User and Identity Setup

Warning: Use the -k flag only in development or trusted internal environments. Do not use it in production, where valid certificates must be configured.

Role Update and User Creation

After deployment, update the default syntheticdata_administrator role to include can_create_token permission. Then create a user with this role.

1. Update syntheticdata_administrator role permission

1. Obtain the gateway URL using the following command:

export GATEWAY_URL="https://$(kubectl get configmap/nfa-config -n default -o jsonpath='{.data.FQDN}')"

2. Obtain the Authentication token using the following command:

   TOKEN=$(curl -k --silent --show-error --dump-header - --output /dev/null "${GATEWAY_URL}/pty/v1/auth/login/token" \
     -X POST \
     -H 'Content-Type: application/x-www-form-urlencoded' \
     -d 'loginname=admin' \
     -d 'password=<PASSWORD>' | grep -i 'pty_access_jwt_token:' | sed 's/pty_access_jwt_token: //' | tr -d '\r')
   

   For more information, refer to Authentication Token.

3. Update the syntheticdata_administrator role with the following API call:

curl -sk -X PUT \
  "${GATEWAY_URL}/pty/v1/auth/roles" \
  -H 'accept: application/json' \
  -H "Authorization: Bearer ${TOKEN}" \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "syntheticdata_administrator",
    "description": "Administrator role",
    "permissions": [
      "can_create_token",
      "syntheticdata_operations_admin"
    ]
  }'

2. Create a user with the syntheticdata_administrator role attached

Use the following request payload when creating the user:

{
  "username": "syntheticdata_admin",
  "email": "synthadmin@example.com",
  "firstName": "Synth",
  "lastName": "<USERNAME>",
  "password": "<PASSWORD>",
  "roles": [
    "syntheticdata_administrator"
  ]
}

Note: Replace default credentials and URLs for production environments. For example, for <USERNAME>, enter User and for <PASSWORD>, enter StrongPassword123!.

Create the user with the following API call:

curl -sk -X POST \
  "${GATEWAY_URL}/pty/v1/auth/users" \
  -H 'accept: application/json' \
  -H "Authorization: Bearer ${TOKEN}" \
  -H 'Content-Type: application/json' \
  -d '{
    "username": "syntheticdata_admin",
    "email": "synthadmin@example.com",
    "firstName": "Synth",
    "lastName": "<USERNAME>",
    "password": "<PASSWORD>",
    "roles": [
      "syntheticdata_administrator"
    ]
  }'