Your suggested change has been received. Thank you.

close

Suggest A Change

https://thales.na.market.dpondemand.io/docs/dpod/services/kmo….

Thales Logo
back

OCI External Resources

Managing External Vaults

search

Please Note:

Managing External Vaults

This section describes how to manage external vaults on CCKM. Before proceeding, a connection to your Oracle account must exist on the CipherTrust Manager and an identity provider must be created.

External vaults can be added, viewed, modified, or deleted on the External Vaults tab of the Oracle Vaults page of the CipherTrust Cloud Key Manager (CCKM) GUI.

Adding External Vaults

You can add external vaults linked to an Oracle connection to the CipherTrust Manager. An external vault can only be added just once.

To add an external vault:

  1. Open the Cloud Key Manager application.

  2. In the left pane, click KMS Containers > Oracle Vaults. The Vaults tab of the Oracle Vaults page is displayed.

  3. Click the External Vaults tab.

  4. Click Add External Vault. The Add External Vault wizard is displayed.

  5. Enter a unique Vault Name.

  6. Select one of the Methods for choosing Oracle Tenancy. The options are:

    • Oracle Connection: Select to specify an Oracle connection. The Select a Connection drop-down list is displayed.

    • Oracle Tenancy (no connection): Select to specify a tenancy. The Tenancy drop-down list is displayed.

  7. Depending on the method selected in the previous step, Select a Connection or Tenancy from the drop-down list.

  8. Select an Issuer from the drop-down list.

  9. Enter Client Application ID of the OCI KMS application as registered in Register OCI KMS Application.

  10. In Endpoint URL Hostname, specify the IP address of the CipherTrust Manager or Load Balancer. FQDNs are not supported.

  11. (Optional) Enter Policy.

  12. Click Add.

  13. Click Close.

The selected vault is displayed on the External Vaults tab of the Oracle Vaults page.

The vault is available for adding external keys.

Viewing External Vaults

To view the list of the external vaults added to the CipherTrust Manager:

  1. Open the Cloud Key Manager application.

  2. In the left pane, click KMS Containers > Oracle Vaults.

  3. Click the External Vaults tab. The External Vaults tab of the Oracle Vaults page shows the list of external vaults added to the CipherTrust Manager.

    The page displays the following details:

    ColumnDescription
    NameName of the external vault.
    External Vault URLURL of the external vault.
    StatusStatus of the external vault, BLOCKED or UNBLOCKED.
    TenancyName of the Oracle tenancy.
    Identity ProviderName of the identity provider.
    ConnectionName of the Oracle connection added to the CipherTrust Manager.
    Date AddedDate and time when the external vault was added.

To view/hide columns, click the Customize View (Custom View) icon, select/clear the desired option, and click OK to display the column.

Viewing or Editing Details of an External Vault

To view or edit the details of an external vault on CCKM:

  1. Open the Cloud Key Manager application.

  2. In the left pane, click KMS Containers > Oracle Vaults.

  3. Click the External Vaults tab.

  4. On the External Vaults tab, click the Name link of the desired vault.

    Alternatively, click the overflow icon (Overflow Icon) corresponding to the desired vault, and click View/Edit Details.

The ORACLE VAULT DETAILS page shows additional details of the selected vault under the GENERAL INFO and ACCESS CONTROL sections. Expand each section to view and edit their details.

The GENERAL INFO section provides details of Endpoint URL Hostname, Identity Provider, and Policy. If needed, you can edit these details, as appropriate.

Changing the Endpoint URL Hostname and Identity Provider

You can change the endpoint URL hostname, identity provider, and policy of an external vault on the CipherTrust Manager.

  1. Expand GENERAL INFO.

  2. Update the Endpoint URL Hostname. Specify the IP address of the CipherTrust Manager or Load Balancer. FQDNs are not supported.

  3. Update the Identity Provider from the drop-down list.

  4. Update the Policy. Specify a valid Rego policy.

  5. Click Update.

The endpoint URL hostname, identity provider, and policy of the external vault is changed.

Managing User Permissions on External Vaults

To work with the external resources, users/groups must have the minimum set of permissions that allow them to use the external resources such as external keys and vaults. Initially, the CCKM user only has permission to view the external keys. However, if required, the CCKM administrator can grant and revoke permissions.

Note

Only the users who are member of the CCKM Users group will be granted permissions to perform operations on external vaults.

Users with the following characteristics can perform operations on external keys and vaults:

  • Users in the CCKM Admins group

  • Users in the Admin group

  • Users who are administrators for a domain

  • Users who are in the CCKM Users group and which have had a CCKM Admin assign permissions through the UI or the /v1/cckm/oci/vaults/{id}/update-acls endpoint in the REST API.

Adding Permissions for a User/Group

To add permissions for a user/group:

  1. Open the Cloud Key Manager application.

  2. In the left pane, click KMS Containers > Oracle Vaults.

  3. Click the External Vaults tab.

  4. On the External Vaults tab, click the Name link of the desired vault.

    Alternatively, click the overflow icon (Overflow Icon) corresponding to the desired vault, and click View/Edit Details.

  5. Expand the ACCESS CONTROL section.

  6. Click Assign User/Group. The Assign User/Group dialog box is displayed.

  7. Select the desired user or group from the User/Group drop-down list.

  8. Click Save.

The newly added user/group is displayed under Name in the ACCESS CONTROL section. You can now grant additional permissions to the user/group, as appropriate. Refer to Granting Permission to Perform an Operation for details.

Granting Permission to Perform an Operation

To grant permissions to the user or group to perform any of the above mentioned operations:

  1. In the ACCESS CONTROL section, select the check box under the desired operation corresponding to the desired users or groups.

  2. Click Update.

A success message is displayed on the screen.

To revoke permissions from a user/group, refer to Removing a Permission for details.

Removing a Permission

To remove a permission assigned to a user or group:

  1. In the ACCESS CONTROL section, clear the check box under the desired operation corresponding to the desired users or groups.

  2. Click Update.

A success message is displayed on the screen.

Removing Permission from a User/Group

To remove current permissions assigned to the user/group:

  1. In the ACCESS CONTROL section, under Unassign, click the X button corresponding to the desired user/group.

  2. On the Remove User / Remove Group screen, click Remove.

    Note

    Removing this user/group will remove all permissions currently assigned to the user/group.

  3. Click Remove to confirm the action. To cancel the action, click Keep It.

A success message is displayed on the screen.

Removing External Vaults

External vaults can be removed on the Oracle Vaults page. Search for existing external vaults using Vault Name, Tenant, or Compartment.

Note

  • Removing an external vault is an irreversible operation which permanently deletes unique identifiers required by the corresponding OCI vaults under External Key Manager (EKM).

  • Before deleting an external vault from the CipherTrust Manager, ensure that the vault contains no external keys. Delete all external keys stored in the vault.

To remove an external vault from the CipherTrust Manager:

  1. Open the Cloud Key Manager application.

  2. In the left pane, click KMS Containers > Oracle Vaults.

  3. Click the External Vaults tab.

  4. On the External Vaults tab, click the overflow icon (Overflow Icon) corresponding to the vault you want to remove.

  5. Click Remove Vault.

  6. Select I wish to delete the vault.

  7. Click Delete.

The external vault is deleted successfully. It is removed from the list of external vaults.

Blocking External Vaults

External vaults can be blocked on the Oracle Vaults page. Search for existing external vaults using Vault Name, Tenant, or Compartment.

When you block an external vault, all the external keys in the vault will be blocked. Any subsequent requests to the keys will fail. Blocking an external vault will also prevent any cryptographic operations on the key from the OCI KMS as well.

To block an external vault from CipherTrust Manager:

  1. Open the Cloud Key Manager application.

  2. In the left pane, click KMS Containers > Oracle Vaults.

  3. Click the External Vaults tab.

  4. On the External Vaults tab, click the overflow icon (Overflow Icon) corresponding to the external vault you want to block.

  5. Click Block.

    All keys in the vault will be blocked. Any subsequent requests to the keys will fail.

  6. Click Confirm.

The external vault is blocked successfully. The status of external vault changes to BLOCKED.

Unblocking External Vaults

Blocked external vaults can be unblocked on the Oracle Vaults page. Search for blocked external vaults using Vault Name, Tenant, or Compartment.

To unblock an external vault from the CipherTrust Manager:

  1. Open the Cloud Key Manager application.

  2. In the left pane, click KMS Containers > Oracle Vaults.

  3. Click the External Vaults tab.

  4. On the External Vaults tab, click the overflow icon (Overflow Icon) corresponding to the external vault you want to unblock.

  5. Click Unblock.

    All keys in the vault will be unblocked.

  6. Click Confirm.

The external vault is unblocked successfully. The status of external vault changes to UNBLOCKED.

On this page