mirror of
https://github.com/LukeHagar/developer.sailpoint.com.git
synced 2025-12-10 04:19:42 +00:00
adding beta version docs back
This commit is contained in:
darrell-thobe-sp
@@ -0,0 +1,347 @@
|
||||
---
|
||||
id: beta-password-management
|
||||
title: PasswordManagement
|
||||
pagination_label: PasswordManagement
|
||||
sidebar_label: PasswordManagement
|
||||
sidebar_class_name: gosdk
|
||||
keywords: ['go', 'Golang', 'sdk', 'PasswordManagement', 'BetaPasswordManagement']
|
||||
slug: /tools/sdk/go/beta/methods/password-management
|
||||
tags: ['SDK', 'Software Development Kit', 'PasswordManagement', 'BetaPasswordManagement']
|
||||
---
|
||||
|
||||
# PasswordManagementAPI
|
||||
Use this API to implement password management functionality.
|
||||
With this functionality in place, users can manage their identity passwords for all their applications.
|
||||
|
||||
In Identity Security Cloud, users can select their names in the upper right corner of the page and use the drop-down menu to select Password Manager.
|
||||
Password Manager lists the user's identity's applications, possibly grouped to share passwords.
|
||||
Users can then select 'Change Password' to update their passwords.
|
||||
|
||||
Grouping passwords allows users to update their passwords more broadly, rather than requiring them to update each password individually.
|
||||
Password Manager may list the applications and sources in the following groups:
|
||||
|
||||
- Password Group: This refers to a group of applications that share a password.
|
||||
For example, a user can use the same password for Google Drive, Google Mail, and YouTube.
|
||||
Updating the password for the password group updates the password for all its included applications.
|
||||
|
||||
- Multi-Application Source: This refers to a source with multiple applications that share a password.
|
||||
For example, a user can have a source, G Suite, that includes the Google Calendar, Google Drive, and Google Mail applications.
|
||||
Updating the password for the multi-application source updates the password for all its included applications.
|
||||
|
||||
- Applications: These are applications that do not share passwords with other applications.
|
||||
|
||||
An organization may require some authentication for users to update their passwords.
|
||||
Users may be required to answer security questions or use a third-party authenticator before they can confirm their updates.
|
||||
|
||||
Refer to [Managing Passwords](https://documentation.sailpoint.com/saas/user-help/accounts/passwords.html) for more information about password management.
|
||||
|
||||
All URIs are relative to *https://sailpoint.api.identitynow.com/beta*
|
||||
|
||||
Method | HTTP request | Description
|
||||
------------- | ------------- | -------------
|
||||
[**create-digit-token**](#create-digit-token) | **Post** `/generate-password-reset-token/digit` | Generate a digit token
|
||||
[**get-identity-password-change-status**](#get-identity-password-change-status) | **Get** `/password-change-status/{id}` | Get Password Change Request Status
|
||||
[**query-password-info**](#query-password-info) | **Post** `/query-password-info` | Query Password Info
|
||||
[**set-identity-password**](#set-identity-password) | **Post** `/set-password` | Set Identity's Password
|
||||
|
||||
|
||||
## create-digit-token
|
||||
Generate a digit token
|
||||
This API is used to generate a digit token for password management. Requires authorization scope of "idn:password-digit-token:create".
|
||||
|
||||
[API Spec](https://developer.sailpoint.com/docs/api/beta/create-digit-token)
|
||||
|
||||
### Path Parameters
|
||||
|
||||
|
||||
|
||||
### Other Parameters
|
||||
|
||||
Other parameters are passed through a pointer to a apiCreateDigitTokenRequest struct via the builder pattern
|
||||
|
||||
|
||||
Name | Type | Description | Notes
|
||||
------------- | ------------- | ------------- | -------------
|
||||
**passwordDigitTokenReset** | [**PasswordDigitTokenReset**](../models/password-digit-token-reset) | |
|
||||
|
||||
### Return type
|
||||
|
||||
[**PasswordDigitToken**](../models/password-digit-token)
|
||||
|
||||
### HTTP request headers
|
||||
|
||||
- **Content-Type**: application/json
|
||||
- **Accept**: application/json
|
||||
|
||||
### Example
|
||||
|
||||
```go
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"os"
|
||||
beta "github.com/sailpoint-oss/golang-sdk/v2/api_beta"
|
||||
openapiclient "github.com/sailpoint-oss/golang-sdk/v2"
|
||||
)
|
||||
|
||||
func main() {
|
||||
passwordDigitTokenReset := fmt.Sprintf(`{
|
||||
"durationMinutes" : 5,
|
||||
"length" : 8,
|
||||
"userId" : "Abby.Smith"
|
||||
}`) # PasswordDigitTokenReset |
|
||||
|
||||
configuration := NewDefaultConfiguration()
|
||||
apiClient := NewAPIClient(configuration)
|
||||
resp, r, err := apiClient.Beta.PasswordManagementAPI.CreateDigitToken(context.Background()).PasswordDigitTokenReset(passwordDigitTokenReset).Execute()
|
||||
if err != nil {
|
||||
fmt.Fprintf(os.Stderr, "Error when calling `PasswordManagementAPI.CreateDigitToken``: %v\n", err)
|
||||
fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r)
|
||||
}
|
||||
// response from `CreateDigitToken`: PasswordDigitToken
|
||||
fmt.Fprintf(os.Stdout, "Response from `PasswordManagementAPI.CreateDigitToken`: %v\n", resp)
|
||||
}
|
||||
```
|
||||
|
||||
[[Back to top]](#)
|
||||
|
||||
## get-identity-password-change-status
|
||||
Get Password Change Request Status
|
||||
This API returns the status of a password change request. A token with identity owner or trusted API client application authority is required to call this API.
|
||||
|
||||
[API Spec](https://developer.sailpoint.com/docs/api/beta/get-identity-password-change-status)
|
||||
|
||||
### Path Parameters
|
||||
|
||||
|
||||
Name | Type | Description | Notes
|
||||
------------- | ------------- | ------------- | -------------
|
||||
**ctx** | **context.Context** | context for authentication, logging, cancellation, deadlines, tracing, etc.
|
||||
**id** | **string** | |
|
||||
|
||||
### Other Parameters
|
||||
|
||||
Other parameters are passed through a pointer to a apiGetIdentityPasswordChangeStatusRequest struct via the builder pattern
|
||||
|
||||
|
||||
Name | Type | Description | Notes
|
||||
------------- | ------------- | ------------- | -------------
|
||||
|
||||
|
||||
### Return type
|
||||
|
||||
[**PasswordStatus**](../models/password-status)
|
||||
|
||||
### HTTP request headers
|
||||
|
||||
- **Content-Type**: Not defined
|
||||
- **Accept**: application/json
|
||||
|
||||
### Example
|
||||
|
||||
```go
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"os"
|
||||
beta "github.com/sailpoint-oss/golang-sdk/v2/api_beta"
|
||||
openapiclient "github.com/sailpoint-oss/golang-sdk/v2"
|
||||
)
|
||||
|
||||
func main() {
|
||||
id := id_example # string | # string |
|
||||
|
||||
configuration := NewDefaultConfiguration()
|
||||
apiClient := NewAPIClient(configuration)
|
||||
resp, r, err := apiClient.Beta.PasswordManagementAPI.GetIdentityPasswordChangeStatus(context.Background(), id).Execute()
|
||||
if err != nil {
|
||||
fmt.Fprintf(os.Stderr, "Error when calling `PasswordManagementAPI.GetIdentityPasswordChangeStatus``: %v\n", err)
|
||||
fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r)
|
||||
}
|
||||
// response from `GetIdentityPasswordChangeStatus`: PasswordStatus
|
||||
fmt.Fprintf(os.Stdout, "Response from `PasswordManagementAPI.GetIdentityPasswordChangeStatus`: %v\n", resp)
|
||||
}
|
||||
```
|
||||
|
||||
[[Back to top]](#)
|
||||
|
||||
## query-password-info
|
||||
Query Password Info
|
||||
This API is used to query password related information.
|
||||
|
||||
A token with [API authority](https://developer.sailpoint.com/idn/api/authentication#client-credentials-grant-flow)
|
||||
is required to call this API. "API authority" refers to a token that only has the "client_credentials"
|
||||
grant type, and therefore no user context. A [personal access token](https://developer.sailpoint.com/idn/api/authentication#personal-access-tokens)
|
||||
or a token generated with the [authorization_code](https://developer.sailpoint.com/idn/api/authentication#authorization-code-grant-flow)
|
||||
grant type will **NOT** work on this endpoint, and a `403 Forbidden` response
|
||||
will be returned.
|
||||
|
||||
|
||||
[API Spec](https://developer.sailpoint.com/docs/api/beta/query-password-info)
|
||||
|
||||
### Path Parameters
|
||||
|
||||
|
||||
|
||||
### Other Parameters
|
||||
|
||||
Other parameters are passed through a pointer to a apiQueryPasswordInfoRequest struct via the builder pattern
|
||||
|
||||
|
||||
Name | Type | Description | Notes
|
||||
------------- | ------------- | ------------- | -------------
|
||||
**passwordInfoQueryDTO** | [**PasswordInfoQueryDTO**](../models/password-info-query-dto) | |
|
||||
|
||||
### Return type
|
||||
|
||||
[**PasswordInfo**](../models/password-info)
|
||||
|
||||
### HTTP request headers
|
||||
|
||||
- **Content-Type**: application/json
|
||||
- **Accept**: application/json
|
||||
|
||||
### Example
|
||||
|
||||
```go
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"os"
|
||||
beta "github.com/sailpoint-oss/golang-sdk/v2/api_beta"
|
||||
openapiclient "github.com/sailpoint-oss/golang-sdk/v2"
|
||||
)
|
||||
|
||||
func main() {
|
||||
passwordInfoQueryDTO := fmt.Sprintf(`{
|
||||
"sourceName" : "My-AD",
|
||||
"userName" : "Abby.Smith"
|
||||
}`) # PasswordInfoQueryDTO |
|
||||
|
||||
configuration := NewDefaultConfiguration()
|
||||
apiClient := NewAPIClient(configuration)
|
||||
resp, r, err := apiClient.Beta.PasswordManagementAPI.QueryPasswordInfo(context.Background()).PasswordInfoQueryDTO(passwordInfoQueryDTO).Execute()
|
||||
if err != nil {
|
||||
fmt.Fprintf(os.Stderr, "Error when calling `PasswordManagementAPI.QueryPasswordInfo``: %v\n", err)
|
||||
fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r)
|
||||
}
|
||||
// response from `QueryPasswordInfo`: PasswordInfo
|
||||
fmt.Fprintf(os.Stdout, "Response from `PasswordManagementAPI.QueryPasswordInfo`: %v\n", resp)
|
||||
}
|
||||
```
|
||||
|
||||
[[Back to top]](#)
|
||||
|
||||
## set-identity-password
|
||||
Set Identity's Password
|
||||
This API is used to set a password for an identity.
|
||||
|
||||
An identity can change their own password (as well as any of their accounts' passwords) if they use a token generated by their ISC user, such as a [personal access token](https://developer.sailpoint.com/idn/api/authentication#personal-access-tokens) or ["authorization_code" derived OAuth token](https://developer.sailpoint.com/idn/api/authentication#authorization-code-grant-flow).
|
||||
|
||||
A token with [API authority](https://developer.sailpoint.com/idn/api/authentication#client-credentials-grant-flow) can be used to change **any** identity's password or the password of any of the identity's accounts.
|
||||
"API authority" refers to a token that only has the "client_credentials" grant type.
|
||||
|
||||
>**Note: If you want to set an identity's source account password, you must enable `PASSWORD` as one of the source's features. You can use the [PATCH Source endpoint](https://developer.sailpoint.com/docs/api/v3/update-source) to add the `PASSWORD` feature.**
|
||||
|
||||
You can use this endpoint to generate an `encryptedPassword` (RSA encrypted using publicKey).
|
||||
To do so, follow these steps:
|
||||
|
||||
1. Use [Query Password Info](https://developer.sailpoint.com/idn/api/v3/query-password-info) to get the following information: `identityId`, `sourceId`, `publicKeyId`, `publicKey`, `accounts`, and `policies`.
|
||||
|
||||
2. Choose an account from the previous response that you will provide as an `accountId` in your request to set an encrypted password.
|
||||
|
||||
3. Use [Set Identity's Password](https://developer.sailpoint.com/idn/api/v3/set-password) and provide the information you got from your earlier query. Then add this code to your request to get the encrypted password:
|
||||
|
||||
```java
|
||||
import javax.crypto.Cipher;
|
||||
import java.security.KeyFactory;
|
||||
import java.security.PublicKey;
|
||||
import java.security.spec.X509EncodedKeySpec;
|
||||
import java util.Base64;
|
||||
|
||||
String encrypt(String publicKey, String toEncrypt) throws Exception {
|
||||
byte[] publicKeyBytes = Base64.getDecoder().decode(publicKey);
|
||||
byte[] encryptedBytes = encryptRsa(publicKeyBytes, toEncrypt.getBytes("UTF-8"));
|
||||
return Base64.getEncoder().encodeToString(encryptedBytes);
|
||||
}
|
||||
|
||||
private byte[] encryptRsa(byte[] publicKeyBytes, byte[] toEncryptBytes) throws Exception {
|
||||
PublicKey key = KeyFactory.getInstance("RSA").generatePublic(new X509EncodedKeySpec(publicKeyBytes));
|
||||
String transformation = "RSA/ECB/PKCS1Padding";
|
||||
Cipher cipher = Cipher.getInstance(transformation);
|
||||
cipher.init(1, key);
|
||||
return cipher.doFinal(toEncryptBytes);
|
||||
}
|
||||
```
|
||||
|
||||
In this example, `toEncrypt` refers to the plain text password you are setting and then encrypting, and the `publicKey` refers to the publicKey you got from the first request you sent.
|
||||
|
||||
You can then use [Get Password Change Request Status](https://developer.sailpoint.com/idn/api/v3/get-password-change-status) to check the password change request status. To do so, you must provide the `requestId` from your earlier request to set the password.
|
||||
|
||||
|
||||
[API Spec](https://developer.sailpoint.com/docs/api/beta/set-identity-password)
|
||||
|
||||
### Path Parameters
|
||||
|
||||
|
||||
|
||||
### Other Parameters
|
||||
|
||||
Other parameters are passed through a pointer to a apiSetIdentityPasswordRequest struct via the builder pattern
|
||||
|
||||
|
||||
Name | Type | Description | Notes
|
||||
------------- | ------------- | ------------- | -------------
|
||||
**passwordChangeRequest** | [**PasswordChangeRequest**](../models/password-change-request) | |
|
||||
|
||||
### Return type
|
||||
|
||||
[**PasswordChangeResponse**](../models/password-change-response)
|
||||
|
||||
### HTTP request headers
|
||||
|
||||
- **Content-Type**: application/json
|
||||
- **Accept**: application/json
|
||||
|
||||
### Example
|
||||
|
||||
```go
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"os"
|
||||
beta "github.com/sailpoint-oss/golang-sdk/v2/api_beta"
|
||||
openapiclient "github.com/sailpoint-oss/golang-sdk/v2"
|
||||
)
|
||||
|
||||
func main() {
|
||||
passwordChangeRequest := fmt.Sprintf(`{
|
||||
"sourceId" : "8a807d4c73c545510173c545d4b60246",
|
||||
"accountId" : "CN=Abby Smith,OU=Austin,OU=Americas,OU=Demo,DC=seri,DC=acme,DC=com",
|
||||
"identityId" : "8a807d4c73c545510173c545f0a002ff",
|
||||
"publicKeyId" : "YWQ2NjQ4MTItZjY0NC00MWExLWFjMjktOGNmMzU3Y2VlNjk2",
|
||||
"encryptedPassword" : "XzN+YwKgr2C+InkMYFMBG3UtjMEw5ZIql/XFlXo8cJNeslmkplx6vn4kd4/43IF9STBk5RnzR6XmjpEO+FwHDoiBwYZAkAZK/Iswxk4OdybG6Y4MStJCOCiK8osKr35IMMSV/mbO4wAeltoCk7daTWzTGLiI6UaT5tf+F2EgdjJZ7YqM8W8r7aUWsm3p2Xt01Y46ZRx0QaM91QruiIx2rECFT2pUO0wr+7oQ77jypATyGWRtADsu3YcvCk/6U5MqCnXMzKBcRas7NnZdSL/d5H1GglVGz3VLPMaivG4/oL4chOMmFCRl/zVsGxZ9RhN8rxsRGFFKn+rhExTi+bax3A=="
|
||||
}`) # PasswordChangeRequest |
|
||||
|
||||
configuration := NewDefaultConfiguration()
|
||||
apiClient := NewAPIClient(configuration)
|
||||
resp, r, err := apiClient.Beta.PasswordManagementAPI.SetIdentityPassword(context.Background()).PasswordChangeRequest(passwordChangeRequest).Execute()
|
||||
if err != nil {
|
||||
fmt.Fprintf(os.Stderr, "Error when calling `PasswordManagementAPI.SetIdentityPassword``: %v\n", err)
|
||||
fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r)
|
||||
}
|
||||
// response from `SetIdentityPassword`: PasswordChangeResponse
|
||||
fmt.Fprintf(os.Stdout, "Response from `PasswordManagementAPI.SetIdentityPassword`: %v\n", resp)
|
||||
}
|
||||
```
|
||||
|
||||
[[Back to top]](#)
|
||||
|
||||
Reference in New Issue
Block a user