The Permission Sets component of the Keyfactor API
An API is a set of functions to allow creation of applications. Keyfactor offers the Keyfactor API, which allows third-party software to integrate with the advanced certificate enrollment and management features of Keyfactor Command. includes operations necessary to programmatically create, edit, retrieve, and delete permission sets within Keyfactor Command.
Permission sets are used to organize security roles (see Security Roles) and provide compartmentalization on permissions. An unconfigured Keyfactor Command has one permission set—the Global Permission Set—that will contain all the security roles created in Keyfactor Command and allow users with administrative permissions to grant any of the possible permissions (see Security Role Permissions) in Keyfactor Command to other users. An implementation with two or more permission sets can be used to limit the actions that administrative users (or any users) can take.
Permission sets can only be managed with the Keyfactor API.
The Global Permission Set contains the following permission:
/This is the base permission set that is created on installation. It allows any security roles created as part of the Global Permission Set to optionally contain any security permission within Keyfactor Command.
The organization adds an Operational Permission Set which contains the following permissions:
/agents/
/application_settings/
/certificate_stores/
/certificates/
/certificate_authorities/
/certificate_templates/
/dashboard/
/metadata/
/monitoring/
/portal/
/reports/
/security/
/scripts/
/ssl/
/workflows/
This allows any security roles created as part of the Operational Permission Set to optionally contain any of the permissions in the referenced areas of Keyfactor Command. Notice that /security/ is among these areas. It does not allow security roles added to this permission set to be granted permissions in areas such as /auditing/ and /identity_providers/.
The organization creates these security roles:
A Global Administrators security role in the Global Permission Set that grants full control to the system. This is created by default during the installation.
An Operational Administrators security role in the Operational Permission Set that grants all the permissions in the Operational Permission Set.
A Power Users security role in the Operational Permission Set that grants a large subset of permissions within the Operational Permission Set. These permissions are assigned at a more specific level within the permitted areas (for example, /certificates/enrollment
Certificate enrollment refers to the process by which a user requests a digital certificate. The user must submit the request to a certificate authority (CA)./csr A CSR or certificate signing request is a block of encoded text that is submitted to a CA when enrolling for a certificate. When you generate a CSR within Keyfactor Command, the matching private key for it is stored in Keyfactor Command in encrypted format and will be married with the certificate once returned from the CA./).A Viewers security role in the Operational Permission Set that grants a small subset of the permissions in the Operational Permission Set, more granularly than grants to the administrators (for example, /certificates/collections/read/).
In this configuration, users who hold the Operational Administrators security role:
- Can edit the Power Users and Viewers security roles and change the permissions granted to those roles but cannot add permissions outside the Operational Permission Set.
Can edit the Operational Administrators security role but cannot add any permissions that aren’t in the Operational Permission Set.
Can add new claims for users, groups, and other entities.
Can add new security roles in the Operational Permission Set, referencing only permissions in that set.
Can associate users, groups, and other entities with the Power Users, Viewers, and Operational Administrators security roles.
Can remove role associations for users, groups, and other entities for the Power Users, Viewers, and Operational Administrators security roles.
Cannot edit the Global Administrators role because it is not in the permission set to which their own security role belongs.
Cannot add or edit permission sets.
Table 665: Permission Sets Operations
| Endpoint | Method | Description | Link |
|---|---|---|---|
| /{id} | GET | Returns the permission set with the specified GUID. | GET Permission Sets ID |
| /{id} | DELETE | Deletes the permission set with the specified GUID. | DELETE Permission Sets ID |
| / | GET | Returns a list of all the permission sets. | GET Permission Sets |
| / | POST | Adds a new permission set into Keyfactor Command. | POST Permission Sets |
| / | PUT | Updates a permission set. | PUT Permission Sets |
| /My | GET | Returns the permission sets containing the specified security string. | GET Permission Sets My |
Was this page helpful? Provide Feedback