Your suggested change has been received. Thank you.

close

Suggest A Change

https://thales.na.market.dpondemand.io/docs/dpod/services/kmo….

Thales Logo

All

  • All
back

SAS Management API

Setup

search

Please Note:

Setup

The SAS PCE Enterprise Virtual Appliance wizard configures the SAS Management API for the primary tenant specified during first-boot. If you create additional (child) tenants in SAS PCE Console after the appliance is already running, follow the steps on this page to enable the SAS Management API for each new tenant.

Prerequisites

  • The appliance is already configured (sudo configure-sae has completed) and the primary sas-mgmt client works end-to-end.

  • You know the child tenant's SAS PCE tenant code and opertaor UUID.

Overview of the workflow

The procedure imports a SAE client template, sets three protocol mappers so that the issued JWT contains the child tenant's identifiers, and generates a new client secret. You can then use the new client's credentials to call the SAS Management API for the child tenant.

Step 1 — Open the SAE Admin UI and switch to the SASManagementAPI realm

  1. Open https://<appliance-fqdn>/admin/ in a browser.

  2. Sign in with the SAE admin account.

  3. From the realm selector in the top-left corner, select SASManagementAPI.

Step 2 — Download the client template JSON

Download the SAE client template from the link below and save it to your workstation:

sas-mgmt-child.json

The template uses a default clientId as sas-mgmt-child and two placeholder strings that must be replaced. The clientId is always renamed in the SAE Admin UI after import or you can rename it in the JSON file before importing it. Similarly, you can replace the two mapper placeholders in the JSON file before import (Step 3, Option A) or in the SAE Admin UI after import (Step 3, Option B). Both options produce the same result.

Where What to change
clientId field (currently sas-mgmt-child) Rename in the Admin UI's Client ID field after import
<Update me with tenant id> (appears twice — in the tenantId mapper and the user_tenant_id mapper) The child tenant's SAS PCE tenant code (for example TENANTB01). Must be identical in both mappers.
<Update me with OPERATOR_UUID> (appears once — in the uuid mapper) The appliance's operator UUID. Run sudo sas-mgmt-info on the appliance to see it, or copy it from the primary sas-mgmt client's uuid mapper in the Admin UI. The same UUID is reused across all tenants.

Do not change any other field in the file — these are shared across tenants. Only the three placeholders above must be changed per tenant.

Step 3 — Import the client (choose Option A or Option B)

Both options produce the same imported client. Choose the option that best suits your preferred editing workflow.

Option A — Edit the JSON first, then import

  1. In your text editor, replace both <Update me with tenant id> strings with the child tenant code and replace <Update me with OPERATOR_UUID> with the appliance operator UUID. Save the file.

  2. In the SAE Admin UI (SASManagementAPI realm), click Clients in the left menu, .then click Import client in the top-right corner.

    Clients list with Import client button

  3. In the Import client dialog, click Browse and select your edited sas-mgmt-child.json.

    Import client dialog with sas-mgmt-child.json loaded

  4. In the Client ID field, change the pre-filled sas-mgmt-child and click Save.

  5. Skip to Step 4 — the mappers are already correct, no further editing is needed in the UI.

Option B — Import the template as-is, then edit in the Admin UI

  1. In the SAE Admin UI (SASManagementAPI realm), click Clients in the left menu, then click Import client.

    Clients list with Import client button

  2. In the Import client dialog, click Browse and select the unmodified sas-mgmt-child.json.

    Import client dialog with sas-mgmt-child.json loaded

  3. In the Client ID field, change the pre-filled sas-mgmt-child. Click Save.

  4. Open the newly created client, click the Client scopes tab, and open the dedicated scope named (name you gave to Client ID-dedicated) sas-mgmt-child-dedicated.

    Dedicated client scope on the Client scopes tab

  5. On the Mappers tab within the dedicated client scope, edit each of the following three mappers in turn. Click the mapper name, replace the Claim value, and then click Save:

    Mapper name Current value in template New value
    tenantId <Update me with tenant id> The child tenant code (for example TENANTB01)
    user_tenant_id <Update me with tenant id> The child tenant code (same value as above)
    uuid <Update me with OPERATOR_UUID> The appliance operator UUID (see Step 2 table)
Step 4 — Generate the client secret

  1. Return to the client's main page then clik the newly created client sas-mgmt-child.

  2. Open the Credentials tab.

  3. Verify that Client Authenticator is set to Client Id and Secret.

  4. Click Regenerate next to Client Secret. Copy the generated secret immediately — you will need it in Step 5.

    Credentials tab with Regenerate secret button

Store the client secret in your organization's secret manager. The Admin UI will not show the plaintext secret again after you navigate away.

Step 5 — Mint an access token and call the API for the child tenant

Replace <APPLIANCE_FQDN>, <CHILD_TENANT_CODE>, <CHILD_CLIENT_SECRET>, and <USER_ID> with your values.

# Mint access token (OAuth2 client-credentials)
TOKEN=$(curl -sk -X POST \
  "https://<APPLIANCE_FQDN>/realms/SASManagementAPI/protocol/openid-connect/token" \
  -d "grant_type=client_credentials" \
  -d "client_id=sas-mgmt-<CHILD_TENANT_CODE>" \
  -d "client_secret=<CHILD_CLIENT_SECRET>" | jq -r .access_token)

# Call SAS Management API for the child tenant
curl -sk -H "Authorization: Bearer ${TOKEN}" \
  "http://<APPLIANCE_FQDN>:5003/api/v1/tenants/<CHILD_TENANT_CODE>/users/<USER_ID>/authenticators"

To use the Swagger UI for the child tenant, open http://<APPLIANCE_FQDN>:5003/swagger/index.html, click Authorize, paste the bearer token obtained above, and invoke endpoints using the child tenant code in the path.

On this page