3.9 Working With User's Templates

The user's templates contain authentication information associated with users. Each template is linked to a user and to an authentication method. When users try to logon using a specific authentication method, the server finds the associated user template and provide authentication. Users cannot use authentication methods without associated user templates. The Enrollment process creates user templates, check the Working With Enrollment chapter for more information. Each authentication method stores different information in the templates. The Authentication method can update a user’s template in the authentication process, also users or administrator can change templates manually, a user can edit only his own templates.

The API provide resources for working with user’s templates: creating, updating, reading and deleting.

This resource provide reading user templates. Resource has URI:

/users/{user_id}/templates?login_session_id={login_session_id}

Resource provided by HTTP GET.

Resource return list of user templates. List present as array of JSON object.

Example

On the following example a user with identifier “958ca11a7fa511e4b6ab00155d62a8b3” and session identifier “TBsifFiE4UJCyMnIyTkmY21kFctSxdwe” gets his own list of two user templates:

HTTP GET
https://authserver.example.com/api/v1/users/958ca11a7fa511e4b6ab00155d62a8b3/templates?login_session_id=TBsifFiE4UJCyMnIyTkmY21kFctSxdwe
Response
{
"templates":[
{
"id":"958ca11b7fa511e4a32200155d62a8b3",
"method_id":"LDAP_PASSWORD:1",
"is_enrolled":true,
"method_title":"LDAP password",
"comment": "LDAP password template"
},
{
"id":"959165a47fa511e4bd1500155d62a8b3",
"method_id":"HOTP:1",
"is_enrolled":true,
"method_title":"HOTP",
"comment": "OATH HTOP template"}
]
}

After a successful enroll process, you can assign enrolled data to the user template. This is provided by resource with URI:

/users/{user_id}/templates

Resource provided by HTTP POST and has this parameter:

An administrator can assign enrolled data and create user templates for any user.

Resource accept JSON-object with these parameters:

Resource return JSON-object with identifier of new user template.

Example

On the following example, a user with identifier “e08c6b48810611e4b79300155d62a8b3” and login session identifier “33ebFAQBW1e1kTkKVzIRz5rf5dhv4OoE” creates a user template with enroll process identifier “nrXwfyy0l4QcXxYZNebzjs33rqS9UkG5”.

HTTP POST
https://authserver.example.com/api/v1/users/e08c6b48810611e4b79300155d62a8b3/templates
Request
{
"enroll_process_id":"nrXwfyy0l4QcXxYZNebzjs33rqS9UkG5",
"comment":"Authentication template comment",
"login_session_id":"33ebFAQBW1e1kTkKVzIRz5rf5dhv4OoE"
}
Response
{
"auth_t_id":"9df84602842f11e4817e00155d62a8b3"
}

You can assign created user template to another user. This way a user can impersonate another user using his own authentication method. An example would be a user having 2 accounts, an admin account and a normal user account. He will only enroll authentication methods for his normal user account but will link his methods to his admin account. Now he can logon using the username of the admin account and the method of the normal account and this will be logged in the audit log.

Another use case would be group accounts where multiple users are linked too.

To link a template to another user use the resource with URI:

/users/{user_id}/templates

Resource provided by HTTP POST and has this parameter:

Resource accept JSON-object with these parameters:

Resource return JSON-object with identifier of user’s template.

This resource just links the user template to another user, new user can’t modify template, user can only read assigned template.

Example

On the following example, user with login session “sC7PfOjvHt7OMgIccEHjK7b9XGlGNSoj” assign template with identifier “ba3cf01e845311e4841900155d62a8b3” to user with identifier “76cc2a62845411e4bd6c00155d62a8b3”.

HTTP POST
https://authserver.example.com/api/v1/users/76cc2a62845411e4bd6c00155d62a8b3/templates
Request
{
"auth_t_id":"ba3cf01e845311e4841900155d62a8b3",
"login_session_id":"sC7PfOjvHt7OMgIccEHjK7b9XGlGNSoj"}
Response
{ "auth_t_id":"ba3cf01e845311e4841900155d62a8b3" }

You can update existing user template, this is provided by resource with URI:

/users/{user_id}/templates/{auth_template_id}

Resource provided by HTTP PUT and has this parameter:

Administrator can update user template for all users, other users can update own templates.

Resource accept JSON-object with these parameters:

You can use one or both parameters for method, if you use enroll process identifier for method you will change user’s template authentication data. When an template is updated all linked users will need to use the updated template

Resource does not return data, if operation was success method returns HTTP 200 status.

Example

On the following example, user with identifier “e08c6b48810611e4b79300155d62a8b3” update user template with identifier “ba3cf01e845311e4841900155d62a8b3” with new enrolled data form enroll process with identifier “l4rh0HvzJxNFBaO9d7PC4Uyq9YRc8EMY”.

HTTP PUT
https://authserver.example.com/api/v1/users/e08c6b48810611e4b79300155d62a8b3/templates/ba3cf01e845311e4841900155d62a8b3
Request
{
"enroll_process_id":"l4rh0HvzJxNFBaO9d7PC4Uyq9YRc8EMY",
"comment":"Updated comment",
"login_session_id":"86oe9ebDvJ08UJvlG0O14ZARm3wIYNTB"
}
Response
HTTP 200

This resource provide deleting of user templates. Resource has URI

/users/{user_id}/templates/{template_id}?login_session_id={login_session_id}

Resource providing by HTTP DELETE and has this parameters:

Administrator can delete any user templates, other users can delete only their own templates.

This method doesn’t return any data, if deleting was successful method returns HTTP 200 status, if an error occurs, method returns error description.

Example

On the following example, user with the user identifier “e08c6b48810611e4b79300155d62a8b3” and login session identifier “GsnGHDvqOiEdPR3KUhKqy2kZq7l4RCcC” tries to delete his own template with identifier “9df84602842f11e4817e00155d62a8b3”.

HTTP DELETE
https://authserver.example.com/api/v1/users/e08c6b48810611e4b79300155d62a8b3/templates/9df84602842f11e4817e00155d62a8b3?login_session_id=GsnGHDvqOiEdPR3KUhKqy2kZq7l4RCcC
Response
HTTP 200