttribute": "userPrincipalName",
        "rdnLDAPAttribute": "cn",
        "customUserSearchFilter": "(ou=Ops Center*)",
        "lastNameLDAPAttribute": "sn",
        "emailLDAPAttribute": "mail",
        "fullNameLDAPAttribute": "cn",
        "searchScope": "2",
        "uuidLDAPAttribute": "objectGUID",
        "userObjectClasses": "person, organizationalPerson"
    }
}

Attribute	Type	Description
id	string	Object ID of the Active Directory or LDAP server
name	string	Server name
priority	int	Priority
userAuthenticationProtocol	string	Authentication method LDAP Kerberos
vendor	string	Type of directory service ACTIVE_DIRECTORY: Active Directory GENERAL: Not Active Directory
connectionUrl	string	URL of the connection-destination Active Directory or LDAP server
baseDn	string	User base DN
bindDn	string	Bind DN
bindPassword	string	Password for the bind DN
groupBaseDn	string	Group base DN When the vendor attribute is ACTIVE_DIRECTORY, this attribute is displayed.
groupEntryDnList	string[]	List of DNs of the groups to be synchronized If the value of the vendor attribute is GENERAL, the value null is always returned.
kerberosRealm	string	Realm name for Kerberos authentication If the value of the userAuthenticationProtocol attribute is LDAP, the value null is always returned.
enabled	boolean	Whether the server setting is enabled true: Enabled false: Disabled
defaultGroupMappingEnabled	boolean	Whether all the users under the User base DN of the Active Directory or LDAP server are allocated to the opscenter-users group true: The users are allocated to the group. false: The users are not allocated to the group.
config	object	Configuration information of the Active Directory or LDAP server When the vendor attribute is ACTIVE_DIRECTORY, the following configuration information of the Active Directory server is displayed. customUserSearchFilter (string) The search filter for narrowing down the users to be displayed in the Users window of the Hitachi Ops Center Portal When the vendor attribute is GENERAL, the following configuration information of the LDAP server is displayed. usernameLDAPAttribute (string) The LDAP attribute allocated to the user ID emailLDAPAttribute (string) The LDAP attribute allocated to the email address of the user account lastNameLDAPAttribute (string) The LDAP attribute allocated to the last name of the user account fullNameLDAPAttribute (string) The LDAP attribute allocated to the full name of the user account When information is set for the firstNameLDAPAttribute attribute, this attribute is not displayed. firstNameLDAPAttribute (string) The LDAP attribute allocated to allocated to the first name of the user account When information is set for the fullNameLDAPAttribute attribute, this attribute is not displayed. rdnLDAPAttribute (string) The LDAP attribute used as the RDN uuidLDAPAttribute (string) The LDAP attribute used as the UUID userObjectClasses (string) The object class of the users to be imported searchScope (string) The range of hierarchy levels in which to search for users to be imported 1: One level 2: Subtree customUserSearchFilter (string) The search filter for narrowing down the users to be imported

Coding example

curl -v -X GET -s "https://example.com:443/portal/security/v1/external-user-storage/1022c8b2-934e-4097-8112-64b0274a3653" -H "Authorization:Bearer eyJhbxxx"

Execution permission

You must be a system administrator or a security administrator.

Request line

GET base-URL/security/v1/kerberos-realm

Request message

Object ID

None.

Query parameters

None.

Body

None.

Response message

Body

[
    {
        "id": "8a44f59a6f87e5d4016f880c544c0000",
        "realm": "LDAP-SRV2.SOFT.EXAMPLE.CO.JP",
        "kdcs": [
            "vm.ldap-srv2.soft.example.co.jp"
        ]
    }
]

Attribute	Type	Description
id	string	Object ID of the realm
realm	string	Realm name
kdcs	string[]	List of KDC servers

Coding example

curl -v -X GET -s "https://example.com:443/portal/security/v1/kerberos-realm" -H "Authorization:Bearer eyJhbxxx"

Execution permission

You must be a system administrator or a security administrator.

Request line

GET base-URL/security/v1/kerberos-realm/object-ID-of-the-realm

Request message

Object ID of the realm

Specify the value of id acquired by using the request for getting information about a list of realms for Kerberos authentication.

Attribute	Type	Description
id	string	(Required) Object ID of the realm

Query parameters

None.

Body

None.

Response message

Body

{
    "id": "8a44f59a6f87e5d4016f880c544c0000",
    "realm": "LDAP-SRV2.SOFT.EXAMPLE.CO.JP",
    "kdcs": [
        "vm.ldap-srv2.soft.example.co.jp"
    ]
}

Attribute	Type	Description
id	string	Object ID of the realm
realm	string	Realm name
kdcs	string[]	List of KDC servers

Coding example

curl -v -X GET -s "https://example.com:443/portal/security/v1/kerberos-realm/4028b8816e4ad3ee016e5d76637c0000" -H "Authorization:Bearer eyJhbxxx"

Execution permission

You must be a system administrator or a security administrator.

Request line

GET base-URL/security/v1/kerberos-connection-settings

Request message

Object ID

None.

Query parameters

None.

Body

None.

Response message

Body

{
    "clockskew" : 0,
    "dnsLookupKdc" : true
}

Attribute	Type	Description
clockskew	int	Allowable time difference between Common Services and the Kerberos server (in seconds)
dnsLookupKdc	boolean	Whether to query the DNS server for KDC information true: Queries the server. false: Does not query the server.

Coding example

curl -v -X GET -s "https://example.com:443/portal/security/v1/kerberos-connection-settings" -H "Authorization:Bearer eyJhbxxx"

Execution permission

You must be a system administrator or a security administrator.

Request line

POST base-URL/security/v1/external-user-storage-test-search-limit-exceeded

Request message

Object ID

None.

Query parameters

None.

Body

{
    "connectionUrl": "ldaps://example.com",
    "bindDn": "cn=Directory Manager",
    "bindPassword": "password",
    "baseDn": "OU=Subtree,DC=example,DC=com",
    "objectClasses": "person, organizationalPerson",
    "searchScope": "1",
    "customUserSearchFilter": "(ou=Ops Center*)",
    "usernameLDAPAttribute": "uid"
}

Attribute	Type	Description
connectionUrl	string	(Required) URL of the connection-destination Active Directory or LDAP server
bindDn	string	(Required) Bind DN
bindPassword	string	(Required) Password for the bind DN
baseDn	string	(Required) User base DN
objectClasses	string	(Required) For an Active Directory server Specify person,organizationalPerson,user. For an LDAP server The object class of the users to be acquired To specify multiple values, separate the values by using commas.
searchScope	string	(Required) For an Active Directory server Specify 2. For an LDAP server The range of hierarchy levels in which to search for users to be acquired Specify either of the following. 1: One level 2: Subtree
customUserSearchFilter	string	(Optional) The search filter for narrowing down the users to be acquired The syntax of the search filter conforms to RFC 2254.
usernameLDAPAttribute	string	(Required) For an Active Directory server Specify sAMAccountName. For an LDAP server LDAP attribute that uniquely identifies the user to be acquired

Response message

Body

{
    "count" : 5,
    "maxValue" : 100
}

Attribute	Type	Description
count	int	The number of users acquired from the Active Directory or LDAP server If the number of users is greater than the value of the maxValue attribute, -1 is returned.
maxValue	int	The maximum number of users that can be displayed in the Users window of the Hitachi Ops Center Portal

Coding example

curl -v -X POST -H "Content-Type:application/json" -s "https://example.com:443/portal/security/v1/external-user-storage-test-search-limit-exceeded" -d @./request.json -H "Authorization:Bearer eyJhbxxx"

Execution permission

You must be a system administrator or a security administrator.

Request line

GET base-URL/idp/v1/external-identity-provider

Request message

Object ID

None.

Query parameters

None.

Body

None.

Response message

Body

When the federation protocol is OIDC

[
    {
        "providerType": "ADFS",
        "protocol": "oidc",
        "alias": "ad5oidc",
        "displayName": "AD5OIDC",
        "fromUrl": "https://adfs.example.com/adfs/.well-known/openid-configuration",
        "enabled": true,
        "guiOrder": 1,
        "defaultGroupList": [
            {
                "localGroupId": "a39f9e45-5e2e-446b-89d3-93f9e9ec4c31",
                "localGroupName": "opscenter-users"
            }
        ],
        "customGroupList": [
            {
                "idpGroupName": "opscenter-ad5\\opscenter_admins",
                "localGroupId": "9fd2ef28-5077-4816-ade8-526204f4d2ac",
                "localGroupName": "opscenter-administrators"
            }
        ],
        "clientId": "a49d4539-c080-4436-8bcb-113271b5152a",
        "clientSecret": "**********",
        "config": {
            "userInfoUrl": "https://adfs.example.com/adfs/userinfo",
            "validateSignature": "true",
            "redirectURI": "https://example.com:8443/auth/realms/opscenter/broker/ad5oidc/endpoint",
            "clientId": "a49d4539-c080-4436-8bcb-113271b5152a",
            "tokenUrl": "https://adfs.example.com/adfs/oauth2/token/",
            "jwksUrl": "https://adfs.example.com/adfs/discovery/keys",
            "issuer": "https://adfs.example.com/adfs",
            "useJwksUrl": "true",
            "authorizationUrl": "https://adfs.example.com/adfs/oauth2/authorize/",
            "clientAuthMethod": "client_secret_post",
            "disableUserInfo": "true",
            "fromUrl": "https://adfs.example.com/adfs/.well-known/openid-configuration",
            "logoutUrl": "https://adfs.example.com/adfs/oauth2/logout",
            "syncMode": "FORCE",
            "clientSecret": "**********",
            "allowedClockSkew": "300",
            "defaultScope": "https://example.com/openid https://example.com/allatclaims"
        }
    }
]

When the federation protocol is SAML

[
    {
        "providerType": "ADFS",
        "protocol": "saml",
        "alias": "ad5saml",
        "displayName": "AD5SAML",
        "fromUrl": "https://adfs.example.com/FederationMetadata/2007-06/FederationMetadata.xml",
        "enabled": true,
        "guiOrder": 1,
        "defaultGroupList": [
            {
                "localGroupId": "a39f9e45-5e2e-446b-89d3-93f9e9ec4c31",
                "localGroupName": "opscenter-users"
            }
        ],
        "customGroupList": [
            {
                "idpGroupName": "opscenter-ad5\\opscenter_admins",
                "localGroupId": "9fd2ef28-5077-4816-ade8-526204f4d2ac",
                "localGroupName": "opscenter-administrators"
            }
        ],
        "clientId": null,
        "clientSecret": null,
        "config": {
            "redirectURI": "https://example.com:8443/auth/realms/opscenter/broker/ad5saml/endpoint",
            "samlXmlKeyNameTranformer": "KEY_ID",
            "postBindingLogout": "true",
            "postBindingResponse": "true",
            "singleLogoutServiceUrl": "https://adfs.example.com/adfs/ls/",
            "claimEmail": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
            "claimFirstname": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
            "claimGroup": "http://schemas.xmlsoap.org/claims/Group",
            "claimLastname": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname",
            "xmlSigKeyInfoKeyNameTransformer": "CERT_SUBJECT",
            "metadataEndpoint": "https://example.com:8443/auth/realms/opscenter/broker/ad5saml/endpoint/descriptor",
            "syncMode": "FORCE",
            "singleSignOnServiceUrl": "https://adfs.example.com/adfs/ls/",
            "wantAuthnRequestsSigned": "true",
            "allowedClockSkew": "300",
            "encryptionPublicKey": "MIIDDDCCAfSgAwIBAgIQPniaLjBZQolPp9AouqTIATANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDEzdBREZTIEVuY3J5cHRpb24gLSB2bTIzNzA1My5vcmlvbi1hZDIuc29mdC5oaXRhY2hpLmNvLmpwMB4XDTIxMDMyMzA0MTI0MVoXDTI0MDMyMjA0MTI0MVowQjFAMD4GA1UEAxM3QURGUyBFbmNyeXB0aW9uIC0gdm0yMzcwNTMub3Jpb24tYWQyLnNvZnQuaGl0YWNoaS5jby5qcDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMpfyp7lB7YdRjnKir4RlRgJIshm1x9ZmjPZYXu+VZ0o7m+r6a+CwuH3zsFJlhu8/QYhjAthL6iHwyrLdv3YETOrURRzd23BY3q0d9aZ50efaAfh1NfcZOltoMkFhOvz39TGjtHL6FlayPkJKRP+AwONZ8VOWkAJIHlmMF3wX8myFHs6Y2cSR5ClbWGZ+eRLfQP4gjLlribfcZMRCulBHk7FrOe9k4hZd2/IaqMVZQKEUofqv1r8fpSu99e01pR59hvoJUQE6xl2mgmKmQygMceit+mCEldw5N31lxq8vj3Uab12OeuadSDYbOJDAuNUwFhx360VJMo6vmZqSpnJlcECAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAAo7wvasuKX7NtGd8YcHzwZ/v/2klT0jx1tmuWS0TezKAnZSofYmJn7HAYugJa/VUal8nehvBAPjajjRvArDLsZBAxOzYsn2U4m3XuEzHrtS+40/dBS/vYGldIfTfupVjCRJZvV35ONFL7sqnXnnxk0PiVTC0r3jY3oIqB8uRELFYEmLgDEEdB3YizH0NdtzWHdWIcHyWTYdZBe3zfizl3UEIOfbZIeMolgXjZquiNcOO/EZKLuJWgbupc17B7RQOhX1ZeKY2OGcL2opqnaBRcib2bTyg6R0E+ZGm6yOy6pC8pYdbvvKv9uBoys7BB/JgbSnLWXz9nB7c6o/yU6WdCA==",
            "validateSignature": "true",
            "signingCertificate": "MIIDBjCCAe6gAwIBAgIQMCWzE1wV4b9Kq4X13T/i3DANBgkqhkiG9w0BAQsFADA/MT0wOwYDVQQDEzRBREZTIFNpZ25pbmcgLSB2bTIzNzA1My5vcmlvbi1hZDIuc29mdC5oaXRhY2hpLmNvLmpwMB4XDTIxMDMyMzA0MTI0NVoXDTI0MDMyMjA0MTI0NVowPzE9MDsGA1UEAxM0QURGUyBTaWduaW5nIC0gdm0yMzcwNTMub3Jpb24tYWQyLnNvZnQuaGl0YWNoaS5jby5qcDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAIwQWHRYEJ1MglckuKBBStb+ClBz3QlrzDlcXAPv1/QQjOpWa20fB0YlL2RmKTjtVE3AuUNEtJXkYfMWoYqVaDcudPj5I6zRve+ZYE46KgyjDkDSBE2o2saENe74KvZ23G9J+1beKt/hcmPdXKH6oOQ8c1C40fEXfxoiV2Uw5K3ltOYfa7lSeQ6ywYdso/DYtUrJqK4juq2kVk7+hHsrQ7hNndKpAKhouq89KZ1opbzxvG/cdQqWR110NZx2CFtZrYXtVu5P4VzloBoA+GVvu7CBQoFlZ2dbWruI0oEPj7/ebV+84HFZYG1NrSMn3D5Da+6LwReljZEoDwJkNKz3m6cCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAIelrzirZug21oHupUezWbaeP7wAYfS8LBIKpbyR+xrtoaJhcdcEUUGwpadT283Yq3AXzRAVJ7rXPVhAGYCOuw+1kq3WaT+glaTbQJPPAy57WhrhNLRRY3AowohOdCZi5fznTTMbREK4E0hJ1xh4r7Hst+JlR9hLfMK1l5DNPKrBMZuiYXa566WIw6F708VLJxRQcTVG9P/MqecOOuch6f9lH4zDyNFPrjDmbssdGVCBX2RnVqHhUKJXPVCTTTLDNOqqUZ4Z/wWzuEAhis0/eyUBs0w3XlBVXYuHaEMIESpGDUSBrBY+Uqv6oR7q0i4Ge+YmfqqwpaxKAUrAN0m2ckA==",
            "nameIDPolicyFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName",
            "signatureAlgorithm": "RSA_SHA256",
            "wantAssertionsEncrypted": "true",
            "useJwksUrl": "true",
            "wantAssertionsSigned": "true",
            "fromUrl": "https://adfs.example.com/FederationMetadata/2007-06/FederationMetadata.xml",
            "postBindingAuthnRequest": "true",
            "forceAuthn": "true",
            "addExtensionsElementWithKeyInfo": "false",
            "principalType": "SUBJECT"
        }
    }
]

Attribute	Type	Description
providerType	string	Provider type A fixed string (ADFS) is returned.
protocol	string	Federation protocol oidc saml
alias	string	Alias name
displayName	string	Display name
fromUrl	string	OpenID Connect discovery endpoint or metadata endpoint of the identity provider
enabled	boolean	Whether the server setting is enabled true: Enabled false: Disabled
guiOrder	int	Server display sequence in the Identity Provider window A fixed value (1) is returned.
defaultGroupList	object	Settings of default group mappers localGroupId (string) Object ID of the local user group localGroupName (string) Local user group name
customGroupList	object	Settings of custom group mappers idpGroupName (string) Group name of the identity provider localGroupId (string) Object ID of the local user group localGroupName (string) Local user group name
clientId	string	Client ID of the identity provider If the value of the protocol attribute is saml, the value null is always returned.
clientSecret	string	Client secret of the identity provider If the value of the protocol attribute is oidc, the value ********** is always returned. If the value of the protocol attribute is saml, the value null is always returned.
config	object	Configuration information of the identity provider