PUT Security Roles
The PUT /Security/Roles method is used to update a security role in Keyfactor Command including the permissions set for the role and the security identities mapped to the role. This method returns HTTP 200 OK on a success with the details of the security role.
Tip: The following permissions (see
Security Roles and Claims) are required to use this feature:
/security/modify/
The user must hold a role containing this permission in the Global Permission Set (see Permission Sets).
Important: Any previously populated fields that are not submitted with their full existing data using this method will be cleared of their existing data. When using this method, you should first do a GET to retrieve all the values for the record you want to update, enter corrected data into the field(s) you want to update, and then submit all the fields using PUT, including the fields that contain values but which you are not changing.
This method has two available versions. Keyfactor strongly recommends using the newer method when possible; the v1 method has been deprecated since it supports Active Directory identities only. The v2 method has been redesigned to provide support for alternate identity providers and the newer claims-based authentication model that accompanies this. This version of the method supports both Active Directory and other identity providers. For more information about versioning, see Versioning.
Version 2 of the PUT /Security/Roles method has been redesigned to provide support for alternate identity providers and the newer claims-based authentication model that accompanies this. All new development should use this version.
Table 640: PUT Security Roles v2 Input Parameters
| Id |
Body |
Required. An integer containing the Keyfactor Command identifier for the security role.
Use the GET /Security/Roles method (see GET Security Roles) to retrieve a list of all the security roles to determine the role's ID.
|
| Name |
Body |
Required. A string containing the short reference name for the security role. |
| Description |
Body |
Required. A string containing the description for the security role. |
| Permission SetId |
Body |
A string containing the Keyfactor Command reference GUID of the permission set to which the role is assigned (see Permission Sets).
|
| Permissions |
Body |
An array of strings containing the permissions assigned to the role in a comma-separated list of Name:Value pairs. See Version Two Permission Model for an overview of the possible permissions.
For example:
Copy
"Permissions": [
"/portal/read/",
"/dashboard/read/",
"/certificates/collections/metadata/modify/6/",
"/certificates/collections/private_key/read/6/"
],
|
| Claims |
Body |
An array of objects containing the claims associated with the role.
| Description |
Body |
A string indicating a description for the security claim. |
| Claim Type |
Body |
A string indicating the type of claim. Supported values are:
| 0 |
User |
Active Directory user account |
| 1 |
Group |
Active Directory group.
|
| 2 |
Computer |
Active Directory machine account
|
| 3 |
OAuth Oid |
An open authorization claim of a type not covered by client, role or subject
|
| 4 |
OAuth Role |
An open authorization group claim
|
| 5 |
OAuth Subject |
An open authorization user claim
|
| 6 |
OAuth ClientId |
An open authorization client application claim
|
|
| Claim Value |
Body |
A string containing the identifying information for the entity specified in the claim. For Active Directory users and groups, this will be in the form DOMAIN\user or group name (e.g. KEYEXAMPLE\PKI Administrators). For Active Directory computers, this will be in the form of a machine account (e.g. KEYEXAMPLE\MyServer$). |
| Provider Authentication Scheme |
Body |
A string indicating the provider authentication scheme (e.g. Active Directory, or Client Certificate Authentication CA, or unknown). |
|
Table 641: PUT Security Roles v2 Response Data
| Id |
Body |
An integer containing the Keyfactor Command identifier for the security role.
|
| Name |
Body |
A string containing the short reference name for the security role. |
| Description |
Body |
A string containing the description for the security role. |
| Immutable |
Body |
A Boolean indicating if the role is immutable (true) or not (false). Only the built-in Administrators role is considered immutable. The value of this parameter cannot be changed. |
| PermissionSetId |
Body |
A string containing the Keyfactor Command reference GUID of the permission set to which the role is assigned (see Permission Sets).
|
| Permissions |
Body |
An array of strings containing the permissions assigned to the role in a comma-separated list of Name:Value pairs. See Version Two Permission Model for an overview of the possible permissions.
For example:
Copy
"Permissions": [
"/portal/read/",
"/dashboard/read/",
"/certificates/collections/metadata/modify/6/",
"/certificates/collections/private_key/read/6/"
],
|
| Claims |
Body |
An array of objects containing the claims associated with the role.
| Id |
|
An integer containing the Keyfactor Command reference ID for the security claim. |
| Description |
Body |
A string indicating a description for the security claim. |
| Claim Type |
Body |
A string indicating the type of claim. Supported values are:
| 0 |
User |
Active Directory user account |
| 1 |
Group |
Active Directory group.
|
| 2 |
Computer |
Active Directory machine account
|
| 3 |
OAuth Oid |
An open authorization claim of a type not covered by client, role or subject
|
| 4 |
OAuth Role |
An open authorization group claim
|
| 5 |
OAuth Subject |
An open authorization user claim
|
| 6 |
OAuth ClientId |
An open authorization client application claim
|
|
| Claim Value |
Body |
A string containing the identifying information for the entity specified in the claim. For Active Directory users and groups, this will be in the form DOMAIN\user or group name (e.g. KEYEXAMPLE\PKI Administrators). For Active Directory computers, this will be in the form of a machine account (e.g. KEYEXAMPLE\MyServer$). |
| Provider |
Body |
An object containing information about the provider assigned to the security claim.
| Id |
A string indicating the Keyfactor Command reference GUID for the provider. |
| Authentication Scheme |
A string indicating the provider auth scheme (e.g. Active Directory, or Client Certificate Authentication CA, or unknown). |
| Display Name |
A string containing the short reference name for the provider (e.g. Active Directory). |
|
|
Version 1 of the PUT /Security/Roles method includes the same capabilities as version 2, but offers support for managing legacy formatted Active Directory identities only.
Important: This has been deprecated since it supports Active Directory identities only. It is retained for backwards compatibility, but all new development should use methods that provide support for alternate identity providers and the newer claims-based authentication model that accompanies this. These newer methods support both Active Directory and other identity providers. See version 2 of this method.
Table 642: PUT Security Roles v1 Input Parameters
| Id |
Body |
Required. An integer containing the Keyfactor Command identifier for the security role.
Use the GET /Security/Roles method (see GET Security Roles) to retrieve a list of all the security roles to determine the role's ID.
|
| Name |
Body |
Required. A string containing the short reference name for the security role. |
| Description |
Body |
Required. A string containing the description for the security role. |
| Enabled |
Body |
A Boolean that indicates whether the security role is enabled (true) or not (false). Security roles that have been disabled cannot be assigned to security identities. The default is true.
This is considered deprecated and may be removed in a future release.
|
| Private |
Body |
A Boolean that indicates whether the security role has been marked private (true) or not (false). The default is false.
This is considered deprecated and may be removed in a future release.
|
| Permission SetId |
Body |
A string indicating the Keyfactor Command reference GUID of the permission set associated with the role (see Permission Sets). |
| Permissions |
Body |
An array of strings containing the permissions assigned to the role in a comma-separated list of Name:Value pairs. See Version One Permission Model for an overview of the possible permissions.
For example:
Copy
"Permissions": [
"AdminPortal:Read",
"Dashboard:Read"
],
|
| Identities |
Body |
An array of objects containing one or more identifiers for each security identity to associate with the role.  Show identifier information.
| AccountName |
Required*. A string containing the account name for the security identity. For Active Directory user and groups, this will be in the form DOMAIN\\user or group name. For example:CopyKEYEXAMPLE\\PKI Administrators
* One of AccountName or SID is required in order to specify an identity, but not both. |
|
SID
|
Required*. A string containing the security identifier from the source identity store (e.g. Active Directory) for the security identity.
* One of AccountName or SID is required in order to specify an identity, but not both. |
For example:
Copy
"Identities": [
{
"AccountName": "KEYEXAMPLE\\jsmith"
},
{
"AccountName": "KEYEXAMPLE\\mjones"
}
]
|
Table 643: PUT Security Roles v1 Response Data
| Id |
An integer containing the Keyfactor Command identifier for the security role.
|
| Name |
A string containing the short reference name for the security role. |
| Description |
A string containing the description for the security role. |
| Enabled |
A Boolean that indicates whether the security role is enabled (true) or not (false). Security roles that have been disabled cannot be assigned to security identities. The default is true.
This is considered deprecated and may be removed in a future release.
|
| Immutable |
A Boolean that indicates whether the security role has been marked as editable (false) or not (true). Internal Keyfactor Command roles are not editable. This setting is reserved for Keyfactor Command internal use. |
| Valid |
A Boolean that indicates whether the security role's audit XML is valid (true) or not (false). A security role may become invalid if Keyfactor Command determines that it appears to have been tampered with. This setting is not end-user configurable. |
| Private |
A Boolean that indicates whether the security role has been marked private (true) or not (false). The default is false.
This is considered deprecated and may be removed in a future release.
|
| Permission SetId |
A string indicating the Keyfactor Command reference GUID of the permission set associated with the role (see Permission Sets). |
| Identities |
An array of objects containing information about the security identities assigned to the security role. Show identity details.
|
Id
|
An integer containing the Keyfactor Command identifier for the security identity.
|
| Account Name |
A string containing the account name for the security identity. For Active Directory users and groups, this will be in the form DOMAIN\\user or group name. For example: KEYEXAMPLE\\PKI Administrators |
| Identity Type |
A string indicating the type of identity—User or Group. |
|
SID
|
A string containing the security identifier from the source identity store (e.g. Active Directory) for the security identity. |
|
| Permissions |
An array of strings containing the permissions assigned to the role in a comma-separated list of Name:Value pairs. See Version One Permission Model for an overview of the possible permissions.
For example:
Copy
"Permissions": [
"AdminPortal:Read",
"Dashboard:Read"
],
|
Tip: See the
Keyfactor API Reference and Utility which provides a utility through which the
Keyfactor endpoints can be called and results returned. It is intended to be used primarily for validation, testing and development. It also serves secondarily as documentation for the API. The link to the
Keyfactor API Reference and Utility is in the dropdown from the help icon (
) at the top of the
Management Portal page next to the
Log Out button.