Security Claim Operations

This page supports the standard query format described in Using Search in the Management Portal and includes its own set of query parsers specific to this operation. Use the following parsers to filter and refine results for this page.

• ADClaimValue

  Complete matches with the name of the security claim for Active Directory (for example, KEYEXAMPLE\Keyfactor Administrators).

• ClaimType

  The claim type matches or doesn’t match the referenced value. Supported claim types are:

  • Computer

  • Group

  • User

  • OAuthClientId

  • OAuthOid

  • OAuthRole

  • OAuthSubject

• ClaimValue

  Complete or partial matches with the name of the security claim for OAuth providers (for example, Keyfactor Administrators).

• Description

  Complete or partial matches with the description for the security claim.

Security claims can be added on the Security Roles and Claims page Claims tab and also from the Claims tab within each role when editing roles on the Security Roles and Claims page Roles tab.

To add a new security claim or update an existing claim:

1. On the Security Roles and Claims page, select the Claims tab and click Add from the toolbar to add a new security claim, or highlight a row and click Edit from the toolbar or right click menu to modify an existing claim.

2. In the Add/Edit Claim dialog, select a Claim Type in the dropdown. Supported claim types are:

   • Active Directory User: An Active Directory user account.

   • Active Directory Group: An Active Directory group.

   • Active Directory Computer: An Active Directory machine account.

   • OAuth Client Id: An open authorization 2.0 client application claim.

   • OAuth Object Id: An open authorization 2.0 claim of a type not covered by client, role or subject.

   • OAuth Role: An open authorization 2.0 group claim.

   • OAuth Subject: An open authorization 2.0 user claim.

   Note:  This field cannot be modified on an edit.

3. In the Claim Value field, enter the identifying information for the entity specified in the claim. For Active Directory users and groups, this will be in the form DOMAIN\user or group name (for example, KEYEXAMPLE\PKI A public key infrastructure (PKI) is a set of roles, policies, and procedures needed to create, manage, distribute, use, store and revoke digital certificates and manage public-key encryption. Administrators). For Active Directory computers, this will be in the form of a machine account (for example, KEYEXAMPLE\MyServer$). For an identity provider other than Active Directory, this will vary.

   Important:  The built-in Active Directory groups Domain Admins and Enterprise Admins cannot be used directly to grant access to the Management Portal due to how these groups function within Windows. You can create a custom Active Directory group, reference that group in the Management Portal, and add the built-in Domain Admins or Enterprise Admins group to that custom group, if desired.
   Note:  This field cannot be modified on an edit.

4. In the Provider dropdown, select the correct identity provider for the claim—either Active Directory or the identity provider name you configured using the configuration wizard.

   Note:  The identity providers that appear in this dropdown are determined by the permissions of the user accessing the Management Portal and the permission set on the identity providers. The user must be assigned a security role that has been granted the Identity Providers > Read permission and that security role must have the same permission set applied to it as has been applied to the identity provider. For more information about permission sets, see Permission Sets.
   Note:  This field cannot be modified on an edit.

5. In the Description field, enter a description for the security claim. For example, the user’s full name or the group owner. This field is required.

   

   Figure 442: Add a Security Claim for an OAuth Identity Provider Role

6. Click Save to save the new claim.

To delete a security claim, select the claim and choose Delete from the toolbar or right-click menu.

Within the View Permissions dialog, you can view the global, certificate collection The certificate search function allows you to query the Keyfactor Command database for certificates from any available source based on any criteria of the certificates and save the results as a collection that will be available in other places in the Management Portal (for example expiration alerts and certain reports)., certificate store application, and PAM PAM (Privileged Access Management): Controls privileged access by vaulting credentials, enforcing least-privilege/just-in-time access, rotating secrets, and auditing sessions. Across Keyfactor products, PAM protects diverse sensitive operations and secrets—for example certificate stores and CA credentials—via built-in or third-party providers; external integrations are delivered as custom PAM extensions (several published on Keyfactor’s public GitHub). permissions assigned to the selected claim.

To view permissions for a security claim, select the claim and choose View Permissions from the toolbar or right-click menu.

If a user or group has been granted multiple roles, the View Permissions dialog consolidates the permissions from all assigned roles into a single view. Hover over a permission to see how it was granted.

To view the roles associated with a claim, select the claim and choose View Roles from the toolbar or right-click menu.