Managing Permissions on SAP Users or Groups

Use the post /v1/cckm/sap/groups/{id}/update-acls API to grant permissions to users or groups to perform specific actions on the SAP groups. User ID and group are mutually exclusive – specify either.

For the first time users or groups, actions are permitted as configured by the CCKM administrator. However, if the permissions of a user or group need to be modified later, for example, a new action is to be permitted or an existing action is to be revoked, the CCKM administrator needs to set that particular action to true or false.

For example, a user or group is permitted actions, keycreate, keyupload, and keydelete. Now, to permit one more action keyrestore to the user or group, set "permit":true and "actions": "keyrestore" and run the API. Similarly, now to deny permission to the action "keycreate", set "permit":false, "actions": "keycreate", and run the API.

Syntax

curl -k '<IP>/api/v1/cckm/sap/groups/{id}/update-acls' -X POST -H 'Authorization: AUTHTOKEN --compressed

Here, {id} is the resource ID of the SAP group.

Request Parameters

Parameter	Type	Description
AUTHTOKEN	string	Authentication token.
actions	array of strings	List of actions. The actions can be: • keycreate • keyupload • keyrotate • keyupdate • view • deletebackup • keydelete • keypurge • keyrestore • keysynchronize • keyrotatetonative • keyrotatetobyok • keyremove Refer to Actions for details.
group	string	Name of the user group to be granted permissions. User ID and group are mutually exclusive - specify either.
permit	boolean	Whether to permit users to perform specific operations. Set true to permit, false to deny.
user_id	string	ID of the user to be granted permissions. User ID and group are mutually exclusive – specify either.

Actions

The following table lists the accepted values:

APIs	Actions	Description
List	view	Permission to view groups and their keys.
Create	keycreate	Permission to create SAP native keys.
Upload	keyupload	Permission to upload the CipherTrust Manager keys to SAP.
Delete	keydelete	Permission to delete SAP keys.
Restore	keyrestore	Permission to restore backed up keys to groups.
Update(Edit key)	keyupdate	Permission to update keys, for example, editing properties, enabling/disabling keys, enabling/disabling key version, and editing labels.
Delete Backup	deletebackup	Permission to delete backups of SAP keys from the CCKM.
Rotate to Native Key	keyrotatetonative	Permission to rotate keys on SAP groups natively.
Rotate to BYOK Key	keyrotatetobyok	Permission to rotate keys on SAP groups using BYOK.
Synchronize	keysynchronize	Permission to synchronize SAP keys.
Cancel	keysynchronize	Permission to cancel synchronization jobs.
Remove	keyremove	Permission to remove SAP keys with their versions and backups from the CCKM.

Example Request

curl -k 'https://127.0.0.1/api/v1/cckm/sap/groups/e4b2c2da-4226-4cd8-bbfa-b3ad7a7c05ea/update-acls' -X POST -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJjNTQ1ZjU0OS1iMDViLTQ2MWUtYmY4MC00NWI3ZjQxNmUwMjgiLCJzdWIiOiJsb2NhbHw3ODA0Y2QzOC01YWIyLTQ1MjktOTcwYi1hOTEyNzVmOTBkMzUiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiZjg1MDQ5ZmUtZGM4Ni00NDVhLWEwMTUtNGUyM2NkNTc4OGM2Iiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6IjMzNWFjYjg0LTJjN2ItNGM1ZC1iMDIzLTgyOTQxNmZjYzUyZSIsImlhdCI6MTYzMzMzOTk4NywiZXhwIjoxNjMzMzQwMjg3fQ.wNxiuDp1f6ycODQUAPKtiyY-1wVzCkm6KjG5XYyUfh8' --compressed

Example Response

{
    "application/json":{
        "id":"ce0ffe4b-fbda-4e87-88af-4b9b4e6484f9",
        "uri":"kylo:kylo:cckm:sfdc-organization:ce0ffe4b-fbda-4e87-88af-4b9b4e6484f9",
        "account":"kylo:kylo:admin:accounts:kylo",
        "application":"ncryptify:gemalto:admin:apps:kylo",
        "devAccount":"ncryptify:gemalto:admin:accounts:gemalto",
        "createdAt":"2021-08-25T04:30:47.915696Z",
        "updatedAt":"2021-08-25T10:04:24.415596321Z",
        "name":"orgnisation name",
        "sfdc_org_id":"00DB000000012ABCDE",
        "connection":"sfdc",
        "cloud_name":"sfdc",
        "organization_type":"Sandbox",
        "refreshed_at":"2021-08-25T04:31:24.089748Z",
        "acls":[
            {
                "user_id":"local|624b6c12-21d4-489a-ab8b-982f91f2f3aa",
                "actions":[
                "view",
                "keydestroy"
                ]
            },
            {
                "group":"CCKM Users",
                "actions":[
                "view"
                ]
            }
        ]
    }
}

Response Codes

Response Code	Description
2xx	Success
4xx	Client errors
5xx	Server errors

Refer to HTTP status codes for details.

Suggest A Change

Managing Permissions on SAP Users or Groups

Syntax

Request Parameters

Actions

Example Request

Example Response

Response Codes