Security Claim Operations

Security claims can be added on the Security Roles and Claims page Claims tab and also from the Claims tab within each role when editing roles on the Security Roles and Claims page Roles tab.

To add a new security claim or update an existing claim:

1. In the Management Portal, browse to System Settings Icon > Security Roles and Claims.

2. On the Security Roles and Claims page, select the Claims tab and click Add from the menu at the top of the grid to add a new security claim, or highlight a row and click Edit from the top of the grid or from the right click menu to modify an existing claim.

3. In the Add/Edit Claim dialog, select a Claim Type in the dropdown. Supported claim types are:

   • Active Directory User

     Active Directory user account.

   • Active Directory Group

   • Active Directory group.

   • Active Directory Computer

   • Active Directory machine account.

   • OAuth Client Id

     An open authorization client application claim.

   • OAuth Object Id

     An open authorization claim of a type not covered by client, role or subject.

   • OAuth Role

     An open authorization group claim.

   • OAuth Subject

     An open authorization user claim.

   Note:  This field cannot be modified on an edit.

4. In the Claim Value field, enter the identifying information for the entity specified in the claim. For Active Directory users and groups, this will be in the form DOMAIN\user or group name (e.g. KEYEXAMPLE\PKI A public key infrastructure (PKI) is a set of roles, policies, and procedures needed to create, manage, distribute, use, store and revoke digital certificates and manage public-key encryption. Administrators). For Active Directory computers, this will be in the form of a machine account (e.g. KEYEXAMPLE\MyServer$). For an identity provider other than Active Directory, users are referenced by GUID (see Configuring Keyfactor Identity Provider and Collecting Data for the Keyfactor Command Installation) and groups (roles) are referenced by role name.

   Important:  The built-in Active Directory groups Domain Admins and Enterprise Admins cannot be used directly to grant access to the Management Portal due to how these groups function within Windows. You can create a custom Active Directory group, reference that group in the Management Portal, and add the built-in Domain Admins or Enterprise Admins group to that custom group, if desired.
   Tip:  If you’re using a federated identity provider with Keyfactor Identity Provider to authenticate your users, enter the Keyfactor Identity Provider identity for that user or a role in Keyfactor Identity Provider that user has been granted (see Federating from Keyfactor Identity Provider).
   Note:  This field cannot be modified on an edit.

5. In the Provider dropdown, select the correct identity provider for the claim—either Active Directory or the identity provider name you configured using the configuration wizard.

   Tip:  If you’re using a federated identity provider with Keyfactor Identity Provider to authenticate your users, select the Keyfactor Identity Provider name in the dropdown.
   Note:  This field cannot be modified on an edit.

6. In the Description field, enter a description for the security claim. For example, the user’s full name or the group owner. This field is required.

   

   Figure 354: Add a Security Claim for an OAuth Identity Provider Role

To delete a security claim:

1. In the Management Portal, browse to System Settings Icon > Security Roles and Claims.
2. Select the Claims tab of the page. Highlight the claim you want to delete and click Delete at the top of the grid. Or right-click the row in the grid and choose Delete from the right-click menu.

Within this dialog you can view the global permissions for the claim, certificate store container permissions, or certificate collection The certificate search function allows you to query the Keyfactor Command database for certificates from any available source based on any criteria of the certificates and save the results as a collection that will be availble in other places in the Management Portal (e.g. expiration alerts and certain reports). permissions.

1. In the Management Portal, browse to System Settings Icon > Security Roles and Claims.
2. Select the Claims tab of the page. Highlight the claim you want to view permissions for and click View Permissions at the top of the grid. Or right-click the row in the grid and choose View Permissions from the right-click menu.

If the user or group has been granted more than one role, you see the permissions of all the roles granted to the user or group consolidated together on the View Permissions dialog for easy viewing. Hover over a specific permission to see how that permission was granted.

To view the roles associated with a claim:

1. In the Management Portal, browse to System Settings Icon > Security Roles and Claims.
2. Select the Claims tab of the page. Highlight the claim you want to view roles for and click View Roles at the top of the grid. Or right-click the row in the grid and choose View Roles from the right-click menu.