Quorums

This feature allows an administrator to configure a system (or quorum) that can have multiple approvers for an operation. These approvers need to approve the operations before they can be successfully executed.

Operations Supported by Quorums

The authorized group(s) for quorum approval associated with operations are configurable. To configure, refer to Updating Quorum Profile.

CTE and CTE UserSpace support CipherTrust Manager's quorum feature. Refer to the Quorum Control section for details on supported CTE and CTE UserSpace operations and resources.

Managing Quorum on Policies

The CipherTrust Manager allows you to enable quorum for:

• ManagePolicyAttachment

• DeletePolicy

These policies can be system policies, user policies, or quorum policies.

Once a quorum is enabled for ManagePolicyAttachment and DeletePolicy, the activation and deactivation of a quorum for any supported operation has to go through the quorum's approval process, similar to any other operation on the CipherTrust Manager.

ManagePolicyAttachment

The ManagePolicyAttachment operation gives you a provision to enable a quorum for:

• Creating policy attachments

• Deleting policy attachments

When you activate a quorum, a policy and a policy attachment is created internally. If you want to bring activation of a quorum policy under a quorum, activate the quorum on the ManagePolicyAttachment.

DeletePolicy

The DeletePolicy operation is used to enable quorum on policy deletion. When you deactivate a quorum, a policy is deleted internally. If you want to bring deactivation of a quorum policy under a quorum, activate the quorum on the DeletePolicy action.

Refer to Enabling Quorum on ManagePolicyAttachment and DeletePolicy for more details.

Quorum Policies

To enable the quorum for any operation, first you need to activate the quorum policy. After the quorum policy is active for an operation, a quorum gets created in a pre-active state on performing the corresponding operation. To activate a quorum policy, refer to Activating the Quorum Policy.
For more details on quorum policies, refer to Managing Quorums Policies using ksctl.

Quorum Profile

It's a configuration that defines the expiration time, number of approvals, and the voter groups for a quorum. For more details on quorum profile, refer to Managing Quorums Profiles using ksctl.

States & Life-cycle of a Quorum Request

If an administrator has configured a quorum for any operation and the user initiates that operation, then that operation is denied and leads to creation of a quorum request.

The quorum request life-cycle is as follows:

• The quorum is created in a pre-active state. A quorum or a quorum request can have one of these six states at a time as depicted in the below diagram.

  

  Note

  The user/requester of this quorum must activate the quorum before any of the approvers can review the quorum request.

• Once the quorum is in the active state, it is available to the approvers to review it. The user/requester can optionally add a reason for initiating the request while activating it.

• When the required approvals are granted, the quorum is set to an approved state.

• A quorum request is set to an executed state if the operation has been completed with an approved quorum.

• A deny vote forces a quorum to be in a denied state implying that the operation can not be performed and the quorum is terminated.

In case, if a quorum already exists for the same operation, the status of the existing quorum is used to determine the outcome of the operation. Any approver can vote either to approve or deny a quorum request. A note can be added with the vote for additional information.

Managing Quorums Policies using ksctl

The following operations can be performed:

• Activate the quorum policy

• Get status of the quorum policy

• Deactivate the quorum policy

Activating the Quorum Policy

To create a policy supporting quorum and activating the policy, run:

Syntax

ksctl quorum-policy activate --actions <Actions>

Example Request 1

ksctl quorum-policy activate --actions "DeleteKey"

Example Response

{
        "Policy": {
                "id": "fd6f911b-f280-492c-9eac-aed35590d530",
                "uri": "kylo:kylo:admin:policies:enablequorum-fd6f911b-f280-492c-9eac-aed35590d530",
                "account": "kylo:kylo:admin:accounts:kylo",
                "application": "ncryptify:gemalto:admin:apps:kylo",
                "devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
                "createdAt": "2021-06-01T04:45:48.917228Z",
                "name": "EnableQuorum",
                "actions": [
                        "DeleteKey"
                ],
                "resources": null,
                "allow": false,
                "effect": "obligate_on_allow",
                "updatedAt": "2021-06-01T04:45:48.917228Z"
        },
        "required_approvals": 2
}

Getting Status of the Quorum Policy

To know whether the quorum policy is in active state or inactive state, run:

Syntax

ksctl quorum-policy status

Example Request

ksctl quorum-policy status

Example Response

 [
    {
        "operation": [
            "DeleteKey"
        ],
        "active": false,
        "profile": "DeleteKey requires quorum"
    },
    {
        "operation": [
            "DownloadBackupkeyDomain"
        ],
        "active": false,
        "profile": "DownloadBackupkeyDomain requires quorum"
    },
    {
        "operation": [
            "AddUserToGroup"
        ],
        "active": false,
        "profile": "AddUserToGroup requires quorum"
    },
    {
        "operation": [
            "RestoreBackupDomain"
        ],
        "active": false,
        "profile": "RestoreBackupDomain requires quorum"
    },
    {
        "operation": [
            "ManagePolicy"
        ],
        "active": false,
        "profile": "ManagePolicy requires quorum"
    },
    {
        "operation": [
            "DeleteDomain"
        ],
        "active": false,
        "profile": "DeleteDomain requires quorum"
    },
    {
        "operation": [
            "DeleteEKMKey"
        ],
        "active": false,
        "profile": "DeleteEKMKey requires quorum"
    },
    {
        "operation": [
            "RestoreBackup"
        ],
        "active": false,
        "profile": "RestoreBackup requires quorum"
    },
    {
        "operation": [
            "DownloadBackupkey"
        ],
        "active": false,
        "profile": "DownloadBackupkey requires quorum"
    }
]

The 'active' field represents whether policy is active. It returns true if the quorum policy is active and false otherwise.

Deactivating the Quorum Policy

To deactivate the already active quorum policy for any specific operation, run:

Syntax

ksctl quorum-policy deactivate --actions <Actions>

Example Request

ksctl quorum-policy deactivate "DeleteKey"

Example Response

There will be no response if quorum policy is deactivated successfully.

Enabling Quorum on ManagePolicyAttachment and DeletePolicy

Enabling a quorum on ManagePolicyAttachment and DeletePolicy brings activation/deactivation of a quorum policy under a quorum. It implies that you won't be able to activate/deactivate any quorum on your own without creating a quorum for that request.

Let's consider a scenario where you have activated a quorum for the "DeleteKey" operation. Currently, you are allowed to deactivate the created quorum.

However, if a quorum is enabled on ManagePolicyAttachment and DeletePolicy, you cannot activate/deactivate any quorum.
Now, let's enable a quorum on both ManagePolicyAttachment and DeletePolicy operations. To do so, run the following commands:

For ManagePolicyAttachment

ksctl  quorum-policy  activate --actions "ManagePolicyAttachment"

Response

{
    "Policy": {
        "id": "865baeb0-cace-4e76-943c-3fea78c0252d",
        "uri": "kylo:kylo:admin:policies:managepolicyattachment-requires-quorum-865baeb0-cace-4e76-943c-3fea78c0252d",
        "account": "kylo:kylo:admin:accounts:kylo",
        "application": "ncryptify:gemalto:admin:apps:kylo",
        "devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
        "createdAt": "2022-09-08T11:05:48.488623Z",
        "name": "ManagePolicyAttachment requires quorum",
        "actions": [
            "CreateAttachedPolicy",
            "DeleteAttachedPolicy"
        ],
        "resources": null,
        "allow": false,
        "effect": "obligate_on_allow",
        "updatedAt": "2022-09-08T11:05:48.488623Z"
    },
    "required_approvals": 3
}

For DeletePolicy

ksctl  quorum-policy  activate --actions "DeletePolicy"

Response

{
    "Policy": {
            "id": "e735b3e8-4698-45ad-814a-4ddfad75c572",
            "uri": "kylo:kylo:admin:policies:deletepolicy-requires-quorum-e735b3e8-4698-45ad-814a-4ddfad75c572",
            "account": "kylo:kylo:admin:accounts:kylo",
            "application": "ncryptify:gemalto:admin:apps:kylo",
            "devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
            "createdAt": "2022-09-08T11:05:45.325665Z",
            "name": "DeletePolicy requires quorum",
            "actions": [
                    "DeletePolicy"
            ],
            "resources": null,
            "allow": false,
            "effect": "obligate_on_allow",
            "updatedAt": "2022-09-08T11:05:45.325665Z"
    },
    "required_approvals": 3
}

Now, if you try to deactivate the quorum for "DeleteKey" created above, an error is thrown as shown below and the deactivation of quorum is not allowed:

{
    "code": 4,
    "codeDesc": "NCERRInsufficientPermissions",
    "message": "A Quorum has been created with ID (fd6f911b-f280-492c-9eac-aed35590d530) in pre-active state. Please activate it."
}

Managing Quorums using ksctl

The following operations can be performed:

• Activate quorum

• Approve quorum

• Deny quorum

• List/Search quorums

• Get quorum

• Delete quorum

• Revoke vote

Activating Quorums

To activate a quorum, run:

Syntax

ksctl quorum activate --id <QuorumId> --quorum-reason <Reason-to-activate>

It changes the state of the quorum from pre-active to active. A quorum can be approved only when it is in the active state.
After quorum is active, it is available for the approval process.

Example Request

ksctl quorum activate --id  558622f8-bf20-4ded-9f43-e72bfaaf73a5

Example Response

{
        "id": "558622f8-bf20-4ded-9f43-e72bfaaf73a5",
        "uri": "kylo:kylo:sallyport:quorum:558622f8-bf20-4ded-9f43-e72bfaaf73a5",
        "account": "kylo:kylo:admin:accounts:kylo",
        "createdAt": "2021-05-31T07:47:27.435019Z",
        "updatedAt": "2021-06-01T05:02:49.884088Z",
        "requester_id": "local|f3ef594a-6b8f-4906-87b6-bd415762115d",
        "operation_fingerprint": "c301c3c23252fa3ff3d097e5d00c9000",
        "operation": "DeleteKey",
        "resource_uri": "kylo:kylo:vault:keys:ks-d707f2d9f313415fbc613e4bffb3ebb810f7235350824f2bbaff68668fef6c2e-v0",
        "state": "active",
        "required_approvals": 1,
        "meta": null,
        "votes": []
}

Approving Quorums

To approve a quorum, run:

Syntax

ksctl quorum approve --id <QuorumId> --note <Additional-note-for-approval>

When all the required approvals are available, then quorum moves to the approved state and you can re-initiate the associated operation.

Example Request

ksctl quorum approve --id  558622f8-bf20-4ded-9f43-e72bfaaf73a5

Example Response

There will be no response if quorum is approved successfully.

Denying Quorums

To deny a approval to a quorum, run:

Syntax

ksctl quorum deny --id <QuorumId> --note <Additional-note-for-denial>

This command moves a quorum to the denied state. This is a terminal state and quorum is unusable after deny.

Example Request

ksctl quorum deny --id  558622f8-bf20-4ded-9f43-e72bfaaf73a5

Example Response

There will be no response if quorum is denied successfully.

Getting List of Quorums

To get the list of quorums, run:

Syntax

ksctl quorum list

Example Request

ksctl  quorum list

Example Response

{
        "skip": 0,
        "limit": 10,
        "total": 1,
        "resources": [
                {
                        "id": "558622f8-bf20-4ded-9f43-e72bfaaf73a5",
                        "uri": "kylo:kylo:sallyport:quorum:558622f8-bf20-4ded-9f43-e72bfaaf73a5",
                        "account": "kylo:kylo:admin:accounts:kylo",
                        "createdAt": "2021-05-31T07:47:27.435019Z",
                        "updatedAt": "2021-05-31T07:47:27.431175Z",
                        "requester_id": "local|f3ef594a-6b8f-4906-87b6-bd415762115d",
                        "operation_fingerprint": "c301c3c23252fa3ff3d097e5d00c9000",
                        "operation": "DeleteKey",
                        "resource_uri": "kylo:kylo:vault:keys:ks-d707f2d9f313415fbc613e4bffb3ebb810f7235350824f2bbaff68668fef6c2e-v0",
                        "state": "pre-active",
                        "required_approvals": 1,
                        "meta": null,
                        "votes": []
                }
        ]
}

Getting Details of Quorums

To get details of a quorum, run:

Syntax

ksctl quorum get --id <QuorumId>

Example Request

ksctl quorum get --id 558622f8-bf20-4ded-9f43-e72bfaaf73a5

Example Response

{
        "id": "558622f8-bf20-4ded-9f43-e72bfaaf73a5",
        "uri": "kylo:kylo:sallyport:quorum:558622f8-bf20-4ded-9f43-e72bfaaf73a5",
        "account": "kylo:kylo:admin:accounts:kylo",
        "createdAt": "2021-05-31T07:47:27.435019Z",
        "updatedAt": "2021-05-31T07:47:27.431175Z",
        "requester_id": "local|f3ef594a-6b8f-4906-87b6-bd415762115d",
        "operation_fingerprint": "c301c3c23252fa3ff3d097e5d00c9000",
        "operation": "DeleteKey",
        "resource_uri": "kylo:kylo:vault:keys:ks-d707f2d9f313415fbc613e4bffb3ebb810f7235350824f2bbaff68668fef6c2e-v0",
        "state": "pre-active",
        "required_approvals": 1,
        "meta": null,
        "votes": []
}

Deleting Quorums

To delete a quorum, run:

Syntax

ksctl quorum delete --id <QuorumId>

Example Request

ksctl quorum delete --id  558622f8-bf20-4ded-9f43-e72bfaaf73a5

There will be no response if quorum is deleted successfully.

Revoking Vote for Quorums

To revoke your vote from an already approved quorum, run:

Syntax

ksctl quorum revoke --id <QuorumId>

If the number of approvals falls below the required approvals, the quorum moves back to the active state.

Example Request

ksctl quorum revoke  --id 558622f8-bf20-4ded-9f43-e72bfaaf73a5

Example Response

There will be no response if vote is revoked successfully.

Managing Quorum Profiles using ksctl

The following operations can be performed:

• Get quorum profile

• List/Search quorum profiles

• Update quorum profile

Getting Details of the Quorum Profile

To get the details of quorum profile, run:

Syntax

ksctl quorum-profiles get --profile-id <ProfileID>

Example Request

ksctl quorum-profiles get --profile-id c4a11fc1-d226-4f19-8d03-5911198e89e5

Example Response

ksctl quorum-profiles get --profile-id "61af169c-36b7-42b8-b396-284b92a52613"
{
        "id": "61af169c-36b7-42b8-b396-284b92a52613",
        "uri": "kylo:kylo:sallyport:quorum-profile:deletepolicy-requires-quorum-61af169c-36b7-42b8-b396-284b92a52613",
        "account": "kylo:kylo:admin:accounts:kylo",
        "createdAt": "2021-08-20T05:15:50.329875Z",
        "updatedAt": "2021-08-20T05:17:40.091664Z",
        "name": "DeletePolicy requires quorum",
        "required_approvals": 3,
        "voter_groups": [
                "System Admins"
        ]
}

Getting List of Quorum Profiles

To get the list of all quorum profiles, run:

Syntax

ksctl quorum-profiles list

Example Request

ksctl quorum-profiles list

Example Response

{
        "skip": 0,
        "limit": 10,
        "total": 6,
        "resources": [
                {
                        "id": "61af169c-36b7-42b8-b396-284b92a52613",
                        "uri": "kylo:kylo:sallyport:quorum-profile:managepolicy-requires-quorum-61af169c-36b7-42b8-b396-284b92a52613",
                        "account": "kylo:kylo:admin:accounts:kylo",
                        "createdAt": "2021-08-20T05:15:50.329875Z",
                        "updatedAt": "2021-08-20T05:15:50.328328Z",
                        "name": "ManagePolicy requires quorum",
                        "required_approvals": 3,
                        "voter_groups": [
                                "admin"
                        ]
                },
                {
                        "id": "8966e5c1-7f0b-4bad-b950-6f6aa57c4562",
                        "uri": "kylo:kylo:sallyport:quorum-profile:restorebackup-requires-quorum-8966e5c1-7f0b-4bad-b950-6f6aa57c4562",
                        "account": "kylo:kylo:admin:accounts:kylo",
                        "createdAt": "2021-08-20T05:15:50.326206Z",
                        "updatedAt": "2021-08-20T05:15:50.324867Z",
                        "name": "RestoreBackup requires quorum",
                        "required_approvals": 3,
                        "voter_groups": [
                                "Backup Admins",
                                "Restore Admins"
                        ]
                },
                {
                        "id": "04c9a485-dad8-4c76-8779-62a912f179f4",
                        "uri": "kylo:kylo:sallyport:quorum-profile:addusertogroup-requires-quorum-04c9a485-dad8-4c76-8779-62a912f179f4",
                        "account": "kylo:kylo:admin:accounts:kylo",
                        "createdAt": "2021-08-20T05:15:50.322876Z",
                        "updatedAt": "2021-08-20T05:15:50.321965Z",
                        "name": "AddUserToGroup requires quorum",
                        "required_approvals": 3,
                        "voter_groups": [
                                "User Admins"
                        ]
                },
                {
                        "id": "3f7d5445-c11c-4e18-8415-842a595b2cc9",
                        "uri": "kylo:kylo:sallyport:quorum-profile:downloadbackupkey-requires-quorum-3f7d5445-c11c-4e18-8415-842a595b2cc9",
                        "account": "kylo:kylo:admin:accounts:kylo",
                        "createdAt": "2021-08-20T05:15:50.319131Z",
                        "updatedAt": "2021-08-20T05:15:50.317472Z",
                        "name": "DownloadBackupkey requires quorum",
                        "required_approvals": 3,
                        "voter_groups": [
                                "Backup Admins",
                                "Restore Admins"
                        ]
                },
                {
                        "id": "3fa83307-8dc5-4d9f-be94-b25a54ffdc09",
                        "uri": "kylo:kylo:sallyport:quorum-profile:deletekey-requires-quorum-3fa83307-8dc5-4d9f-be94-b25a54ffdc09",
                        "account": "kylo:kylo:admin:accounts:kylo",
                        "createdAt": "2021-08-20T05:15:50.31489Z",
                        "updatedAt": "2021-08-20T05:15:50.313633Z",
                        "name": "DeleteKey requires quorum",
                        "required_approvals": 3,
                        "voter_groups": [
                                "Key Admins"
                        ]
                },
                {
                        "id": "95506ebb-2fde-48cd-b107-541dc599331e",
                        "uri": "kylo:kylo:sallyport:quorum-profile:deletedomain-requires-quorum-95506ebb-2fde-48cd-b107-541dc599331e",
                        "account": "kylo:kylo:admin:accounts:kylo",
                        "createdAt": "2021-08-20T05:15:50.310317Z",
                        "updatedAt": "2021-08-20T05:15:50.307507Z",
                        "name": "DeleteDomain requires quorum",
                        "required_approvals": 3,
                        "voter_groups": [
                                "Domain Admins"
                        ]
                }
        ]
}

Updating Quorum Profile

To update the quorum profile, run:

Syntax

ksctl quorum-profiles update --profile-id <ProfileID> --approvals <NumberOfApprovals> --voter-groups <VoterGroups>

Example Request 1

ksctl quorum-profiles update --profile-id 61af169c-36b7-42b8-b396-284b92a52613 --approvals 2

Example Response 1

{
        "id": "61af169c-36b7-42b8-b396-284b92a52613",
        "uri": "kylo:kylo:sallyport:quorum-profile:managepolicy-requires-quorum-61af169c-36b7-42b8-b396-284b92a52613",
        "account": "kylo:kylo:admin:accounts:kylo",
        "createdAt": "2021-08-20T05:15:50.329875Z",
        "updatedAt": "2021-08-20T05:19:32.613434Z",
        "name": "ManagePolicy requires quorum",
        "required_approvals": 2,
        "voter_groups": [
                "admin"
        ]
}

Example Request 2

ksctl quorum-profiles update --profile-id 61af169c-36b7-42b8-b396-284b92a52613 --approvals 2 --voter-groups 'Domain Admins,Key Admins'

Example Response 2

{
        "id": "61af169c-36b7-42b8-b396-284b92a52613",
        "uri": "kylo:kylo:sallyport:quorum-profile:managepolicy-requires-quorum-61af169c-36b7-42b8-b396-284b92a52613",
        "account": "kylo:kylo:admin:accounts:kylo",
        "createdAt": "2021-08-20T05:15:50.329875Z",
        "updatedAt": "2021-08-20T05:19:32.613434Z",
        "name": "ManagePolicy requires quorum",
        "required_approvals": 2,
        "voter_groups": [
                "Domain Admins"
                "Key Admins"
        ]
}