11.10.3. Configure the Vault Expression Constraint
By default, reading and writing vault expressions are sensitive operations. Configuring the Vault Expression Constraint allows you to set either or both of those operations to being nonsensitive. Changing this constraint allows a greater number of roles to read and write vault expressions.
The vault expression constraint is found in the management model at
/core-service=management/access=authorization/constraint=vault-expression
.
To configure the vault expression constraint, use the
write-attribute
operation to set the attributes of configured-requires-write
and configured-requires-read
to true
or false
. By default these are not set and the values of default-requires-read
and default-requires-write
are used. The default values cannot be changed.
Example 11.7. Making writing to vault expressions a nonsensitive operation
[domain@localhost:9999 /] cd /core-service=management/access=authorization/constraint=vault-expression [domain@localhost:9999 constraint=vault-expression] :write-attribute(name=configured-requires-write, value=false) { "outcome" => "success", "result" => undefined, "server-groups" => {"main-server-group" => {"host" => {"master" => { "server-one" => {"response" => {"outcome" => "success"}}, "server-two" => {"response" => {"outcome" => "success"}} }}}} } [domain@localhost:9999 constraint=vault-expression] :read-resource { "outcome" => "success", "result" => { "configured-requires-read" => undefined, "configured-requires-write" => false, "default-requires-read" => true, "default-requires-write" => true } } [domain@localhost:9999 constraint=vault-expression]
What roles will be able to read and write to vault expressions depending on this configuration is summarized in Table 11.3, “Vault Expression Constraint Configuration outcomes”.
Table 11.3. Vault Expression Constraint Configuration outcomes
Value | requires-read | requires-write |
---|---|---|
true
|
Read operation is sensitive.
Only Auditor, Administrator, and SuperUser can read.
|
Write operation is sensitive.
Only Administrator and SuperUser can write.
|
false
|
Read operation is not sensitive.
All management users can read.
|
Write operation is not sensitive.
Monitor, Administrator and SuperUser can write. Deployers can also write if the vault expression is in an Application Resource.
|