Granting Permissions to Users or Groups

se the post /v1/cckm/sap/ekm/keystores/{id}/update-acls API to grant permissions to users or groups to perform specific actions on the SAP keystore.

For the first time users or groups, actions are permitted as configured by the CCKM administrator. However, if the permissions of a user or group needs to be modified later, for example, a new action is to be permitted or an existing action is to be revoked, the CCKM administrator needs to set that particular action to true or false.

For example, a user or group is permitted actions, hyokkeycreate, hyokkeyupdate, and hyokkeydelete. Now, to permit one more action hyokkeyblockunblock to the user or group, set "permit":true and "actions": "hyokkeyblockunblock", and run the API. Similarly, now to deny permission to the action hyokkeycreate, set "permit":false, "actions": "hyokkeycreate", and run the API.

Syntax

curl -k 'https://<IP>/api/v1/cckm/sap/ekm/keystores/{id}/update-acls' -X POST -H 'Authorization: AUTHTOKEN' --compressed

Here, {id} represents the keystore ID.

Request Parameters

Parameter	Type	Description
AUTHTOKEN	string	Authorization token.
actions	array of strings	Permitted actions on the SAP keys. The actions can be: • hyokkeycreate • viewhyokkey • hyokkeyupdate • hyokkeydelete • hyokkeyblockunblock • hyokkeyrotate • hyokkeyarchiverecover Refer to APIs and Action Mapping for the supported actions and details.
group	string	Name of the user group to be granted permissions. User ID and group are mutually exclusive – specify either.
permit	boolean	Whether to permit users to perform specific operations. Set `true` to permit, `false` to deny.
user_id	string	ID of the user to be granted permissions. User ID and group are mutually exclusive – specify either.

APIs and Action Mapping

The following table lists the mapping of APIs and actions required to call these APIs.

APIs	Actions Required	Description
List	viewhyokkey	Permission to view groups and their keys.
Create	hyokkeycreate	Permission to create external keys in SAP KeyStores.
Update	hyokkeyupdate	Permission to updates the SAP External key attributes.
Delete	hyokkeydelete	Permission to deletes an SAP External key and its versions.
Block	hyokkeyblockunblock	Permission to blocks all the proxy operations on the SAP external key.
Unblock	hyokkeyblockunblock	Permission to unblocks all the proxy operations on the SAP external key.
Enable/Disable	hyokkeyupdate	Permission to enable/disable the SAP External key.
Enable/Disable Auto Rotation	hyokkeyupdate	Permission to enable/disable the SAP External key rotation
Add Version	hyokkeyrotate	Permission to add versions on SAP External key.
Archive	hyokkeyarchiverecover	Permission to archive the SAP External key.
Recover	hyokkeyarchiverecover	Permission to recover the SAP External key.

Example Request

curl -k 'https://127.0.0.1/api/v1/cckm/sap/ekm/keystores/213k/update-acls' -X POST -H 'Authorization: Bearer eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiI2MDdmMDQ0My0xMTE2LTRkZDktODhkNC1hYTE5Yzk2N2VkYzMiLCJzdWIiOiJsb2NhbHw1MTAwODIzOS04MDkzLTRmM2YtODY0Ny1hMzI5NmM2ZmM2ODYiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJjbGllbnRfaWQiOiI4MzdjODQwZC03NWRkLTRiNGYtYTMxOC03OWNiMTZjYTI0OGQiLCJjbGllbnRfbmFtZSI6ImFwaS1wbGF5Z3JvdW5kIiwiY2xpZW50X3R5cGUiOiJwdWJsaWMiLCJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiODM3Yzg0MGQtNzVkZC00YjRmLWEzMTgtNzljYjE2Y2EyNDhkIiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6ImY2NDdjYTE0LWIzYjEtNGFiMS1iNzEyLWVmNzBlNzI1MzVjNSIsImlhdCI6MTcyNDk0NDM3MiwiZXhwIjoxNzI0OTQ0NjcyfQ.iQ8c_AyGde0Ea_yZA6CjlD1MjLggnhNth_iGWhKzOjmwdrN13vqLq9IgdDfuvsyNKIYbkGwLVENtE31EVSSg3A' -H 'accept: application/json' --compressed

Example Response

{
    "id": "7cde72f5-dcf2-4b34-8398-0d85403c1c02",
    "uri": "kylo:kylo:cckm:sap-keystore:7cde72f5-dcf2-4b34-8398-0d85403c1c02",
    "account": "kylo:kylo:admin:accounts:kylo",
    "createdAt": "2024-06-10T07:03:20.175147Z",
    "updatedAt": "2024-06-10T14:33:44.772115Z",
    "name": "sap-keystore",
    "description": "demo-sap-keystore",
    "acls": [
        {
            "group": "CCKM Users",
            "actions": [
                "viewhyokkey"
            ]
        }
    ],
    "keystore_url_hostname": "localhost:443",
    "keystore_url": "https://localhost:443/api/v1/cckm/sap/hyok/v1/keystores/7cde72f5-dcf2-4b34-8398-0d85403c1c02",
    "sap_tenant_id": "5e3d1d87-9502-42af-a946-3ffec9e71a44",
    "blocked": false,
    "state": "ACTIVE"
}

Response Codes

Response Code	Description
2xx	Success
4xx	Client errors
5xx	Server errors

Refer to HTTP status codes for details.

Granting Permissions to Users or Groups

Syntax

Request Parameters

APIs and Action Mapping

Example Request

Example Response

Response Codes

On this page

Suggest A Change