entity-alias
NOTE: Be careful in granting permissions to non-readonly identity endpoints. If a user can modify an entity, they can grant it additional privileges through policies. If a user can modify an alias they can login with, they can bind it to an entity with higher privileges.
Create an Entity Alias
IMPORTANT NOTE: Prior to creating any alias it is important to consider the cardinality of the alias' name, since there are potential security issues to be aware of. The main one revolves around alias reuse. It is possible for multiple authenticated entities to be bound to the same alias, and therefore gain access to all of its privileges. It is recommended, whenever possible, to create a unique alias for each entity. This is especially true in the case of machine generated entities.
This endpoint creates a new alias for an entity.
Method | Path |
---|---|
POST | /identity/entity-alias |
Parameters
name
(string: <required>)
- Name of the alias. Name should be the identifier of the client in the authentication source. For example, if the alias belongs to userpass backend, the name should be a valid username within userpass auth method. If the alias belongs to GitHub, it should be the GitHub username. If the alias belongs to an approle auth method, the name should be a valid RoleID.id
(string: <optional>)
- ID of the entity alias. If set, updates the corresponding entity alias.canonical_id
(string: <required>)
- Entity ID to which this alias belongs to.mount_accessor
(string: <required>)
- Accessor of the mount to which the alias should belong to.custom_metadata
(map<string|string>: <optional>)
- A map of arbitrary string to string valued user-provided metadata meant to describe the alias.
Sample Payload
Sample Request
Sample Response
Read Entity Alias by ID
This endpoint queries the entity alias by its identifier.
Method | Path |
---|---|
GET | /identity/entity-alias/id/:id |
Parameters
id
(string: <required>)
– Identifier of entity alias.
Sample Request
Sample Response
Update Entity Alias by ID
This endpoint is used to update an existing entity alias.
Method | Path |
---|---|
POST | /identity/entity-alias/id/:id |
Parameters
id
(string: <required>)
– Identifier of the entity alias.name
(string: <required>)
- Name of the alias. Name should be the identifier of the client in the authentication source. For example, if the alias belongs to userpass backend, the name should be a valid username within userpass backend. If alias belongs to GitHub, it should be the GitHub username.canonical_id
(string: <required>)
- Entity ID to which this alias belongs to.mount_accessor
(string: <required>)
- Accessor of the mount to which the alias should belong to.custom_metadata
(map<string|string>: <optional>)
- A map of arbitrary string to string valued user-provided metadata meant to describe the alias.
Sample Payload
Sample Request
Sample Response
Delete Entity Alias by ID
This endpoint deletes an alias from its corresponding entity.
Method | Path |
---|---|
DELETE | /identity/entity-alias/id/:id |
Parameters
id
(string: <required>)
– Identifier of the entity alias.
Sample Request
List Entity Aliases by ID
This endpoint returns a list of available entity aliases by their identifiers.
Method | Path |
---|---|
LIST | /identity/entity-alias/id |
GET | /identity/entity-alias/id?list=true |
Sample Request
Sample Response