SPS can authenticate the users of the controlled SSH or RDP connections to LDAP databases.
GET https://<IP-address-of-SPS>/api/configuration/policies/ldap_servers
Cookie name | Description | Required | Values |
---|---|---|---|
session_id | Contains the authentication token of the user | Required |
The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API. Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format). |
The following command lists the available LDAP server configurations.
curl --cookie cookies https://<IP-address-of-SPS>/api/configuration/policies/ldap_servers
The following command retrieves the properties of a specific LDAP server.
curl --cookie cookies https://<IP-address-of-SPS>/api/configuration/policies/ldap_servers/<object-id>
The following is a sample response received when listing LDAP servers.
For details of the meta object, see Message format.
{ "items": [ { "key": "3548834825727acc530407", "meta": { "href": "/api/configuration/policies/ldap_servers/3548834825727acc530407" } } ], "meta": { "first": "/api/configuration/policies/audit_policies", "href": "/api/configuration/policies/ldap_servers", "last": "/api/configuration/policies/usermapping_policies", "next": "/api/configuration/policies/signing_cas", "parent": "/api/configuration/policies", "previous": "/api/configuration/policies/indexing", "transaction": "/api/transaction" } }
When retrieving the endpoint of a specific LDAP server, the response is the following.
{ "key": "posix-simple", "body": { "name": "posix-simple", "schema": { "selection": "posix", "membership_check": { enabled": true, "member_uid_attribute": "memberUid" }, "memberof_check": { "enabled": true, "memberof_user_attribute": "memberOf", "memberof_group_objectclass": "groupOfNames" }, "username_attribute": "uid", "user_dn_in_groups": [] }, "servers": [ { "host": { "selection" : "ip", "value": "10.110.0.1" }, "port": 389 } ], "user_base_dn": "ou=People,dc=example,dc=com", "group_base_dn": "ou=Groups,dc=example,dc=com", "bind_dn": null, "bind_password": null, "memberof_attribute": null, "encryption": { "selection": "disabled" }, "publickey_attribute": "sshPublicKey", "generated_publickey_attribute": null } }
Element | Type | Description | ||||
---|---|---|---|---|---|---|
key | string | Top level element, contains the ID of the LDAP server configuration. | ||||
body | Top level element (string) | Contains the properties of the LDAP server. | ||||
user_base_dn | string |
Name of the DN to be used as the base of queries regarding users.
| ||||
group_base_dn | string |
Name of the DN to be used as the base of queries regarding groups.
| ||||
bind_dn | string | The Distinguished Name that SPS should use to bind to the LDAP directory. | ||||
bind_password | string |
References the password SPS uses to authenticate on the server. You can configure passwords at the /api/configuration/passwords/ endpoint. To modify or add a password, use the value of the returned key as the value of the password element, and remove any child elements (including the key). | ||||
encryption | Top level item | Configuration settings for encrypting the communication between SPS and the LDAP server. | ||||
generated_publickey_attribute | string |
Set this element to null if you use passwords to authenticate. Configure this element if you want SPS to generate server-side encryption keys on-the-fly, and store them in a separate attribute on the LDAP server. | ||||
name | string | Top level element, the name of the object. This name is also displayed on the SPS web interface. It cannot contain whitespace. | ||||
publickey_attribute | string |
Set this element to null if you use passwords to authenticate. The name of the LDAP attribute that stores the public keys of the users. | ||||
schema | Top level item | Contains the configuration settings for the AD schema. | ||||
servers | Top level list | Contains the addresses and ports of the LDAP servers. |
Elements of encryption | Type | Description | |
---|---|---|---|
selection | string |
Defines the type of encryption SPS uses to communicate with the LDAP server. Possible values are:
| |
client_authentication | Top level item |
Must be used with the selection child element. Configures the X.509 certificate SPS uses to authenticate on the LDAP server. | |
enabled | boolean |
Must be used with the client-authentication parent element. Set to true if the LDAP server requires mutual authentication. | |
x509_identity | string |
Must be used if the enabled element is set to true. References the identifier of the X.509 certificate stored on SPS. You can configure X.509 certificates at the /api/configuration/x509/ endpoint. To modify or add an X.509 host certificate, use the value of the returned key as the value of the x509_identity element, and remove any child elements (including the key). | |
selection | string |
Defines the type of encryption SPS uses to communicate with the LDAP server. Possible values are:
| |
server_certificate_check | Top level item |
Must be used with the enabled child element. Configuration settings for verifying the LDAP server's certificate. | |
enabled | boolean |
Must be used with the server_certificate_check parent element. Set to true to verify the LDAP server's certificate using the certificate of a Certificate Authority (CA). | |
server_certificate_ca | string |
Must be used if the enabled element is set to true. The certificate of the CA. |
Elements of schema | Type | Description | |
---|---|---|---|
selection | string |
Configures which LDAP schema to use: AD or POSIX. Possible values are:
| |
membership_check | Top level element | ||
enabled | boolean |
POSIX: Enables POSIX primary and supplementary group membership checking. AD: Enables Active Directory specific non-primary group membership checking. | |
nested_groups | boolean |
Must be used if the selection element is set to ad. Enable nested groups allows AD nested group support. | |
member_uid_attribute | string |
Must be used if the value of the selection element is set to posix. The POSIX group membership attribute name is the name of the attribute in a posixGroup group object, which lists the plain usernames that are members of the group. These groups are usually referred to as supplementary groups of the referred user. Can be null. | |
memberof_check | Top level element |
The Enable checking for group DNs in user objects setting allows checking a configurable attribute in the user object. This attribute contains a list of group DNs the user is additionally a member of. This user attribute is usually memberOf. | |
enabled | boolean |
To enable memberof_check, set it to true. | |
memberof_user_attribute | string |
Must be used if the memberof_check is set it to true. The name of the user attribute (for example, memberOf) that contains the group DNs. | |
username_attribute | string |
Must be used if the selection element is set to posix. Attribute name of the username (user ID). | |
user_dn_in_groups | Top level list |
Add object_class / attribute pairs. SPS will search for the user DN in the group's attribute defined here. If it finds the user DN there, SPS considers the user the member of that group. For example: "user_dn_in_groups": [ { "object_class": "groupOfNames", "attribute": "member" }, { "object_class": "groupOfUniqueNames", "attribute": "uniqueMember" } ] | |
object_class | string | Consider groups of this objectClass. | |
attribute | string | Name of the group attribute which contains the user DN. |
{ "name": "<name-of-ldap-policy>", "schema": { "selection": "posix", "username_attribute": "<uid>", "membership_check": { "enabled": true, "member_uid_attribute": "<memberUid>" }, "memberof_check": { "enabled": true, "memberof_user_attribute": "<memberOf>", "memberof_group_objectclass": "<groupOfNames>" }, "user_dn_in_groups": [ { "object_class": "<groupOfNames>", "attribute": "<member>" }, { "object_class": "<groupOfUniqueNames>", "attribute": "<uniqueMember>" } ] }, "servers": [ { "host": { "selection": "fqdn", "value": "<server-name>" }, "port": <server-port> } ], "user_base_dn": "<basedn>", "group_base_dn": "<basedn>", "bind_dn": "<binddn>", "bind_password": "<bind-password>", "encryption": { "client_authentication": { "enabled": false }, "selection": "ssl", "server_certificate_check": { "enabled": false } }, "publickey_attribute": "<sshPublicKey>", "generated_publickey_attribute": null }
{ "name": "<name-of-ldap-policy>", "schema": { "selection": "ad", "membership_check": { "enabled": true, "nested_groups": false }, "memberof_check": { "enabled": true, "memberof_user_attribute": "<memberOf>" }, "user_dn_in_groups": [ { "object_class": "<groupOfNames>", "attribute": "<member>" }, { "object_class": "<groupOfUniqueNames>", "attribute": "<uniqueMember>" } ] }, "servers": [ { "host": { "selection": "ip", "value": "<server-ip>" }, "port": <server-port> } ], "user_base_dn": "<basedn>", "group_base_dn": "<basedn>", "bind_dn": "<binddn>", "bind_password": "<key-of-password>", "encryption": { "client_authentication": { "enabled": true, "x509_identity": "<key-of-cert>" }, "selection": "starttls", "server_certificate_check": { "enabled": true, "server_certificate_ca": "<ca-cert>" } }, "publickey_attribute": "<sshPublicKey>", "generated_publickey_attribute": null }
CA certificates must not contain any metadata. SPS uses only the key part of the certificate.
To use a certificate with the SPS API, remove all metadata, and substitute line breaks with \n.
The following is an example certificate, as used on the SPS web interface:
-----BEGIN CERTIFICATE----- MIIDnDCCAoQCCQDc536Ob5tPQTANBgkqhkiG9w0BAQUFADCBjzELMAkGA1UEBhMC Q0ExEDAOBgNVBAgTB09udGFyaW8xEDAOBgNVBAcTB1Rvcm9udG8xEDAOBgNVBAoT B0JhbGFiaXQxFjAUBgNVBAsTDURvY3VtZW50YXRpb24xEDAOBgNVBAMTB2JhbGFi aXQxIDAeBgkqhkiG9w0BCQEWEWNhdGFpbEBiYWxhYml0Lmh1MB4XDTE2MDQyMjE2 MDAyNloXDTE3MDQyMjE2MDAyNlowgY8xCzAJBgNVBAYTAkNBMRAwDgYDVQQIEwdP bnRhcmlvMRAwDgYDVQQHEwdUb3JvbnRvMRAwDgYDVQQKEwdCYWxhYml0MRYwFAYD VQQLEw1Eb2N1bWVudGF0aW9uMRAwDgYDVQQDEwdiYWxhYml0MSAwHgYJKoZIhvcN AQkBFhFjYXRhaWxAYmFsYWJpdC5odTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBAOGa9I2jmVlVdVWEI/Wy7ahTeyaIjK52FQUXqxG8okOSD+nV74ZFUuiS 59X+2Ow1aDqVGrDMgPNhSVpYXUvDUAUOILJW4rAIoxDY6vDU9/4v9dDiQfEPlauw 0qNRjPS1MLzjSOQDSKqPkdivkS6HKZeX3+TFq3OxO+vIrF9zFfp9T+eDG2oSobPc 3mV2zkvtD61CXzbezAVdArDl6WnysRyzxyH8WEhFwZepWxFD9Y5N1dzKody7Hncs X5kVIv0+Z6bBHfg/7wHWysJdwNuLr0ByTOvPM6WdA83k3Fy2gYNk7Rc0BbRFbQTX hJVfUzSUWHVhFQtAb4diKU5voqepfNMCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEA R5DIwOHsEKoGkiI3cHC2VMnxP2rRhpTneh6El+DFnQPdjrXa+tnqV4TdnNaD+FvP AB1kqbmC4hJAsjMLU2b1ne6m+SLmzhRuMxcA6x+fnYvcQT57IbRdq2E/4oJGeyuy 0jQE+nmoVD3lDytIOxCfQvZhl1tcbBE5hp5USme4PmNhY6QfUlgjsFjPfoVG7XDB uNaUoWS6RvZPmL5IuvF9tqe96ES6DTjC8rBfQYvSoVNjjPnUMx0C8xstRSEG7oJc N5+4ImYnFNxSG20hZpFy0OFDf2g7Fx+W50/NtXamUF1Sf8WlPZc03oVl1/Fzo7mt qYyyD1ld89OUEYZ+aJQd/A== -----END CERTIFICATE-----
The same certificate, as accepted by the SPS API:
"certificate": "-----BEGIN CERTIFICATE-----\nMIIDnDCCAoQCCQDc536Ob5tPQTANBgkqhkiG9w0BAQUFADCBjzELMAkGA1UEBhMC\nQ0ExEDAOBgNVBAgTB09udGFyaW8xEDAOBgNVBAcTB1Rvcm9udG8xEDAOBgNVBAoT\nB0JhbGFiaXQxFjAUBgNVBAsTDURvY3VtZW50YXRpb24xEDAOBgNVBAMTB2JhbGFi\naXQxIDAeBgkqhkiG9w0BCQEWEWNhdGFpbEBiYWxhYml0Lmh1MB4XDTE2MDQyMjE2\nMDAyNloXDTE3MDQyMjE2MDAyNlowgY8xCzAJBgNVBAYTAkNBMRAwDgYDVQQIEwdP\nbnRhcmlvMRAwDgYDVQQHEwdUb3JvbnRvMRAwDgYDVQQKEwdCYWxhYml0MRYwFAYD\nVQQLEw1Eb2N1bWVudGF0aW9uMRAwDgYDVQQDEwdiYWxhYml0MSAwHgYJKoZIhvcN\nAQkBFhFjYXRhaWxAYmFsYWJpdC5odTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC\nAQoCggEBAOGa9I2jmVlVdVWEI/Wy7ahTeyaIjK52FQUXqxG8okOSD+nV74ZFUuiS\n59X+2Ow1aDqVGrDMgPNhSVpYXUvDUAUOILJW4rAIoxDY6vDU9/4v9dDiQfEPlauw\n0qNRjPS1MLzjSOQDSKqPkdivkS6HKZeX3+TFq3OxO+vIrF9zFfp9T+eDG2oSobPc\n3mV2zkvtD61CXzbezAVdArDl6WnysRyzxyH8WEhFwZepWxFD9Y5N1dzKody7Hncs\nX5kVIv0+Z6bBHfg/7wHWysJdwNuLr0ByTOvPM6WdA83k3Fy2gYNk7Rc0BbRFbQTX\nhJVfUzSUWHVhFQtAb4diKU5voqepfNMCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEA\nR5DIwOHsEKoGkiI3cHC2VMnxP2rRhpTneh6El+DFnQPdjrXa+tnqV4TdnNaD+FvP\nAB1kqbmC4hJAsjMLU2b1ne6m+SLmzhRuMxcA6x+fnYvcQT57IbRdq2E/4oJGeyuy\n0jQE+nmoVD3lDytIOxCfQvZhl1tcbBE5hp5USme4PmNhY6QfUlgjsFjPfoVG7XDB\nuNaUoWS6RvZPmL5IuvF9tqe96ES6DTjC8rBfQYvSoVNjjPnUMx0C8xstRSEG7oJc\nN5+4ImYnFNxSG20hZpFy0OFDf2g7Fx+W50/NtXamUF1Sf8WlPZc03oVl1/Fzo7mt\nqYyyD1ld89OUEYZ+aJQd/A==\n-----END CERTIFICATE-----\n"
To add an LDAP server, you have to:
For details, see Open a transaction.
POST the JSON object to the https://<IP-address-of-SPS>/api/configuration/policies/ldap_servers endpoint. You can find a detailed description of the available parameters listed in Element .
If the POST request is successful, the response includes the key of the new LDAP server. For example:
{ "key": "f9f9783c-1e28-4ce8-a650-fc4c7311ac52", "meta": { "href": "/api/configuration/policies/ldap_servers/f9f9783c-1e28-4ce8-a650-fc4c7311ac52", "parent": "/api/configuration/policies/ldap_servers", "transaction": "/api/transaction" } }
For details, see Commit a transaction.
To modify the configuration of an LDAP server, you have to:
For details, see Open a transaction.
PUT the modified JSON object to the https://<IP-address-of-SPS>/api/configuration/policies/ldap_servers/<key-of-the-object> endpoint. You can find a detailed description of the available parameters listed in Element .
For details, see Commit a transaction.
The following table lists the typical status and error codes for this request. For a complete list of error codes, see Application level error codes.
Code | Description | Notes |
---|---|---|
201 | Created | The new resource was successfully created. |
400 | InvalidQuery | The requested filter or its value is invalid. |
401 | Unauthenticated | The requested resource cannot be retrieved because the client is not authenticated and the resource requires authorization to access it. The details section contains the path that was attempted to be accessed, but could not be retrieved. |
401 | AuthenticationFailure | Authenticating the user with the given credentials has failed. |
404 | NotFound | The requested object does not exist. |
SPS can generate the server-side certificates on the fly. This technique is used for example in SSL-encrypted RDP sessions, RDP sessions that use Network Level Authentication (CredSSP), or SSH connections that use X.509-based authentication.
GET https://<IP-address-of-SPS>/api/configuration/policies/signing_cas
Cookie name | Description | Required | Values |
---|---|---|---|
session_id | Contains the authentication token of the user | Required |
The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API. Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format). |
The following command lists the configured signing Certificate Authorities (CAs).
curl --cookie cookies https://<IP-address-of-SPS>/api/configuration/policies/signing_cas
The following command retrieves the properties of a specific policy.
curl --cookie cookies https://<IP-address-of-SPS>/api/configuration/policies/signing_cas/<object-id>
The following is a sample response received when listing signing CAs.
For details of the meta object, see Message format.
{ "items": [ { "key": "991699365727ac4eb4606", "meta": { "href": "/api/configuration/policies/signing_cas/991699365727ac4eb4606" } } ], "meta": { "first": "/api/configuration/policies/audit_policies", "href": "/api/configuration/policies/signing_cas", "last": "/api/configuration/policies/usermapping_policies", "next": "/api/configuration/policies/ticketing_policies", "parent": "/api/configuration/policies", "previous": "/api/configuration/policies/ldap_servers", "transaction": "/api/transaction" } }
When retrieving the endpoint of a specific signing CA, the response is the following.
{ "body": { "ca": { "key": "55b2419c-f94f-4836-9c0b-bc3796b6f556", "meta": { "href": "/api/configuration/x509/55b2419c-f94f-4836-9c0b-bc3796b6f556" } }, "name": "API_CA" }, "key": "991699365727ac4eb4606", "meta": { "first": "/api/configuration/policies/signing_cas/991699365727ac4eb4606", "href": "/api/configuration/policies/signing_cas/991699365727ac4eb4606", "last": "/api/configuration/policies/signing_cas/991699365727ac4eb4606", "next": null, "parent": "/api/configuration/policies/signing_cas", "previous": null, "transaction": "/api/transaction" } }
Element | Type | Description | |
---|---|---|---|
key | string | Top level element, contains the ID of the signing CA. | |
body | Top level element (string) | Contains the properties of the signing CA. | |
ca | string |
References the identifier of the signing CA's X.509 certificate. You can configure certificates at the /api/configuration/x509/ endpoint. To modify or add an X.509 certificate, use the value of the returned key as the value of the x509_identity element, and remove any child elements (including the key). | |
name | string | The name of the signing CA. This name is also displayed on the SPS web interface. It cannot contain whitespace. |
To add a signing CA, you have to:
For details, see Open a transaction.
Have the value of the key element of a valid X.509 CA certificate stored on SPS.
Use the X.509 certificate's key as the value of the ca element for the signing CA. You can find a detailed description of the available parameters listed in Element .
POST the JSON object to the https://<IP-address-of-SPS>/api/configuration/policies/signing_cas endpoint. If the POST request is successful, the response includes the key of the new signing CA. For example:
{ "key": "325768b5-5b85-467d-8e30-e2b57d0869c8", "meta": { "href": "/api/configuration/policies/signing_cas/325768b5-5b85-467d-8e30-e2b57d0869c8", "parent": "/api/configuration/policies/signing_cas", "transaction": "/api/transaction" } }
For details, see Commit a transaction.
To modify a signing CA, you have to:
For details, see Open a transaction.
Use the X.509 certificate's key as the value of the ca element for the signing CA. You can find a detailed description of the available parameters listed in Element .
PUT the modified JSON object to the https://<IP-address-of-SPS>/api/configuration/policies/signing_cas/<key-of-the-object> endpoint.
For details, see Commit a transaction.
The following table lists the typical status and error codes for this request. For a complete list of error codes, see Application level error codes.
Code | Description | Notes |
---|---|---|
201 | Created | The new resource was successfully created. |
400 | InvalidQuery | The requested filter or its value is invalid. |
400 |
Bad Request "message": "Signing certificate is not CA; |
The referenced certificate is not a valid CA certificate. |
401 | Unauthenticated | The requested resource cannot be retrieved because the client is not authenticated and the resource requires authorization to access it. The details section contains the path that was attempted to be accessed, but could not be retrieved. |
401 | AuthenticationFailure | Authenticating the user with the given credentials has failed. |
404 | NotFound | The requested object does not exist. |
The time policy determines the timeframe when the users are permitted to access a particular channel. To list the available Time policies, use the following command.
curl --cookie cookies https://<IP-address-of-SPS>/api/configuration/policies/time_policies
The following sections detail the properties of Time policy objects.
GET https:<IP-address-of-SPS>/api/configuration/policies/time_policies/<object-id>
Cookie name | Description | Required | Values |
---|---|---|---|
session_id | Contains the authentication token of the user | Required |
The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API. Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format). |
The following command lists the properties of a specific Time policy object.
curl --cookie cookies -https:<IP-address-of-SPS>/api/configuration/policies/time_policies/<object-id>
The following is a sample response received, showing the properties of Content policy objects.
For details of the meta object, see Message format.
{ "body": { "Fri": [ [ "0:00", "23:59" ] ], "Mon": [ [ "0:00", "23:59" ] ], "Sat": [ [ "0:00", "23:59" ] ], "Sun": [ [ "0:00", "23:59" ] ], "Thu": [ [ "0:00", "23:59" ] ], "Tue": [ [ "0:00", "23:59" ] ], "Wed": [ [ "0:00", "23:59" ] ], "name": "7x24" }
Element | Type | Description |
---|---|---|
name | string | Top level element, the name of the object. This name is also displayed on the SPS web interface. It cannot contain whitespace. |
Fri | list |
A list of intervals for the day when the users are allowed to access the connection. Use the hh:mm format. If the users are not allowed to access the connection for this day, use an empty list. For example: "Sat": [], To allow access for the whole day, use 0:00 for the starting time, and 23:59for the end. For example: "Wed": [ [ "0:00", "23:59" ] |
Sat | list | |
Sun | list | |
Thu | list | |
Tue | list | |
Wed | list |
SPS can check the validity of certificates using the certificates and certificate-revocation lists of trusted certificate authorities (CAs) that issued the certificates.
GET https://<IP-address-of-SPS>/api/configuration/policies/trusted_ca_lists
Cookie name | Description | Required | Values |
---|---|---|---|
session_id | Contains the authentication token of the user | Required |
The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API. Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format). |
The following command lists the trusted CAs.
curl --cookie cookies https://<IP-address-of-SPS>/api/configuration/policies/trusted_ca_lists
The following command retrieves the properties of a specific CA.
curl --cookie cookies https://<IP-address-of-SPS>/api/configuration/policies/trusted_ca_lists/<policy-id>
The following is a sample response received when listing trusted CAs.
For details of the meta object, see Message format.
{ "items": [ { "key": "12269547065727ad6e79d9e", "meta": { "href": "/api/configuration/policies/trusted_ca_lists/12269547065727ad6e79d9e" } } ], "meta": { "first": "/api/configuration/policies/audit_policies", "href": "/api/configuration/policies/trusted_ca_lists", "last": "/api/configuration/policies/usermapping_policies", "next": "/api/configuration/policies/user_databases", "parent": "/api/configuration/policies", "previous": "/api/configuration/policies/time_policies", "transaction": "/api/transaction" } }
When retrieving the endpoint of a specific CA, the response is the following.
{ "body": { "authorities": [ { "certificate": "<cert>", "crl": "<url-of-revocation-list>" } ], "dn_check": { "altEmailAddress": "<altEmail>", "c": "<country>", "cn": "<commonName>", "emailAddress": "<email>", "l": "<localityName>", "o": "<orgName>", "ou": "<orgUnitName>", "st": "<stateOrProvince>" }, "dns_lookup": false, "name": "<ca-name>", "strict_hostcheck": true }, "key": "12269547065727ad6e79d9e", "meta": { "first": "/api/configuration/policies/trusted_ca_lists/12269547065727ad6e79d9e", "href": "/api/configuration/policies/trusted_ca_lists/12269547065727ad6e79d9e", "last": "/api/configuration/policies/trusted_ca_lists/12269547065727ad6e79d9e", "next": null, "parent": "/api/configuration/policies/trusted_ca_lists", "previous": null, "transaction": "/api/transaction" } }
SPS uses only the key part of the CA certificate.
To use a certificate with the SPS API, remove all data, and substitute line breaks with \n.
The following is an example certificate, as used on the SPS web interface:
-----BEGIN CERTIFICATE----- MIIDnDCCAoQCCQDc536Ob5tPQTANBgkqhkiG9w0BAQUFADCBjzELMAkGA1UEBhMC Q0ExEDAOBgNVBAgTB09udGFyaW8xEDAOBgNVBAcTB1Rvcm9udG8xEDAOBgNVBAoT B0JhbGFiaXQxFjAUBgNVBAsTDURvY3VtZW50YXRpb24xEDAOBgNVBAMTB2JhbGFi aXQxIDAeBgkqhkiG9w0BCQEWEWNhdGFpbEBiYWxhYml0Lmh1MB4XDTE2MDQyMjE2 MDAyNloXDTE3MDQyMjE2MDAyNlowgY8xCzAJBgNVBAYTAkNBMRAwDgYDVQQIEwdP bnRhcmlvMRAwDgYDVQQHEwdUb3JvbnRvMRAwDgYDVQQKEwdCYWxhYml0MRYwFAYD VQQLEw1Eb2N1bWVudGF0aW9uMRAwDgYDVQQDEwdiYWxhYml0MSAwHgYJKoZIhvcN AQkBFhFjYXRhaWxAYmFsYWJpdC5odTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBAOGa9I2jmVlVdVWEI/Wy7ahTeyaIjK52FQUXqxG8okOSD+nV74ZFUuiS 59X+2Ow1aDqVGrDMgPNhSVpYXUvDUAUOILJW4rAIoxDY6vDU9/4v9dDiQfEPlauw 0qNRjPS1MLzjSOQDSKqPkdivkS6HKZeX3+TFq3OxO+vIrF9zFfp9T+eDG2oSobPc 3mV2zkvtD61CXzbezAVdArDl6WnysRyzxyH8WEhFwZepWxFD9Y5N1dzKody7Hncs X5kVIv0+Z6bBHfg/7wHWysJdwNuLr0ByTOvPM6WdA83k3Fy2gYNk7Rc0BbRFbQTX hJVfUzSUWHVhFQtAb4diKU5voqepfNMCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEA R5DIwOHsEKoGkiI3cHC2VMnxP2rRhpTneh6El+DFnQPdjrXa+tnqV4TdnNaD+FvP AB1kqbmC4hJAsjMLU2b1ne6m+SLmzhRuMxcA6x+fnYvcQT57IbRdq2E/4oJGeyuy 0jQE+nmoVD3lDytIOxCfQvZhl1tcbBE5hp5USme4PmNhY6QfUlgjsFjPfoVG7XDB uNaUoWS6RvZPmL5IuvF9tqe96ES6DTjC8rBfQYvSoVNjjPnUMx0C8xstRSEG7oJc N5+4ImYnFNxSG20hZpFy0OFDf2g7Fx+W50/NtXamUF1Sf8WlPZc03oVl1/Fzo7mt qYyyD1ld89OUEYZ+aJQd/A== -----END CERTIFICATE-----
The same certificate, as accepted by the SPS API:
"certificate": "-----BEGIN CERTIFICATE-----\nMIIDnDCCAoQCCQDc536Ob5tPQTANBgkqhkiG9w0BAQUFADCBjzELMAkGA1UEBhMC\nQ0ExEDAOBgNVBAgTB09udGFyaW8xEDAOBgNVBAcTB1Rvcm9udG8xEDAOBgNVBAoT\nB0JhbGFiaXQxFjAUBgNVBAsTDURvY3VtZW50YXRpb24xEDAOBgNVBAMTB2JhbGFi\naXQxIDAeBgkqhkiG9w0BCQEWEWNhdGFpbEBiYWxhYml0Lmh1MB4XDTE2MDQyMjE2\nMDAyNloXDTE3MDQyMjE2MDAyNlowgY8xCzAJBgNVBAYTAkNBMRAwDgYDVQQIEwdP\nbnRhcmlvMRAwDgYDVQQHEwdUb3JvbnRvMRAwDgYDVQQKEwdCYWxhYml0MRYwFAYD\nVQQLEw1Eb2N1bWVudGF0aW9uMRAwDgYDVQQDEwdiYWxhYml0MSAwHgYJKoZIhvcN\nAQkBFhFjYXRhaWxAYmFsYWJpdC5odTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC\nAQoCggEBAOGa9I2jmVlVdVWEI/Wy7ahTeyaIjK52FQUXqxG8okOSD+nV74ZFUuiS\n59X+2Ow1aDqVGrDMgPNhSVpYXUvDUAUOILJW4rAIoxDY6vDU9/4v9dDiQfEPlauw\n0qNRjPS1MLzjSOQDSKqPkdivkS6HKZeX3+TFq3OxO+vIrF9zFfp9T+eDG2oSobPc\n3mV2zkvtD61CXzbezAVdArDl6WnysRyzxyH8WEhFwZepWxFD9Y5N1dzKody7Hncs\nX5kVIv0+Z6bBHfg/7wHWysJdwNuLr0ByTOvPM6WdA83k3Fy2gYNk7Rc0BbRFbQTX\nhJVfUzSUWHVhFQtAb4diKU5voqepfNMCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEA\nR5DIwOHsEKoGkiI3cHC2VMnxP2rRhpTneh6El+DFnQPdjrXa+tnqV4TdnNaD+FvP\nAB1kqbmC4hJAsjMLU2b1ne6m+SLmzhRuMxcA6x+fnYvcQT57IbRdq2E/4oJGeyuy\n0jQE+nmoVD3lDytIOxCfQvZhl1tcbBE5hp5USme4PmNhY6QfUlgjsFjPfoVG7XDB\nuNaUoWS6RvZPmL5IuvF9tqe96ES6DTjC8rBfQYvSoVNjjPnUMx0C8xstRSEG7oJc\nN5+4ImYnFNxSG20hZpFy0OFDf2g7Fx+W50/NtXamUF1Sf8WlPZc03oVl1/Fzo7mt\nqYyyD1ld89OUEYZ+aJQd/A==\n-----END CERTIFICATE-----\n"
To add a trusted CA, you have to:
For details, see Open a transaction.
POST the JSON object to the https://<IP-address-of-SPS>/api/configuration/policies/trusted_ca_lists endpoint. You can find a detailed description of the available parameters listed in Element .
If the POST request is successful, the response includes the key of the new trusted CA. For example:
{ "key": "becc17b1-e876-4443-b22e-a3baf7825e55", "meta": { "href": "/api/configuration/policies/trusted_ca_lists/becc17b1-e876-4443-b22e-a3baf7825e55", "parent": "/api/configuration/policies/trusted_ca_lists", "transaction": "/api/transaction" } }
For details, see Commit a transaction.
To modify a trusted CA, you have to:
For details, see Open a transaction.
PUT the modified JSON object to the https://<IP-address-of-SPS>/api/configuration/policies/trusted_ca_lists/<key-of-the-object> endpoint. You can find a detailed description of the available parameters listed in Element .
For details, see Commit a transaction.
The following table lists the typical status and error codes for this request. For a complete list of error codes, see Application level error codes.
Code | Description | Notes |
---|---|---|
201 | Created | The new resource was successfully created. |
400 | InvalidQuery | The requested filter or its value is invalid. |
401 | Unauthenticated | The requested resource cannot be retrieved because the client is not authenticated and the resource requires authorization to access it. The details section contains the path that was attempted to be accessed, but could not be retrieved. |
401 | AuthenticationFailure | Authenticating the user with the given credentials has failed. |
404 | NotFound | The requested object does not exist. |
© 2024 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center