Managing trusted profiles

Updating the description of your profile

Click the name of the trusted profile that you want to update, and select Actions > Edit. Enter the new name and description, and click Apply.

Redefining the trust relationship

After the trusted profile is created, you can build trust with both federated users and compute resources in the same trusted profile.

1. Click the name of the trusted profile that you want to update.
2. Click Add to add a condition to the existing trust relationship. To edit an existing condition, click the Actions icon > Edit next to the trust relationship you want to update.
   • Click Add a condition and repeat as needed to add more conditions.
   • To remove a condition, click the Remove icon next to the existing condition.
3. Click Save to apply all added or removed conditions to your trusted profile.

Assigning access

You can assign access to a trusted profile by assigning individual access policies, or by adding the trusted profiles to an existing access group.

Updating session duration

1. Click the name of the trusted profile that you want to update.
2. In the federated users section, click the Actions icon for the identity provider (IdP) that you want to update.
3. Select Edit
4. In hours, enter how long federated users can use this profile before their session expires.
5. Click Save.

Assigning access policies

You can assign new access policies to your trusted profile by using the CLI.

1. Log in, and select the account.

   ibmcloud login
   

2. Check the list of trusted profiles for the current account and select the one that you want to assign new access policies to. The following command shows the list of trusted profiles for your IBM Cloud account:

   ibmcloud iam trusted-profiles
   

3. Assign new access policies by running the following command:

   ibmcloud iam trusted-profile-policy-create
   

To check the details of the access policy for a trusted profile, run the following command:

ibmcloud iam trusted-profile-policy

For checking the list of access policies for a trusted profile, you can use the ibmcloud iam trusted-profile-policies command:

ibmcloud iam trusted-profile-policies

You can easily update existing access policies by running the ibmcloud iam trusted-profile-policy-update command:

ibmcloud iam trusted-profile-policy-update

If you'd like to remove an access policy for a trusted profile, you can use the ibmcloud iam trusted-profile-policy-delete command:

ibmcloud iam trusted-profile-policy-delete

Updating the name or description

To update the name or description of an existing trusted profile, call the following. Enter your updated name and description attributes.

curl -X PUT 'https://iam.cloud.ibm.com/v1/profiles/PROFILE_ID' -H 'Authorization: Bearer TOKEN' -H 'If-Match: <value of etag header from GET request>' -H 'Content-Type: application/json' -H 'Accept: application/json' -d '{
  "name": "My Profile updated",
  "description": "My updated desc"
}'

Updating the conditions of the trust relationship

After the trusted profile is created, you can build trust with both federated users and compute resources in the same trusted profile.

curl -X PUT 'https://iam.cloud.ibm.com/v1/profiles/PROFILE_ID/rules/CLAIM_RULE_ID'
-H 'Authorization: Bearer TOKEN'
-H 'If-Match: <value of etag header from GET request>'
-H 'Content-Type: application/json'
-H 'Accept: application/json'
-d '{
   "type": "Profile-SAML",
   "realm_name": "https://w3id.sso.ibm.com/auth/sps/samlidp2/saml20",
   "expiration": 10000,
   "conditions": [
  {
"claim": "groups",
"operator": "CONTAINS",
"value": "\"cloud-docs-ops\""
  }
  ]
}'

Assigning access policies

To assign new access policies, call the following:

curl -X PUT 'https://iam.cloud.ibm.com/v1/policies'
-H 'Authorization: Bearer $TOKEN'
-H 'Content-Type: application/json'
-H 'If-Match: $ETAG'
-d '{
"type": "access",
"description": "Viewer role for for all instances of SERVICE_NAME in the account.",
"subjects": [
   {
      "attributes": [
      {
         "name": "iam_id",
         "value": "IBMid-123453user"
      }
      ]
   }'
],
"roles":[
   {
      "role_id": "crn:v1:bluemix:public:iam::::role:Viewer"
   }
],
"resources":[
   {
      "attributes": [
      {
         "name": "accountId",
         "value": "$ACCOUNT_ID"
      },
      {
         "name": "serviceName",
         "value": "$SERVICE_NAME"
      }
      ]
   }
]
}'

For more information, see the IAM Policy Management API.

Updating session duration

To update the session duration for federated users, call the following:

curl -X PUT 'https://iam.cloud.ibm.com/v1/profiles/PROFILE_ID/rules/CLAIM_RULE_ID'
-H 'Authorization: Bearer TOKEN'
-H 'If-Match: <value of etag header from GET request>'
-H 'Content-Type: application/json'
-H 'Accept: application/json'
-d '{
   "type": "Profile-SAML",
   "realm_name": "https://w3id.sso.ibm.com/auth/sps/samlidp2/saml20",
   "expiration": 10000,
   "conditions": [
  {
"claim": "groups",
"operator": "CONTAINS",
"value": "\"cloud-docs-ops\""
  }
  ]
}'