Sonatype Nexus Repository Security management: LDAP API

openapi: 3.2.0
info:
  title: 'Nexus Repository Manager REST Security management: LDAP API'
  version: 3.97.2-02
servers:
- url: /service/rest
tags:
- name: 'Security management: LDAP'
paths:
  /v1/security/ldap/change-order:
    post:
      tags:
      - 'Security management: LDAP'
      summary: Change LDAP server order
      operationId: createSecurityLdapChangeOrder
      requestBody:
        description: Ordered list of LDAP server names
        content:
          application/json:
            schema:
              type: array
              items:
                type: string
        required: true
      responses:
        '204':
          description: LDAP server order changed
        '401':
          description: Authentication required
        '403':
          description: Insufficient permissions
  /v1/security/ldap/cache:
    delete:
      tags:
      - 'Security management: LDAP'
      operationId: deleteSecurityLdapCache
      responses:
        '200':
          description: successful operation
          content:
            application/json: {}
      summary: Delete security ldap cache
      x-summary-source: derived
  /v1/security/ldap:
    get:
      tags:
      - 'Security management: LDAP'
      summary: List LDAP servers
      operationId: listSecurityLdap
      responses:
        '200':
          description: LDAP server list returned
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ReadLdapServerXo'
        '401':
          description: Authentication required
        '403':
          description: Insufficient permissions
    post:
      tags:
      - 'Security management: LDAP'
      summary: Create LDAP server
      operationId: createSecurityLdap
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateLdapServerXo'
        required: true
      responses:
        '201':
          description: LDAP server created
        '401':
          description: Authentication required
        '403':
          description: Insufficient permissions
  /v1/security/ldap/{name}:
    get:
      tags:
      - 'Security management: LDAP'
      summary: Get LDAP server
      operationId: getSecurityLdap
      parameters:
      - name: name
        in: path
        description: Name of the LDAP server to retrieve
        required: true
        schema:
          type: string
      responses:
        '200':
          description: LDAP server returned
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ReadLdapServerXo'
        '401':
          description: Authentication required
        '403':
          description: Insufficient permissions
        '404':
          description: LDAP server not found
    put:
      tags:
      - 'Security management: LDAP'
      summary: Update LDAP server
      operationId: updateSecurityLdap
      parameters:
      - name: name
        in: path
        description: Name of the LDAP server to update
        required: true
        schema:
          type: string
      requestBody:
        description: Updated values of LDAP server
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateLdapServerXo'
        required: true
      responses:
        '204':
          description: LDAP server updated
        '401':
          description: Authentication required
        '403':
          description: Insufficient permissions
        '404':
          description: LDAP server not found
    delete:
      tags:
      - 'Security management: LDAP'
      summary: Delete LDAP server
      operationId: deleteSecurityLdap
      parameters:
      - name: name
        in: path
        description: Name of the LDAP server to delete
        required: true
        schema:
          type: string
      responses:
        '204':
          description: LDAP server deleted
        '401':
          description: Authentication required
        '403':
          description: Insufficient permissions
        '404':
          description: LDAP server not found
  /v1/security/ldap/templates:
    get:
      tags:
      - 'Security management: LDAP'
      operationId: listSecurityLdapTemplates
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/LdapSchemaTemplateXo'
      summary: List security ldap templates
      x-summary-source: derived
  /v1/security/ldap/verify-connection:
    post:
      tags:
      - 'Security management: LDAP'
      operationId: createSecurityLdapVerifyConnection
      parameters:
      - name: existingServerName
        in: query
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateLdapServerXo'
        required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json: {}
      summary: Create security ldap verify connection
      x-summary-source: derived
  /v1/security/ldap/verify-login:
    post:
      tags:
      - 'Security management: LDAP'
      operationId: createSecurityLdapVerifyLogin
      parameters:
      - name: existingServerName
        in: query
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LdapVerifyLoginXo'
        required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json: {}
      summary: Create security ldap verify login
      x-summary-source: derived
  /v1/security/ldap/verify-user-mapping:
    post:
      tags:
      - 'Security management: LDAP'
      operationId: createSecurityLdapVerifyUserMapping
      parameters:
      - name: existingServerName
        in: query
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateLdapServerXo'
        required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/LdapTestUserMappingXo'
      summary: Create security ldap verify user mapping
      x-summary-source: derived
components:
  schemas:
    LdapSchemaTemplateXo:
      type: object
      properties:
        name:
          type: string
          description: Template name
        userBaseDn:
          type: string
          description: The relative DN where users are found
        userSubtree:
          type: boolean
          description: Whether to include subtrees when searching for users
        userObjectClass:
          type: string
          description: LDAP object class for users
        userLdapFilter:
          type: string
          description: Optional LDAP filter to limit user search
        userIdAttribute:
          type: string
          description: LDAP attribute containing the user ID
        userRealNameAttribute:
          type: string
          description: LDAP attribute containing the user's real name
        userEmailAddressAttribute:
          type: string
          description: LDAP attribute containing the user's email address
        userPasswordAttribute:
          type: string
          description: LDAP attribute containing the user's password
        ldapGroupsAsRoles:
          type: boolean
          description: Whether LDAP groups should be mapped as roles
        groupType:
          type: string
          description: 'Group type: ''static'' or ''dynamic'''
        groupBaseDn:
          type: string
          description: The relative DN where groups are found
        groupSubtree:
          type: boolean
          description: Whether to include subtrees when searching for groups
        groupObjectClass:
          type: string
          description: LDAP object class for groups
        groupIdAttribute:
          type: string
          description: LDAP attribute containing the group ID
        groupMemberAttribute:
          type: string
          description: LDAP attribute containing group member references
        groupMemberFormat:
          type: string
          description: Format of group member attribute values
        userMemberOfAttribute:
          type: string
          description: LDAP attribute on user containing group membership (for dynamic groups)
    ReadLdapServerXo:
      required:
      - authScheme
      - connectionRetryDelaySeconds
      - connectionTimeoutSeconds
      - host
      - maxIncidentsCount
      - name
      - port
      - protocol
      - searchBase
      - userEmailAddressAttribute
      - userIdAttribute
      - userObjectClass
      - userRealNameAttribute
      type: object
      properties:
        name:
          minLength: 1
          type: string
          description: LDAP server name
        protocol:
          type: string
          description: LDAP server connection Protocol to use
          enum:
          - LDAP
          - LDAPS
        useTrustStore:
          type: boolean
          description: Whether to use certificates stored in Nexus Repository Manager's truststore
        host:
          minLength: 1
          type: string
          description: LDAP server connection hostname
        port:
          type: integer
          description: LDAP server connection port to use
          format: int32
          example: 636
        searchBase:
          minLength: 1
          type: string
          description: LDAP location to be added to the connection URL
          example: dc=example,dc=com
        authScheme:
          type: string
          description: Authentication scheme used for connecting to LDAP server
          enum:
          - NONE
          - SIMPLE
          - CRAM_MD5
          - DIGEST_MD5
        authRealm:
          type: string
          description: The SASL realm to bind to. Required if authScheme is CRAM_MD5 or DIGEST_MD5
          example: example.com
        authUsername:
          type: string
          description: This must be a fully qualified username if simple authentication is used. Required if authScheme other than none.
        connectionTimeoutSeconds:
          maximum: 3600
          minimum: 1
          type: integer
          description: How long to wait before timeout
          format: int32
          example: 1
        connectionRetryDelaySeconds:
          minimum: 0
          type: integer
          description: How long to wait before retrying
          format: int32
        maxIncidentsCount:
          minimum: 0
          type: integer
          description: How many retry attempts
          format: int32
        userBaseDn:
          type: string
          description: The relative DN where user objects are found (e.g. ou=people). This value will have the Search base DN value appended to form the full User search base DN.
          example: ou=people
        userSubtree:
          type: boolean
          description: Are users located in structures below the user base DN?
        userObjectClass:
          minLength: 1
          type: string
          description: LDAP class for user objects
          example: inetOrgPerson
        userLdapFilter:
          type: string
          description: LDAP search filter to limit user search
          example: (|(mail=*@example.com)(uid=dom*))
        userIdAttribute:
          minLength: 1
          type: string
          description: This is used to find a user given its user ID
          example: uid
        userRealNameAttribute:
          minLength: 1
          type: string
          description: This is used to find a real name given the user ID
          example: cn
        userEmailAddressAttribute:
          minLength: 1
          type: string
          description: This is used to find an email address given the user ID
          example: mail
        userPasswordAttribute:
          type: string
          description: If this field is blank the user will be authenticated against a bind with the LDAP server
        ldapGroupsAsRoles:
          type: boolean
          description: Denotes whether LDAP assigned roles are used as Nexus Repository Manager roles
        groupType:
          type: string
          description: 'Defines a type of groups used: static (a group contains a list of users) or dynamic (a user contains a list of groups). Required if ldapGroupsAsRoles is true.'
          enum:
          - DYNAMIC
          - STATIC
        groupBaseDn:
          type: string
          description: The relative DN where group objects are found (e.g. ou=Group). This value will have the Search base DN value appended to form the full Group search base DN.
          example: ou=Group
        groupSubtree:
          type: boolean
          description: Are groups located in structures below the group base DN
        groupObjectClass:
          type: string
          description: LDAP class for group objects. Required if groupType is static
          example: posixGroup
        groupIdAttribute:
          type: string
          description: This field specifies the attribute of the Object class that defines the Group ID. Required if groupType is static
          example: cn
        groupMemberAttribute:
          type: string
          description: LDAP attribute containing the usernames for the group. Required if groupType is static
          example: memberUid
        groupMemberFormat:
          type: string
          description: The format of user ID stored in the group member attribute. Required if groupType is static
          example: uid=${username},ou=people,dc=example,dc=com
        userMemberOfAttribute:
          type: string
          description: Set this to the attribute used to store the attribute which holds groups DN in the user object. Required if groupType is dynamic
          example: memberOf
        id:
          type: string
          description: LDAP server ID
        order:
          type: integer
          description: Order number in which the server is being used when looking for a user
          format: int32
    LdapTestUserMappingXo:
      type: object
      properties:
        username:
          type: string
          description: Username from LDAP
        realName:
          type: string
          description: User's real name from LDAP
        email:
          type: string
          description: User's email address from LDAP
        membership:
          uniqueItems: true
          type: array
          description: Group memberships from LDAP
          items:
            type: string
            description: Group memberships from LDAP
    LdapVerifyLoginXo:
      required:
      - base64Password
      - base64Username
      - ldapServer
      type: object
      properties:
        base64Username:
          minLength: 1
          type: string
          description: Base64-encoded username to test
        base64Password:
          minLength: 1
          type: string
          description: Base64-encoded password to test
        ldapServer:
          $ref: '#/components/schemas/CreateLdapServerXo'
    CreateLdapServerXo:
      required:
      - authScheme
      - connectionRetryDelaySeconds
      - connectionTimeoutSeconds
      - host
      - maxIncidentsCount
      - name
      - port
      - protocol
      - searchBase
      - userEmailAddressAttribute
      - userIdAttribute
      - userObjectClass
      - userRealNameAttribute
      type: object
      properties:
        name:
          minLength: 1
          type: string
          description: LDAP server name
        protocol:
          type: string
          description: LDAP server connection Protocol to use
          enum:
          - LDAP
          - LDAPS
        useTrustStore:
          type: boolean
          description: Whether to use certificates stored in Nexus Repository Manager's truststore
        host:
          minLength: 1
          type: string
          description: LDAP server connection hostname
        port:
          type: integer
          description: LDAP server connection port to use
          format: int32
          example: 636
        searchBase:
          minLength: 1
          type: string
          description: LDAP location to be added to the connection URL
          example: dc=example,dc=com
        authScheme:
          type: string
          description: Authentication scheme used for connecting to LDAP server
          enum:
          - NONE
          - SIMPLE
          - CRAM_MD5
          - DIGEST_MD5
        authRealm:
          type: string
          description: The SASL realm to bind to. Required if authScheme is CRAM_MD5 or DIGEST_MD5
          example: example.com
        authUsername:
          type: string
          description: This must be a fully qualified username if simple authentication is used. Required if authScheme other than none.
        connectionTimeoutSeconds:
          maximum: 3600
          minimum: 1
          type: integer
          description: How long to wait before timeout
          format: int32
          example: 1
        connectionRetryDelaySeconds:
          minimum: 0
          type: integer
          description: How long to wait before retrying
          format: int32
        maxIncidentsCount:
          minimum: 0
          type: integer
          description: How many retry attempts
          format: int32
        userBaseDn:
          type: string
          description: The relative DN where user objects are found (e.g. ou=people). This value will have the Search base DN value appended to form the full User search base DN.
          example: ou=people
        userSubtree:
          type: boolean
          description: Are users located in structures below the user base DN?
        userObjectClass:
          minLength: 1
          type: string
          description: LDAP class for user objects
          example: inetOrgPerson
        userLdapFilter:
          type: string
          description: LDAP search filter to limit user search
          example: (|(mail=*@example.com)(uid=dom*))
        userIdAttribute:
          minLength: 1
          type: string
          description: This is used to find a user given its user ID
          example: uid
        userRealNameAttribute:
          minLength: 1
          type: string
          description: This is used to find a real name given the user ID
          example: cn
        userEmailAddressAttribute:
          minLength: 1
          type: string
          description: This is used to find an email address given the user ID
          example: mail
        userPasswordAttribute:
          type: string
          description: If this field is blank the user will be authenticated against a bind with the LDAP server
        ldapGroupsAsRoles:
          type: boolean
          description: Denotes whether LDAP assigned roles are used as Nexus Repository Manager roles
        groupType:
          type: string
          description: 'Defines a type of groups used: static (a group contains a list of users) or dynamic (a user contains a list of groups). Required if ldapGroupsAsRoles is true.'
          enum:
          - DYNAMIC
          - STATIC
        groupBaseDn:
          type: string
          description: The relative DN where group objects are found (e.g. ou=Group). This value will have the Search base DN value appended to form the full Group search base DN.
          example: ou=Group
        groupSubtree:
          type: boolean
          description: Are groups located in structures below the group base DN
        groupObjectClass:
          type: string
          description: LDAP class for group objects. Required if groupType is static
          example: posixGroup
        groupIdAttribute:
          type: string
          description: This field specifies the attribute of the Object class that defines the Group ID. Required if groupType is static
          example: cn
        groupMemberAttribute:
          type: string
          description: LDAP attribute containing the usernames for the group. Required if groupType is static
          example: memberUid
        groupMemberFormat:
          type: string
          description: The format of user ID stored in the group member attribute. Required if groupType is static
          example: uid=${username},ou=people,dc=example,dc=com
        userMemberOfAttribute:
          type: string
          description: Set this to the attribute used to store the attribute which holds groups DN in the user object. Required if groupType is dynamic
          example: memberOf
        authPassword:
          type: string
          description: The password to bind with. Required if authScheme other than none.
    UpdateLdapServerXo:
      required:
      - authScheme
      - connectionRetryDelaySeconds
      - connectionTimeoutSeconds
      - host
      - maxIncidentsCount
      - name
      - port
      - protocol
      - searchBase
      - userEmailAddressAttribute
      - userIdAttribute
      - userObjectClass
      - userRealNameAttribute
      type: object
      properties:
        name:
          minLength: 1
          type: string
          description: LDAP server name
        protocol:
          type: string
          description: LDAP server connection Protocol to use
          enum:
          - LDAP
          - LDAPS
        useTrustStore:
          type: boolean
          description: Whether to use certificates stored in Nexus Repository Manager's truststore
        host:
          minLength: 1
          type: string
          description: LDAP server connection hostname
        port:
          type: integer
          description: LDAP server connection port to use
          format: int32
          example: 636
        searchBase:
          minLength: 1
          type: string
          description: LDAP location to be added to the connection URL
          example: dc=example,dc=com
        authScheme:
          type: string
          description: Authentication scheme used for connecting to LDAP server
          enum:
          - NONE
          - SIMPLE
          - CRAM_MD5
          - DIGEST_MD5
        authRealm:
          type: string
          description: The SASL realm to bind to. Required if authScheme is CRAM_MD5 or DIGEST_MD5
          example: example.com
        authUsername:
          type: string
          description: This must be a fully qualified username if simple authentication is used. Required if authScheme other than none.
        connectionTimeoutSeconds:
          maximum: 3600
          minimum: 1
          type: integer
          description: How long to wait before timeout
          format: int32
          example: 1
        connectionRetryDelaySeconds:
          minimum: 0
          type: integer
          description: How long to wait before retrying
          format: int32
        maxIncidentsCount:
          minimum: 0
          type: integer
          description: How many retry attempts
          format: int32
        userBaseDn:
          type: string
          description: The relative DN where user objects are found (e.g. ou=people). This value will have the Search base DN value appended to form the full User search base DN.
          example: ou=people
        userSubtree:
          type: boolean
          description: Are users located in structures below the user base DN?
        userObjectClass:
          minLength: 1
          type: string
          description: LDAP class for user objects
          example: inetOrgPerson
        userLdapFilter:
          type: string
          description: LDAP search filter to limit user search
          example: (|(mail=*@example.com)(uid=dom*))
        userIdAttribute:
          minLength: 1
          type: string
          description: This is used to find a user given its user ID
          example: uid
        userRealNameAttribute:
          minLength: 1
          type: string
          description: This is used to find a real name given the user ID
          example: cn
        userEmailAddressAttribute:
          minLength: 1
          type: string
          description: This is used to find an email address given the user ID
          example: mail
        userPasswordAttribute:
          type: string
          description: If this field is blank the user will be authenticated against a bind with the LDAP server
        ldapGroupsAsRoles:
          type: boolean
          description: Denotes whether LDAP assigned roles are used as Nexus Repository Manager roles
        groupType:
          type: string
          description: 'Defines a type of groups used: static (a group contains a list of users) or dynamic (a user contains a list of groups). Required if ldapGroupsAsRoles is true.'
          enum:
          - DYNAMIC
          - STATIC
        groupBaseDn:
          type: string
          description: The relative DN where group objects are found (e.g. ou=Group). This value will have the Search base DN value appended to form the full Group search base DN.
          example: ou=Group
        groupSubtree:
          type: boolean
          description: Are groups located in structures below the group base DN
        groupObjectClass:
          type: string
          description: LDAP class for group objects. Required if groupType is static
          example: posixGroup
        groupIdAttribute:
          type: string
          description: This field specifies the attribute of the Object class that defines the Group ID. Required if groupType is static
          example: cn
        groupMemberAttribute:
          type: string
          description: LDAP attribute containing the usernames for the group. Required if groupType is static
          example: memberUid
        groupMemberFormat:
          type: string
          description: The format of user ID stored in the group member attribute. Required if groupType is static
          example: uid=${username},ou=people,dc=example,dc=com
        userMemberOfAttribute:
          type: string
          description: Set this to the attribute used to store the attribute which holds groups DN in the user object. Required if groupType is dynamic
          example: memberOf
        authPassword:
          type: string
          description: The password to bind with. Required if authScheme other than none.
        id:
          type: string
          description: LDAP server ID