Create Security Roles

This example demonstrates how to find and add a new user and roles in Pyramid, when using Active Directory authentication.

The example uses API authentication driven from JavaScript. See Authentication APIs for alternatives.

// URL of the Pyramid installation and the path to the API 3.0 REST methods
var pyramidURL = "http://mysite.com/api3/";

// step 1: authenticate admin account and get token. 
//This assumes authentication with Windows Authentication SSO. Therefore the account logging on is an admin account.
// NOTE: callApi method is a generic REST method shown below. And inside it, xhttp.withCredentials = true;
				
let token = callApi("authentication/authenticateUserWindows",{},"",false); 
log("got token "+token);

//step 2: Get the defult tenant.
let defaultTenantResult = callApi("access/getDefaultTenant",{},
token // admin token generated above
);
let tenantId = defaultTenantResult.data;
log("default tenant, id= "+tenantId);

//step 3: search for an active directory user in the AD itself
let searchUsers=callApi("access/searchAdUsers",{
	"domainNetBios":"myAdDomain",
	"searchValue":"Smith",
	"ldapSearchType": 0, //search type enumeriation. 0 = exact
},token // admin token generated above
);


let adUser = searchUsers.data[0];
log("adUser = "+adUser.firstName);

//step 4: creating a user using the results from the search in step 3
let createUser = callApi("access/createUserAd",{
	"userName": adUser.userName, //using the search result from step 3 above
	"adminType": 0, //admin type
	"clientLicenseType": 100,//ClientLicenseType.Viewer
	"statusID": 1,
	"tenantId": tenantId, //tenant Id from above
	"adDomainName":"myAdDomain" 
},token );
let userId = createUser.data.modifiedList[0].id;
log("created user "+userId);


//step 5: optional, changing the user from Viewer to Professional
let updateUser=callApi("access/updateUsersAd",[{
	"userName": adUser.userName,
	"adDomainName":"myAdDomain",
	"clientLicenseType": 200,//ClientLicenseType.Professional
}],token );


//step 6: creating 2 roles
let createRole=callApi("access/createRoles",[{
	"roleName": "role1",
	"tenantId": tenantId,
	"isGroupRole": false
},{
	"roleName": "role2",
	"tenantId": tenantId,
	"isGroupRole": false
}],token);

let role1 = createRole.data.modifiedList[0].id;
let role2 = createRole.data.modifiedList[1].id;
log("created roles "+role1+","+role2);

//step 7: binding user to role1 from step 6
let addUserToRole=callApi("access/addUserToRole",{
	"userId":userId,
	"roleId":role1
},token );


//step 8: searchAdGroupsForUser, searching for AD groups of the given user in the given domain
let groups=callApi("access/searchAdGroupsForUser",{
	"domainNetBios":"myAdDomain",
	"userName":adUser.userName
},token );
log("groups of " + adUser.userName" + "+JSON.stringify(groups.data));
let selectedGroup=groups.data[0];


//step 9: add role2 to the AD security group from step 8
let addRoleToAdGroup=callApi("access/changeRoleAdGroups",{
	roleId":role2,
	"groupsToAdd":[{
		"domainNetBios":selectedGroup.domainAddress,
		"groupName":selectedGroup.name
	}]
},token );
log("addRoleToAdGroup "+JSON.stringify(addRoleToAdGroup));

//step 10: optional get all groups by role - this will find the selected Group from step 9
let groupsFound=callApi("access/getGroupsByRole",role2,token );
log("found group "+groupsFound.data[0].name);

// ##### optional generic logging method for debugging ##############
function log(msg){
	document.write(msg);
	console.log(msg);
}

// ##### generic REST API calling method ##############
function callApi(path,data,token="",parseResult=true){
	var xhttp = new XMLHttpRequest();
	
	//notice we changed callApi and added xhttp.withCredentials = true; to pass the windows credentials
	xhttp.withCredentials = true;
	
	xhttp.open("POST", pyramidURL+path, false);
	xhttp.setRequestHeader("paToken",token)
	xhttp.send(JSON.stringify(data));
	if(parseResult){
		return JSON.parse(xhttp.responseText);
	}else{
		return xhttp.responseText;
	}
}


		

This example demonstrates how to run queries and slicers (parameters) programmatically to extract results.

The example uses API authentication driven from JavaScript. See Authentication APIs for alternatives.

// URL of the Pyramid installation and the path to the API 3.0 REST methods
var pyramidURL = "http://mysite.com/api3/";


// step 1: authenticate admin account and get token
// NOTE: callApi method is a generic REST method shown below.
let token = callApi("authentication/authenticateUser",{
	"userName":"adminUser",
		"password":"abc123!"
},"",false);


//step 2: get default tenant
let defaultTenantResult = callApi("access/getDefaultTenant","",token);
let tenantId = defaultTenantResult.data;

//step 3A: add a new profile called "Consumers" using the numeric approach

//	build the numeric value by summing the bit switches for each item needed.
// assume we want to have advanced (9) and discovery (3) choices on

let bitNum = (2^3) + (2^9)


let saveProfile= callApi("access/addProProfile",{
	"name":"Consumers",
	"description":"Basic tools for consumer user types",
	"permissions":{"numeric":bitNum},
	"tenantId":tenantId
},token);

let profileId = saveProfile.data.modifiedList[0].id

//step 3B: add a new profile called "Consumers" using the array approach
// assume we want to have advanced (9) and discovery (3) choices on

let saveProfile2= callApi("access/addProProfile",{
	"name":"Consumers",
	"description":"Basic tools for consumer user types",
	"permissions":{"permissionBitIndexList":[9,3]},
	"tenantId":tenantId
},token);

let profileId = saveProfile2.data.modifiedList[0].id


//step 4: creating roles
let createRole=callApi("access/createRoles",[{
		"roleName": "prole1",
		"tenantId": tenantId,
		"isGroupRole": false
	},{
		"roleName": "prole2",
		"tenantId": tenantId,
		"isGroupRole": false
	}],token);
let role1 = createRole.data.modifiedList[0].id;
let role2 = createRole.data.modifiedList[1].id;
log("created roles "+role1+","+role2);


//step 5: bind new profile to role1
let updateRolesByProfileId=callApi("access/updateRoleProfiles",{
	"profileId":profileId,
	"rolesToAdd":[role1],
	"rolesToRemove":[]
},token);

//step 6: retrieve all roles with a given profile
let allProfileRoles= callApi("access/getRolesbyProfile",profileId,token);

//step 7: delete the profile
let deleteProfile= callApi("access/deleteProfile",profileId,token);


// ##### optional generic logging method for debugging ##############
function log(msg){
	document.write(msg);
	console.log(msg);
}

// ##### generic REST API calling method ##############
function callApi(path,data,token="",parseResult=true){
	var xhttp = new XMLHttpRequest();
	xhttp.open("POST", pyramidURL+path, false);
	xhttp.setRequestHeader("paToken",token)
	xhttp.send(JSON.stringify(data));
	if(parseResult){
		return JSON.parse(xhttp.responseText);
	}else{
		return xhttp.responseText;
	}
}