ACCESS FEDERATION: How to remove a registered synchronization target

Erez Vadmani
2023-03-01 17:07

When using Access Federation, you might want to remove an Artifactory instance (or several instances when using high availability) from your synchronization targets list, which means that new security entities (users, groups, tokens, and permissions) won’t transfer to said instance(s).

However, you might have noticed that on the Access Federation configuration page, you may only apply new topologies or edit existing ones, and there is no option to remove synchronization targets.

Changes must be made to the configuration files located under your Artifactory installation path in order to remove a synchronization target from your Access Federation setup.

Steps to remove a synchronization target:

  1. Gain access to the server which hosts the source Federation instance (in case of using a highly available cluster, it is sufficient to do so for a single node of the cluster)
  2. Navigate to $JFROG_HOME/artifactory/var/etc/access
  3. Edit the “access.config.latest.yml” file
  4. Look for your “outbound” rules under the “federaton” section
  5. Under federation.outbound.servers you should see the list of synchronization targets, each one is specified using a hyphen (“-”), one such example with a single synchronization target:
User-added image
6. Remove the synchronization target(s) by deleting the relevant entries (including the hyphen itself, “-”)
7. Save the file, and then rename it to “access.config.import.yml”
User-added image
8. After saving the changes and renaming the file, perform a restart of Artifactory (the Access Federation source), in case of using a high availability cluster, perform a rolling restart of the cluster.
9. The changes made should then be seen in the Access Federation page in the UI:
User-added image

* Please be aware that the aforementioned technique only removes synchronization target(s) from asingleJPD (JFrog Platform Deployment), if you desire to delete a bi-syncrhoned Federation setup, you must do so from both ends.