ActivID CMS Configuration

The ActivID CMS REST API requires an operator with the relevant rights to authenticate using their certificate. A part of the REST API is also accessible for end-users who have been authenticated using a certificate or a password. The following topics provide details on configuring operators based on the version of the REST API you are using.

Configuring Operator Permissions for the REST API

By default, the REST API is accessible for a limited set of predefined roles. You can configure other roles to have access to this API and define their permissions.

Each entry point of the API is protected by a dedicated permission, with the permissions grouped in scopes, which are then assigned to different roles. Some of the entry points (like POST /ContentRequest) have different permissions depending on the type of the request.

Scope of Permissions

There are currently four scopes available: Device Management, Help Desk, Configuration Operator and Device.

Device Management grants all permissions needed to issue a device (user search, get user details, add a device, get device details, and recycle a device).

Help Desk grants all permissions needed to manage a user's devices (user search, get user details, get device details, terminate a device, and recycle a device).

Configuration Operator grants all permissions needed to manage operators.

Device grants all permissions needed to manage an end user's own devices.

Permission Mapping

Default Configuration

Operators who have the predefined Issuance role inherit the Device Management scope. An operator with this role can do anything except terminate a device.

Operators who have the predefined Help Desk role inherit the Help Desk scope. An operator with this role can do anything except issue a device.

Operators who have the predefined Administration role inherit the Device Management, Help Desk and Configuration Operator scopes. An operator with this role can do everything.

End-users who have the predefined Cardholder role inherit the Device scope. An end-user with this scope can manage their own devices.

Customizing Scopes for Roles

The mapping between roles and scopes is defined in a configuration file: %PROGRAMDATA%\HID Global\Credential Management System\Shared Files\scopeAssignment.properties. You can modify this file in order to change existing roles or add new ones.

Each role in the scopeAssignment.properties file is defined using the following attributes:

• roleWithScope.name.{id}: matches the name of an existing role

• roleWithScope.scopes.{id}: configures the list of predefined scopes assigned to the role

For example, the Help Desk role is included by default as shown here:

roleWithScope.name.2=Help Desk
roleWithScope.scopes.2=Scope.helpdesk

You can create roles in the ActivID CMS Operator Portal and assign them to an operator, but you must add these roles to the scopeAssignment.properties file (using the same format shown in the example above) and assign one or more of the predefined scopes to each role.

For example, if you create a role "Full Help Desk" in ActivID CMS and assign it to an operator, you can add this role to the scopeAssignment.properties file as shown below, and assign both predefined scopes to it:

roleWithScope.name.5=Full Help Desk
roleWithScope.scopes.5=Scope.helpdesk,Scope.device_management

It is also possible to modify the default roles present by adding or removing one or more of the predefined scopes, but it is recommended to leave the default configuration.

Configuring Operator Permissions for the Legacy REST API (v1)

To verify that an operator meets the requirements for using the REST API, you must:

• Make sure that adequate rights are associated with the operator by checking the information concerning the operator’s role:

  

  Note: “Logs out Operator” is not used by the REST API. Other permissions must be given as needed, depending on which operations are expected to be performed.

• Make sure there is a certificate associated with the operator by viewing the operator’s information:

  

  Note: If there is no certificate associated with the operator, the View Certificate button displays “No Certificate registered” as shown below.