6.10.3. Configure the Vault Expression Constraint

By default, reading and writing vault expressions are sensitive operations. Configuring the Vault Expression Constraint allows you to set either or both of those operations to being nonsensitive. Changing this constraint allows a greater number of roles to read and write vault expressions.

The vault expression constraint is found in the management model at /core-service=management/access=authorization/constraint=vault-expression.

To configure the vault expression constraint, use the write-attribute operation to set the attributes of configured-requires-write and configured-requires-read to true or false. By default these are not set and the values of default-requires-read and default-requires-write are used. The default values cannot be changed.

Example 6.7. Making writing to vault expressions a nonsensitive operation

[domain@localhost:9999 /] cd /core-service=management/access=authorization/constraint=vault-expression
[domain@localhost:9999 constraint=vault-expression] :write-attribute(name=configured-requires-write, value=false)
{
    "outcome" => "success",
    "result" => undefined,
    "server-groups" => {"main-server-group" => {"host" => {"master" => {
        "server-one" => {"response" => {"outcome" => "success"}},
        "server-two" => {"response" => {"outcome" => "success"}}
    }}}}
}
[domain@localhost:9999 constraint=vault-expression] :read-resource
{
    "outcome" => "success",
    "result" => {
        "configured-requires-read" => undefined,
        "configured-requires-write" => false,
        "default-requires-read" => true,
        "default-requires-write" => true
    }
}
[domain@localhost:9999 constraint=vault-expression]

What roles will be able to read and write to vault expressions depending on this configuration is summarized in Table 6.3, “Vault Expression Constraint Configuration outcomes”.

Expand

Table 6.3. Vault Expression Constraint Configuration outcomes
Value	`requires-read`	`requires-write`
`true`	Read operation is sensitive. Only `Auditor`, `Administrator`, and `SuperUser` can read.	Write operation is sensitive. Only `Administrator`, and `SuperUser` can write.
`false`	Read operation is not sensitive. All management users can read.	Write operation is not sensitive. `Monitor`, `Administrator`, and `SuperUser` can write. `Deployers` can also write if the vault expression is in an Application Resource.

Report a bug

Ce contenu n'est pas disponible dans la langue sélectionnée.

6.10.3. Configure the Vault Expression Constraint

Apprendre

Essayez, achetez et vendez

Communautés

À propos de Red Hat

Rendre l’open source plus inclusif

À propos de la documentation Red Hat

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links