Query Active Directory authentication settings by calling GetInstanceADAuthServer - Bastionhost - Alibaba Cloud - Bastionhost

Queries the Active Directory (AD) authentication configurations of a Bastionhost instance.

Operation description

Usage notes

This operation queries the Active Directory (AD) authentication configurations of a Bastionhost instance. You can use the AD authentication feature of Bastionhost to synchronize users from an AD server to Bastionhost. After the synchronization is complete, users can perform O&M operations on servers by using Bastionhost. For enterprise-level managed operations, you can also refer to Alibaba Cloud Managed Services.

QPS limits

The queries per second (QPS) limit on this operation is 10 per user. If the number of API invocations exceeds the limit, throttling is triggered, which may affect your business. Invoke this operation at a reasonable frequency.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

yundun-bastionhost:GetInstanceADAuthServer

get

*Instance

acs:yundun-bastionhost:{#regionId}:{#accountId}:instance/{#InstanceId}

None

Request parameters

Parameter	Type	Required	Description	Example
InstanceId	string	Yes	The ID of the Bastionhost instance. Note You can call the DescribeInstances operation to query the instance ID.	bastionhost-cn-st220aw****
RegionId	string	No	The region ID of the Bastionhost instance. Note For more information about the mapping between region IDs and region names, see Regions and zones.	cn-hangzhou
UserSourceId	string	No

Response elements

Element	Type	Description	Example
	object	Schema of Response
RequestId	string	The ID of the request. The ID is a unique identifier generated by Alibaba Cloud for the request and can be used to troubleshoot issues.	89398CFB-4EB6-4C7E-BB3C-EF213AC8FA50
AD	object	The Active Directory (AD) authentication configurations.
Account	string	The distinguished name (DN) of the server account.	cn=Manager,dc=test,dc=com
BaseDN	string	The base DN used to connect to the AD server.	dc=test,dc=com
Domain	string	The domain on the AD server.	domain
EmailMapping	string	The name of the field that maps to the user email address on the AD server.	emailAttr
Filter	string	The filter condition for users.	(&(objectClass=top))
IsSSL	boolean	Specifies whether SSL is supported. Valid values: true: Supported. false: Not supported.	true
MobileMapping	string	The name of the field that maps to the user mobile phone number on the AD server.	mobileAttr
NameMapping	string	The name of the field that maps to the username on the AD server.	nameAttr
HasPassword	boolean	Specifies whether a password is set. Valid values: true: A password is set. false: No password is set.	true
Port	integer	The port of the server.	389
Server	string	The address of the server.	192.168.XX.XX
StandbyServer	string	The address of the standby server.	192.168.XX.XX
LatestSyncTime	integer	The time when the user snapshot was last synchronized.	0
SyncInterval	integer	The interval for automatic synchronization of user snapshots. Unit: hours. Valid values: 0, and 4 to 168. A value of 0 indicates that automatic synchronization is disabled and no synchronization is performed.	0
IsSyncEmailAttr	boolean	Specifies whether email addresses are synchronized. A value of true indicates that email addresses are synchronized, and a value of false indicates that email addresses are not synchronized.	true
IsSyncMobileAttr	boolean	Specifies whether mobile phone numbers are synchronized. A value of true indicates that mobile phone numbers are synchronized, and a value of false indicates that mobile phone numbers are not synchronized.	true
IsSyncNameAttr	boolean	Specifies whether display names are synchronized. A value of true indicates that display names are synchronized, and a value of false indicates that display names are not synchronized.	true
ServerName	string	The name of the AD authentication server.	AD Server
IsSyncOuAsUserGroup	boolean	Specifies whether the organization to which a user belongs is synchronized as a user group. A value of true indicates that the organization is synchronized as a user group, and a value of false indicates that the organization is not synchronized as a user group.	true
UserSourceId	string
IsDefault	boolean	Specifies whether the server is the default AD authentication server. A value of true indicates that the server is the default AD authentication server, and a value of false indicates that the server is not the default AD authentication server.	true

Examples

Success response

JSON format

{
  "RequestId": "89398CFB-4EB6-4C7E-BB3C-EF213AC8FA50",
  "AD": {
    "Account": "cn=Manager,dc=test,dc=com",
    "BaseDN": "dc=test,dc=com",
    "Domain": "domain",
    "EmailMapping": "emailAttr",
    "Filter": "(&(objectClass=top))",
    "IsSSL": true,
    "MobileMapping": "mobileAttr",
    "NameMapping": "nameAttr",
    "HasPassword": true,
    "Port": 389,
    "Server": "192.168.XX.XX",
    "StandbyServer": "192.168.XX.XX",
    "LatestSyncTime": 0,
    "SyncInterval": 0,
    "IsSyncEmailAttr": true,
    "IsSyncMobileAttr": true,
    "IsSyncNameAttr": true,
    "ServerName": "AD Server",
    "IsSyncOuAsUserGroup": true,
    "UserSourceId": "",
    "IsDefault": true
  }
}

Error codes

HTTP status code	Error code	Error message	Description
400	InvalidParameter	The argument is invalid.	The argument is invalid.
500	InternalError	An unknown error occurred.	An unknown error occurred.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.