Documentation Suite v26.2.1

Submit Search

POST Security Roles

The POST /Security/Roles operation creates a new security role in Keyfactor Command. On success, the operation returns HTTP 200 OK with the details of the security role.

Tip: The following permissions (see Security Roles and Claims) are required to use this feature:

/security/modify/

The user must hold a role containing this permission in the Global Permission Set (see Permission Sets).

This operation has two available versions. Keyfactor strongly recommends using the newer operation when possible. The v1 operation has been deprecated since it supports Active Directory identities only. The v2 operation has been redesigned to provide support for alternate identity providers and the newer claims-based authentication model that accompanies this. This version of the operation supports both Active Directory and other identity providers. For more information, see Endpoint Definition Versioning.

Version 2

Version 1

Version 2 of the POST /Security/Roles operation has been redesigned to provide support for alternate identity providers and the newer claims-based authentication model that accompanies this. All new development should use this version.

Table 814: POST Security Roles v2 Input Parameters

Name

Description

Name Required. A string containing the short reference name for the security role.

Description Required. A string containing the description for the security role.

EmailAddress A string containing an email address for the role. This address can be used from workflows to direct email messages to the owner of certificates for uses such as certificate expiration alerts (assuming the certificate owner for the certificates, a security role, has been populated)

Permission SetId

A string containing the Keyfactor Command reference GUID of the permission set to which the role is assigned (see Permission Sets).

Tip: For details of the permissions associated with the role, use the GET Security Roles ID operation for the desired role. For details of the permissions associated withe the permission set to which the role belongs, use the GET Permission Sets ID operation with this permission set GUID. A role may be only granted a subset of the permissions available in a permission set.

Enable Cert Ownership A Boolean indicating if the role can be assigned as a certificate owner (True or False). If this security role is expected to be an owner of any certificate, this flag must be True. If this value is set to False, this role will not appear when trying to assign an owner to a certificate.

Permissions

An array of strings containing the permissions assigned to the role in a comma-separated list of Name:Value pairs. See Security Structure for an overview of the possible permissions.

For example:

Copy

"Permissions": [  
   "/portal/read/",
   "/dashboard/read/",
   "/certificates/collections/metadata/modify/6/",
   "/certificates/collections/private_key/read/6/"
],

Claims

An array of objects containing the claims associated with the role. Show claim details.

Name

Description

Required. A string indicating a description for the security claim.

Claim Type

Required. An integer indicating the type of claim. Show claim type details.

Claim Type Integer	Claim Type String	Description
0	User	Active Directory user account
1	Group	Active Directory group.
2	Computer	Active Directory machine account
3	OAuth Oid	An open authorization claim of a type not covered by client, role or subject
4	OAuth Role	An open authorization group claim
5	OAuth Subject	An open authorization user claim
6	OAuth ClientId	An open authorization client application claim

Claim Value

Required. A string containing the identifying information for the entity specified in the claim. For implementations authenticated using Active Directory, this will be in NetBIOS format (DOMAIN\account-name). For example, group KEYEXAMPLE\PKI Administrators or for a computer, machine account KEYEXAMPLE\MyServer$. For implementations authenticated using OAuth, this will be in the format defined by the Name Claim Type.

Provider Authentication Scheme

Required. A string indicating the provider authentication scheme (for example, Active Directory or the OAuth authentication scheme name).

Table 815: POST Security Roles v2 Response Data

Name

Description

An integer containing the Keyfactor Command identifier for the security role.

Name A string containing the short reference name for the security role.

Description A string containing the description for the security role.

Immutable A Boolean indicating if the role is immutable or not. Only the built-in Administrators role is considered immutable. The value of this parameter cannot be changed.

Permission SetId

A string containing the Keyfactor Command reference GUID of the permission set to which the role is assigned (see Permission Sets).

Permissions

An array of strings containing the permissions assigned to the role in a comma-separated list of Name:Value pairs. See Security Structure for an overview of the possible permissions.

For example:

Copy

"Permissions": [  
   "/portal/read/",
   "/dashboard/read/",
   "/certificates/collections/metadata/modify/6/",
   "/certificates/collections/private_key/read/6/"
],

Claims

An array of objects containing the claims associated with the role. Show claim details.

Name

Description

An integer containing the Keyfactor Command reference ID for the security claim.

Description

A string indicating a description for the security claim.

Claim Type

A string indicating the type of claim. Show claim type details.

Claim Type Integer	Claim Type String	Description
0	User	Active Directory user account
1	Group	Active Directory group.
2	Computer	Active Directory machine account
3	OAuth Oid	An open authorization claim of a type not covered by client, role or subject
4	OAuth Role	An open authorization group claim
5	OAuth Subject	An open authorization user claim
6	OAuth ClientId	An open authorization client application claim

Claim Value

A string containing the identifying information for the entity specified in the claim. For implementations authenticated using Active Directory, this will be in NetBIOS format (DOMAIN\account-name). For example, group KEYEXAMPLE\PKI Administrators or for a computer, machine account KEYEXAMPLE\MyServer$. For implementations authenticated using OAuth, this will be in the format defined by the Name Claim Type.

Provider

An object containing information about the provider assigned to the security claim. Show authentication provider details.

Name

Description

A string indicating the Keyfactor Command reference GUID for the provider.

Authentication Scheme

A string indicating the provider authentication scheme. This may be:

Active Directory
The authentication scheme name defined for the OAuth identity provider
Client Certificate Authentication CA
unknown

Display Name

A string containing the short reference name for the provider (for example, Active Directory).

Version 1 of the POST /Security/Roles operation includes the same capabilities as version 2, but offers support for managing legacy formatted Active Directory identities only.

Important: This version has been deprecated since it supports Active Directory identities only. It is retained for backwards compatibility, but all new development should use operations that provide support for alternate identity providers and the newer claims-based authentication model that accompanies this. These newer operations support both Active Directory and other identity providers. See version 2 of this operation.

Table 816: POST Security Roles v1 Input Parameters

Name

Description

Name Body Required. A string containing the short reference name for the security role.

Description Body Required. A string containing the description for the security role.

EmailAddress Body A string containing an email address for the role. This address can be used from workflows to direct email messages to the owner of certificates for uses such as certificate expiration alerts (assuming the certificate owner for the certificates, a security role, has been populated).

Enabled

Body

A Boolean that indicates whether the security role is active (True or False). Security roles that have been deactivated cannot be assigned to security identities. The default is True.

This is considered deprecated and may be removed in a future release.

Private

Body

A Boolean that indicates whether the security role has been marked private (True or False). The default is False.

This is considered deprecated and may be removed in a future release.

Permission SetId Body A string indicating the Keyfactor Command reference GUID of the permission set associated with the role (see Permission Sets).

Permissions

Body

An array of strings containing the permissions assigned to the role in a comma-separated list of Name:Value pairs. See Legacy Security Structure for an overview of the possible permissions.

For example:

Copy

"Permissions": [
   "AdminPortal:Read",
   "Dashboard:Read"
],

Identities

Body

An array of objects containing one or more identifiers for each security identity to associate with the role. Show identifier information.

Name	Description
AccountName	Required in some cases. A string containing the account name for the security identity. For Active Directory user and groups, this will be in the form DOMAIN\\user or group name. For example: Copy `KEYEXAMPLE\\PKI Administrators` One of AccountName or SID is required to specify an identity, but not both.
SID	Required in some cases. A string containing the security identifier from the source identity store (for example, Active Directory) for the security identity. One of AccountName or SID is required to specify an identity, but not both.

For example:

Copy

"Identities": [
   {
      "AccountName": "KEYEXAMPLE\\jsmith"
   },
   {
      "AccountName": "KEYEXAMPLE\\mjones"
   }
]

Table 817: POST Security Roles v1 Response Data

Name

Description

An integer containing the Keyfactor Command identifier for the security role.

Name A string containing the short reference name for the security role.

Description A string containing the description for the security role.

Enabled

A Boolean that indicates whether the security role is active (True or False). Security roles that have been deactivated cannot be assigned to security identities. The default is True.

This is considered deprecated and may be removed in a future release.

Immutable A Boolean that indicates whether the security role has been marked as editable (False) or (True). Internal Keyfactor Command roles are not editable. This setting is reserved for Keyfactor Command internal use.

Valid A Boolean that indicates whether the security role's audit XML is valid (True or False). A security role may become invalid if Keyfactor Command determines that it appears to have been tampered with. This setting is not end-user configurable.

Private

A Boolean that indicates whether the security role has been marked private (True or False). The default is False.

This is considered deprecated and may be removed in a future release.

Permission SetId A string indicating the Keyfactor Command reference GUID of the permission set associated with the role (see Permission Sets).

Identities

An array of objects containing information about the security identities assigned to the security role. Show identity details.

Name	Description
Id	An integer containing the Keyfactor Command identifier for the security identity.
Account Name	A string containing the account name for the security identity. For Active Directory users and groups, this will be in the form DOMAIN\\user or group name. For example: KEYEXAMPLE\\PKI Administrators
Identity Type	A string indicating the type of identity—User or Group.
SID	A string containing the security identifier from the source identity store (for example, Active Directory) for the security identity.

Permissions

An array of strings containing the permissions assigned to the role in a comma-separated list of Name:Value pairs. See Legacy Security Structure for an overview of the possible permissions.

For example:

Copy

"Permissions": [
   "AdminPortal:Read",
   "Dashboard:Read"
],

Tip: See the Keyfactor API

An API is a set of functions to allow creation of applications. Keyfactor offers the Keyfactor API, which allows third-party software to integrate with the advanced certificate enrollment and management features of Keyfactor Command. Reference and Utility, which allows you to call API operations and view results. It is primarily intended for validation, testing, and workflow

A workflow is a series of steps necessary to complete a process. In Keyfactor Command, it refers to the workflow builder, which allows you to automate event-driven tasks such as when a certificate is requested, revoked or found in a certificate store. development, and also serves as an interactive supplement to this API documentation. You can access it from the help menu (

) in the Management Portal.

Was this page helpful? Provide Feedback

Version v26.2.1

On This Page