Security Role Operations

To add a new security role or update an existing role:

1. In the Management Portal, browse to System Settings Icon > Security Roles and Claims.

2. On the Security Roles and Claims page, select the Security Role tab and click Add from the menu at the top of the grid to add a new security role, or highlight a row and click Edit from the top of the grid or from the right click menu to modify an existing role.

   Note:  The Administrator and Reporting API A set of functions to allow creation of applications. Keyfactor offers the Keyfactor API, which allows third-party software to integrate with the advanced certificate enrollment and management features of Keyfactor Command. Access roles cannot be edited or deleted—they are shown as immutable in the grid.

3. Either the Add Security Role dialog or Role information For <role> dialog will open. Fill in each tab of the dialog with the information desired for the selected security role as described below.

   Details Tab

   On the details tab, give the role a Name and Description. Both fields are required. In the Permission Set dropdown, select a permission set to apply to the role. For more information about permission sets, see Permission Sets.

   Note:  Selecting a permission set limits the permissions available for selection in the dialog to those supported by the permission set. If you select a permission set other than the Global permission set, some permissions may not appear in the dialogs. This includes the Collection The certificate search function allows you to query the Keyfactor Command database for certificates from any available source based on any criteria of the certificates and save the results as a collection that will be availble in other places in the Management Portal (e.g. expiration alerts and certain reports). Permissions, Container Permissions and PAM Provider Permissions tabs, which only appear if the permissions for these are included in the selected permission set.

   If you change the permission set for a role after permissions have already been granted for the role, any permissions not contained in the new permission set will be removed from the role upon save.

   Global Permissions Tab

   On the Global Permissions tab, check the boxes for the permissions that are appropriate for the new role (see Security Role Permissions).

   

   Figure 349: Grant Global Permissions to a Security Role

   Tip:  If desired, use the dropdown at the top to enable all the Read boxes (Read Only) or All the boxes (Select All). Click Apply to apply the selection in the dropdown across all permissions. Click Reset to return the dialog to the state it was in when last saved and remove any changes made since opening the permissions for editing. Click Clear to uncheck all the boxes.

   Note:  For the most part, when you grant Modify role permissions to an area in the Management Portal, you must also grant Read role permissions to that same area for that security role to receive full functionality. Granting Modify without Read to a user or a group can result in unexpected behavior. See also Certificate Collection Permissions.

   Note:  Security roles for SSH The SSH (secure shell) protocol provides for secure connections between computers. It provides several options for authentication, including public key, and protects the communications with strong encryption. key management are structured somewhat differently than those for most of the rest of the product set, as they don't use the standard Read and Modify convention. For more information, see SSH Permissions.
   Collection Permissions Tab

   Optionally, on the Collection Permissions tab, highlight each certificate collection you would like to set permissions for and click the toggle button for each desired permission (see Certificate Collection Permissions). If you do not opt to set permissions on any collections, the permissions set on the Global Permissions tab will apply to all collections.

   Along the top of the Collection Permissions tab, you can see the system-wide certificate collection permissions that have been configured. This is useful for reference. The system-wide settings may also be edited from this tab, if desired.

   Any permissions that have been enabled at the system-wide level will not be available for configuration at the collection-level. Toggles for these will be grayed out.

   Tip:  The search bar at the top of Collection Name column on the collections tab can make it easier to find collections if you have a large number of them.

   

   Figure 350: Grant Collection Permissions to a Security Role

   Container Permissions Tab

   Optionally, on the Container Permissions tab, highlight each certificate store container you would like to set permissions for and click the toggle button for each desired permission (see Container Permissions). If you do not opt to set permissions on any certificate store containers, the permissions set on the Global Permissions tab will apply to all certificate store containers.

   Tip:  The search bar at the top of Container Name column on the containers tab can make it easier to find certificate store containers if you have a large number of them.

   

   Figure 351: Grant Container Permissions to a Security Role

   PAM Provider Permissions Tab

   Optionally, on the PAM Provider Permissions tab, highlight each PAM provider you would like to set permissions for and click the toggle button for each desired permission (see PAM Permissions). If you do not opt to set permissions on any PAM providers, the permissions set on the Global Permissions tab will apply to all PAM providers.

   Tip:  The search bar at the top of PAM Provider Name column on the PAM provider permissions tab can make it easier to find PAM providers if you have a large number of them.
   Claims Tab

   On the Claims tab, you associate security claims with the security role to grant the permissions associated with the role to claim owners. You can associate existing security claims or add new security claims and associate them in one step. Claim to role associations can also be removed from this tab, but claims cannot be deleted from here.

   To add a new claim and associate it with the role in one step:

   1. On the Claims tab, click Add New from the menu at the top of the grid to add a new security claim and associate it.

   2. In the Add Claim dialog, select a Claim Type in the dropdown. Supported claim types are:

      • Active Directory User

        Active Directory user account.

      • Active Directory Group

      • Active Directory group.

      • Active Directory Computer

      • Active Directory machine account.

      • OAuth Client Id

        An open authorization client application claim.

      • OAuth Object Id

        An open authorization claim of a type not covered by client, role or subject.

      • OAuth Role

        An open authorization group claim.

      • OAuth Subject

        An open authorization user claim.

   3. In the Claim Value field, enter the identifying information for the entity specified in the claim. For Active Directory users and groups, this will be in the form DOMAIN\user or group name (e.g. KEYEXAMPLE\PKI A public key infrastructure (PKI) is a set of roles, policies, and procedures needed to create, manage, distribute, use, store and revoke digital certificates and manage public-key encryption. Administrators). For Active Directory computers, this will be in the form of a machine account (e.g. KEYEXAMPLE\MyServer$). For an identity provider other than Active Directory, users are referenced by GUID (see Configuring Keyfactor Identity Provider and Collecting Data for the Keyfactor Command Installation) and groups (roles) are referenced by role name.

      Important:  The built-in Active Directory groups Domain Admins and Enterprise Admins cannot be used directly to grant access to the Management Portal due to how these groups function within Windows. You can create a custom Active Directory group, reference that group in the Management Portal, and add the built-in Domain Admins or Enterprise Admins group to that custom group, if desired.
      Tip:  If you’re using a federated identity provider with Keyfactor Identity Provider to authenticate your users, enter the Keyfactor Identity Provider identity for that user or a role in Keyfactor Identity Provider that user has been granted (see Federating from Keyfactor Identity Provider).

   4. In the Provider dropdown, select the correct identity provider for the claim—either Active Directory or the identity provider name you configured using the configuration wizard.

      Tip:  If you’re using a federated identity provider with Keyfactor Identity Provider to authenticate your users, select the Keyfactor Identity Provider name in the dropdown.

   5. In the Description field, enter a description for the security claim. For example, the user’s full name or the group owner. This field is required.

      

      Figure 352: Add a Security Claim for an OAuth Identity Provider Role

   To associate an existing claim with the role:

   1. On the Claims tab, highlight a row and click Add Existing from the top of the grid or from the right click menu to associate an existing claim.

   2. On the Select Existing Claims dialog, check the box next to each desired claim and click Include or Include and Close to associate the claim(s) with this role. You may use the search at the top of the dialog to limit the claims shown in the dialog grid (see Using the Security Claim Search Feature).

      

      Figure 353: Associate Existing Claims with a Security Role

   To remove the association of a claim to the role, on the Claims tab, highlight one or more rows and click Remove from the top of the grid or select a single row and choose Remove from the right click menu.

4. Click Save to save the role.

To copy a security role:

1. In the Management Portal, browse to System Settings Icon > Security Roles and Claims.
2. On the Security Roles and Claims page, select the Security Role tab. Highlight a row and click Copy from the top of the grid or from the right click menu to copy an existing role.

3. Click OK to the Confirm Operation message.

   Note:  Copying a security role will also assign the new role to all the same security claims as the original role.
4. The name will automatically be set to Copy of (original role name) with the same description as the original role. Update the name and description and click Save.

To delete a security role:

1. In the Management Portal, browse to System Settings Icon > Security Roles and Claims.
2. On the Security Roles and Claims page, select the Security Role tab. Highlight a row and click Delete from the top of the grid or from the right click menu to delete an existing role.