User and Identity Setup

Warning: Use the -k flag only in development or trusted internal environments. Do not use it in production, where valid certificates must be configured.

Role Update and User Creation

After deployment, update the default anonymization_administrator role to include the can_create_token permission and then create a user with this role.

1. Update anonymization_administrator role permission

1. Obtain the gateway URL using the following command:

   export GATEWAY_URL="https://$(kubectl get configmap/nfa-config -n default -o jsonpath='{.data.FQDN}')"
   

2. Obtain the Authentication token using the following command:

   TOKEN=$(curl -k --silent --show-error --dump-header - --output /dev/null "${GATEWAY_URL}/pty/v1/auth/login/token" \
     -X POST \
     -H 'Content-Type: application/x-www-form-urlencoded' \
     -d 'loginname=admin' \
     -d 'password=<password>' | grep -i 'pty_access_jwt_token:' | sed 's/pty_access_jwt_token: //' | tr -d '\r')
   

   For more information, refer to Authentication Token.

3. Update the anonymization_administrator role with the following API call:

   curl -sk -X PUT \
     "${GATEWAY_URL}/pty/v1/auth/roles" \
     -H 'accept: application/json' \
     -H "Authorization: Bearer ${TOKEN}" \
     -H 'Content-Type: application/json' \
     -d '{
       "name": "anonymization_administrator",
       "description": "Administrator role",
       "permissions": [
         "can_create_token",
         "anonymization_operations_admin"
       ]
     }'
   

2. Create a user with the anonymization_administrator role

Use the following request payload when creating the user:

{
  "username": "anonymization_admin",
  "email": "anonadmin@example.com",
  "firstName": "Anon",
  "lastName": "<USERNAME>",
  "password": "<PASSWORD>",
  "roles": [
    "anonymization_administrator"
  ]
}

Create the user with the following API call:

curl -sk -X POST \
  "${GATEWAY_URL}/pty/v1/auth/users" \
  -H 'accept: application/json' \
  -H "Authorization: Bearer ${TOKEN}" \
  -H 'Content-Type: application/json' \
  -d '{
    "username": "anonymization_admin",
    "email": "anonadmin@example.com",
    "firstName": "Anon",
    "lastName": "<USERNAME>",
    "password": "<PASSWORD>",
    "roles": [
      "anonymization_administrator"
    ]
  }'

Note: In production environments, replace the default credentials and URLs. For example, for <USERNAME>, enter User and for <PASSWORD>, enter StrongPassword123!.