Security management

Authentication from the Content Software for File system to Vault relies on an API token. Since the Content Software for File system must always be able to communicate with the KMS, a periodic service token must be used. To obtain the token, follow the next steps:

• Verify that the token authentication method in Vault is enabled. This can be performed using the following command:

  $ vault auth list
  
  Path         Type        Description
  ----         ----        -----------
  token/       token       token based credentials

• To enable the token authentication method use the following command:

  $ vault auth enable token

• Log into the KMS system using any of the identity methods supported by Vault. The identity should have permission to use the previously-set master key.
• Create a token role for the identity using the following command:

  $ vault write auth/token/roles/weka allowed_policies="weka" period="768h"

  Notehe period is the time set for a renewal request. If no renewal is requested during this time period, the token will be revoked and a new token must be retrieved from Vault and set in the Weka system.
• Generate a token for the logged-in identity using the following command:

  $ vault token create -role=weka
  
  Key                  Value
  ---                  -----
  token                s.nRucA9Gtb3yNVmLUK221234
  token_accessor       4Nm9BvIVS4HWCgLATc3r1234
  token_duration       768h
  token_renewable      true
  token_policies       ["default"]
  identity_policies    []
  policies             ["default"]

For more information on obtaining an API token, see Vault Tokens documentation.

You must provide an access token to use the Content Software for File REST API.

To obtain access/refresh tokens via the CLI, refer to Obtaining an Authentication Token section (there you can also generate an access token with a longer expiry time). To obtain access/refresh tokens via the API, you can call the login API, providing it a username and password .

If you already obtained a refresh token, you can use the login/refresh API to refresh the access token.

{% tabs %} {% tab title="Login" %} {% code title="Python example calling the login API" %}

import requests

url = "https://weka01:14000/api/v2/login"

payload="{\n    \"username\": \"admin\",\n    \"password\": \"admin\"\n}"
headers = {
  'Content-Type': 'application/json'
}

response = requests.request("POST", url, headers=headers, data=payload)

print(response.text)

{% endcode %} {% endtab %}

{% tab title="Refresh" %} {% code title="Python example calling the login refresh API" %}

import requests

url = "https://weka01:14000/api/v2/login/refresh"

payload="{\n    \"refresh_token\": \"REPLACE-WITH-REFRESH-TOKEN\"\n}"
headers = {
  'Content-Type': 'application/json'
}

response = requests.request("POST", url, headers=headers, data=payload)

print(response.text)

{% endcode %} {% endtab %} {% endtabs %}

In response, you will get an access token (valid for 5 minutes), that can be used in the other APIs that require token authentication, along with the refresh token (valid for 1 year), for getting additional access tokens without using the username/password.

{% code title="Login/Refresh Response" %}

{
  "data": [
    {
      "access_token": "ACCESS-TOKEN",
      "token_type": "Bearer",
      "expires_in": 300,
      "refresh_token": "REFRESH-TOKEN"
    }
  ]
}

{% endcode %}

Now, that you have obtained an access token, you can call Content Software for File REST API commands with it. For example, you can query the cluster status:

{% code title="Python example calling cluster status API" %}

import requests

url = "https://weka01:14000/api/v2/cluster"

payload={}
headers = {
  'Authorization': 'Bearer REPLACE-WITH-ACCESS-TOKEN'
}

response = requests.request("GET", url, headers=headers, data=payload)

print(response.text)

{% endcode %}