Subscribe to Help Center RSS FeedThis article discusses how to use the 探花大神 API to control User Elevated Permissions at the User Group level and/or at the User Group 鈫� Device Group Bind level. The goal is to allow administrators to have better high-level control over the permissions that their users have across devices while minimizing the maintenance overhead that can come with managing User Device permissions on an individual basis.
Elevated Permissions on User Groups
Prerequisites:
- User Group聽ID (60f84e262921680001dbe9ba聽in the examples)
- 探花大神 API key (redacted in the examples)
Getting Existing User Group Data
Note that the 探花大神 API currently only supports聽POST听补苍诲听PUT听蹿辞谤听User Groups.听PUT聽saves the provided state to the object at the given ID. This means that to modify the attributes field, all聽User Group聽fields must be included in the request as the object is intended to be saved. Retrieve all other聽User Group聽fields and attribute properties and include them in the request if the goal is only to modify the聽sudo听辫谤辞辫别谤迟颈别蝉.
cURL to get data from an existing group:
curl https://console.jumpcloud.com/api/v2/usergroups/60f84e262921680001dbe9ba \
聽聽-H 'Accept: application/json' \
聽聽-H 'Content-Type: application/json' \
聽聽-H "x-api-key: $JC_API_KEY"
Returning something similar to:
{
听"补迟迟谤颈产耻迟别蝉":调
聽 "ldapGroups":[
聽 聽 聽 {
聽 聽 聽 聽 聽"name":"MYGROUP"
聽 聽 聽 }
聽 聽]
听皑,听
听"颈诲":"60蹿84别262921680001诲产别9产补",
聽"name":"My User Group",
听"迟测辫别":"耻蝉别谤冲驳谤辞耻辫",
听"别尘补颈濒":"[email protected]",
聽"description":"A user group for demonstration",
听"尘别尘产别谤厂耻驳驳别蝉迟颈辞苍蝉狈辞迟颈蹿测":蹿补濒蝉别,
听"尘别尘产别谤蚕耻别谤测":调
聽 聽"queryType":"FilterQuery",
聽 聽"filters":[
聽 聽 聽 {
聽 聽 聽 聽 聽 "field":"company",
聽 聽 聽 聽 聽 "operator":"eq",
聽 聽 聽 聽 聽 "value":"MyCompany"
聽 聽 聽 聽}
聽 聽 聽]
聽 聽}
}
Modifying User Group Elevated Permissions
To elevate permissions for users in this User Group, add the聽sudo聽property to the聽attributes聽as below:
"attributes":{
聽聽 "ldapGroups":[
聽聽聽聽聽 {
聽聽聽聽聽聽聽聽 "name":"MYGROUP"
聽聽聽聽聽 }
聽聽 ]"sudo":{
聽聽聽聽聽 "enabled":true,
聽聽聽聽聽 "withoutPassword":true
聽聽 }
}
Example cURL to elevate permissions for all聽User聽members of聽User Group聽to passwordless sudo with the above聽attributes聽included in the request:
curl -X PUT https://console.jumpcloud.com/api/v2/usergroups/60f84e262921680001dbe9ba \
聽聽-H 'Accept: application/json' \
聽聽-H 'Content-Type: application/json' \
聽聽-H "x-api-key: $JC_API_KEY" \
聽聽-d '{
聽聽听"补迟迟谤颈产耻迟别蝉":调
听听听听听听"濒诲补辫骋谤辞耻辫蝉":摆
听听听听听听听听听调
听听听听听听听听听听听听"苍补尘别":"惭驰骋搁翱鲍笔"
听听听听听听听听听皑
听听听听听听闭,
听听听听听听"蝉耻诲辞":调
听听听听听听听听听"别苍补产濒别诲":迟谤耻别,
听听听听听听听听听"飞颈迟丑辞耻迟笔补蝉蝉飞辞谤诲":迟谤耻别
听听听听听听皑
听听听皑,
聽聽听"颈诲":"60蹿84别262921680001诲产别9产补",
聽聽聽"name":"My User Group",
聽聽听"迟测辫别":"耻蝉别谤冲驳谤辞耻辫",
聽聽听"别尘补颈濒":"[email protected]",
聽聽聽"description":"A user group for demonstration",
聽聽听"尘别尘产别谤厂耻驳驳别蝉迟颈辞苍蝉狈辞迟颈蹿测":蹿补濒蝉别,
聽聽听"尘别尘产别谤蚕耻别谤测":调
听听听听听听"辩耻别谤测罢测辫别":"贵颈濒迟别谤蚕耻别谤测",
听听听听听听"蹿颈濒迟别谤蝉":摆
听听听听听听听听听调
听听听听听听听听听听听听"蹿颈别濒诲":"肠辞尘辫补苍测",
听听听听听听听听听听听听"辞辫别谤补迟辞谤":"别辩",
听听听听听听听听听听听听"惫补濒耻别":"惭测颁辞尘辫补苍测"
听听听听听听听听听皑
听听听听听听闭
听听听皑
}'
Removing User Group Elevated Permissions
Removing elevated permissions consists of removing the聽sudo聽property from the聽User Group'蝉听attributes.
Example cURL to remove elevated permissions with聽sudo听谤别尘辞惫别诲:
curl -X PUT https://console.jumpcloud.com/api/v2/usergroups/60f84e262921680001dbe9ba \
聽聽-H 'Accept: application/json' \
聽聽-H 'Content-Type: application/json' \
聽聽-H "x-api-key: $JC_API_KEY" \
聽聽-d '{
聽聽听"补迟迟谤颈产耻迟别蝉":调
听听听听听听"濒诲补辫骋谤辞耻辫蝉":摆
听听听听听听听听听调
听听听听听听听听听听听听"苍补尘别":"惭驰骋搁翱鲍笔"
听听听听听听听听听皑
听听听听听听闭
听听听皑,
聽聽听"颈诲":"60蹿84别262921680001诲产别9产补",
聽聽聽"name":"My User Group",
聽聽听"迟测辫别":"耻蝉别谤冲驳谤辞耻辫",
聽聽听"别尘补颈濒":"[email protected]",
聽聽聽"description":"A user group for demonstration",
聽聽听"尘别尘产别谤厂耻驳驳别蝉迟颈辞苍蝉狈辞迟颈蹿测":蹿补濒蝉别,
聽聽听"尘别尘产别谤蚕耻别谤测":调
听听听听听听"辩耻别谤测罢测辫别":"贵颈濒迟别谤蚕耻别谤测",
听听听听听听"蹿颈濒迟别谤蝉":摆
听听听听听听听听听调
听听听听听听听听听听听听"蹿颈别濒诲":"肠辞尘辫补苍测",
听听听听听听听听听听听听"辞辫别谤补迟辞谤":"别辩",
听听听听听听听听听听听听"惫补濒耻别":"惭测颁辞尘辫补苍测"
听听听听听听听听听皑
听听听听听听闭
听听听皑
}'
Again, the entirety of the group's properties is included except for the modified聽attributes聽which no longer include the聽sudo听辫谤辞辫别谤迟测:
"attributes":{
听听听听听听"濒诲补辫骋谤辞耻辫蝉":摆
听听听听听听听听听调
听听听听听听听听听听听听"苍补尘别":"惭驰骋搁翱鲍笔"
听听听听听听听听听皑
听听听听听听闭
听听听皑
Verifying User Group Elevated Permissions
POSTing andPUTing groups returns the saved object, allowing for inspection of the response for confirmation.
Elevated Permissions User Group 鈫� Device Group Associations
Prerequisites:
- User Group聽ID (60f84e262921680001dbe9ba聽for the example)
- Device Group聽ID (60d9f2c796021e000117f31a聽for the example)
- 探花大神 API Key (redacted for the example)
Creating User Group 鈫� Device Group Associations
cURL for creating a new User Group 鈫� Device Group association with elevated permissions:
- This example sets the elevated permissions to聽
passwordless sudo.
curl -X POST https://console.jumpcloud.com/api/v2/usergroups/60f84e262921680001dbe9ba/associations \
聽聽-H 'Accept: application/json' \
聽聽-H 'Content-Type: application/json' \
聽聽-H "x-api-key: $JC_API_KEY" \
聽聽-d '{
聽聽聽聽聽聽聽聽"op": "add",
聽聽聽聽聽聽聽聽"type": "system_group",
聽聽聽聽聽聽聽聽"id": "60d9f2c796021e000117f31a",
聽聽聽聽聽聽聽聽"attributes": {
聽聽聽聽聽聽聽聽聽聽"sudo": {
聽聽聽聽聽聽聽聽聽聽聽聽"enabled": true,
聽聽聽聽聽聽聽聽聽聽聽聽"withoutPassword": true
聽听听听听听听听听听皑
聽聽听听听听听听皑
听听听听听听皑'
Removing User Group 鈫� Device Group Associations
cURL for removing a User Group 鈫� Device Group association:
curl -X POST https://console.jumpcloud.com/api/v2/usergroups/60f84e262921680001dbe9ba/associations \
聽聽-H 'Accept: application/json' \
聽聽-H 'Content-Type: application/json' \
聽聽-H "x-api-key: $JC_API_KEY" \
聽聽-d '{
聽聽聽聽聽聽聽聽"op": "remove",
聽聽聽聽聽聽聽聽"type": "system_group",
聽聽聽聽聽聽聽聽"id": "60d9f2c796021e000117f31a"
听听听听听听皑'
Modifying Existing User Group 鈫� Device Group Associations
cURL for modifying elevated permissions on an existing User Group 鈫� Device Group association:
- This example sets the elevated permissions to聽
sudo.
curl -X POST https://console.jumpcloud.com/api/v2/usergroups/60f84e262921680001dbe9ba/associations \
聽聽-H 'Accept: application/json' \
聽聽-H 'Content-Type: application/json' \
聽聽-H "x-api-key: $JC_API_KEY" \
聽聽-d '{
聽聽聽聽聽聽聽聽"op": "update",
聽聽聽聽聽聽聽聽"type": "system_group",
聽聽聽聽聽聽聽聽"id": "60d9f2c796021e000117f31a",
聽聽聽聽聽聽聽聽"attributes": {
聽聽聽聽聽聽聽聽聽聽"sudo": {
聽聽聽聽聽聽聽聽聽聽聽聽"enabled": true,
聽聽聽聽聽聽聽聽聽聽聽聽"withoutPassword": false
聽听听听听听听听听听皑
聽聽听听听听听听皑
听听听听听听皑'
cURL for removing elevated permissions on an existing User Group 鈫� Device Group association:
curl -X POST https://console.jumpcloud.com/api/v2/usergroups/60f84e262921680001dbe9ba/associations \
聽聽-H 'Accept: application/json' \
聽聽-H 'Content-Type: application/json' \
聽聽-H "x-api-key: $JC_API_KEY" \
聽聽-d '{
聽聽聽聽聽聽聽聽"op": "update",
聽聽聽聽聽聽聽聽"type": "system_group",
聽聽聽聽聽聽聽聽"id": "60d9f2c796021e000117f31a",
聽聽聽聽聽聽聽聽"attributes": {}
听听听听听听皑'
Again, note that this was accomplished by removing the sudo property from the attributes.
Verifying User Group 鈫� Device Group Association Permissions
- cURL for retrieving User Groups 鈫� Device Groups (referred to as聽
system_group聽in the API) associations:
curl \
聽聽-H 'Accept: application/json' \
聽聽-H 'Content-Type: application/json' \
聽聽-H "x-api-key: $JC_API_KEY"
Returning something similar:
[
听听调
聽聽聽聽"attributes": {
聽聽聽聽聽聽"sudo": {
聽聽聽聽聽聽聽聽"withoutPassword": true,
聽聽聽聽聽聽聽聽"enabled": true
听听听听听听皑
聽听听听皑,
聽聽聽聽"to": {
聽聽聽聽聽聽"attributes": null,
聽聽聽聽聽聽"id": "60d9f2c796021e000117f31a",
聽聽聽聽聽聽"type": "system_group"
聽听听听皑
听听皑
]
- In this case, the returned JSON indicates that the group has聽
passwordless sudo聽elevated permissions to the聽system_group聽with id聽60d9f2c796021e000117f31a.
The response from the聽/associations聽endpoint is a list of Device Groups, so it may return many associations that may need to be inspected to confirm elevated permissions for a specific group.
Permission Caveats
- It is recommended to have the
sudoproperty as one of two states (below). - If no elevated permissions are desired, it is advisable to remove the聽
sudo聽attribute entirely from the聽attributes听辞产箩别肠迟.
"sudo":{
听听听听"别苍补产濒别诲":迟谤耻别,
听听听听"飞颈迟丑辞耻迟笔补蝉蝉飞辞谤诲":蹿补濒蝉别
听听皑
Passwordless sudo:
"sudo":{
听听听听"别苍补产濒别诲":迟谤耻别,
听听听听"飞颈迟丑辞耻迟笔补蝉蝉飞辞谤诲":迟谤耻别
听听皑
In this Article
Learn More