Assigning DaaS Roles
DaaS roles can be programmatically assigned to Citrix Cloud administrators through a combination Citrix Cloud APIs.
Note:
For now, this documentation only works for DaaS and Platform Services (Notifications, SecureClient, ResourceLocations, etc.) The DaaS policies have
serviceName == "XenDesktop"and Platform policies haveserviceName == "Platform". There is a future roadmap for supporting programmatically managing access for all services.
Add a new administrator with DaaS Roles and Scopes
- Fetch the available DaaS roles and scopes
Get the DaaS policies (roles and scopes) available for assignment by calling GET /administrators/{id}/access where {id} is the userId of the user administrator bearer token used to authorize the request.
This will fetch all available policies for the customer.
You may find the userId by either decoding the JWT or find your administrator by calling GET /administrators.
- Create the new administrator
Call POST /administrators/$create.
Modify the response body from the previous step and set the accessType and policies in the request body.
-
checkable.valueindicates whether the permission is granted or not. You may omit policies and scopes wherecheckable.value := false. - For
accessType := "Full", set policies to null.
Custom Access Example:
{
"type": "AdministratorUser",
"providerType": "CitrixSts",
"email": "alice@example.com",
"firstName": "Alice",
"lastName": "Roberts",
"accessType": "Custom",
"policies": [
// DaaS permissions
{
"name": "R-3a45035c-a260-4b4a-88a9-64461cba5a",
"serviceName": "XenDesktop",
"displayName": "Cloud Administrator",
"checkable": {
"value": true,
"canChangeValue": true
},
"scopeChoices": {
"allScopesSelected": false,
"choices": [
{
"name": "XenDesktop-FullAdmin",
"displayName": "All",
"checkable": {
"value": true,
"canChangeValue": true
}
}
]
}
},
{
"name": "R-ac0b54e3-6e8a-473f-9713-139218ed4e",
"serviceName": "XenDesktop",
"displayName": "Delivery Group Administrator",
"checkable": {
"value": true,
"canChangeValue": true
},
"scopeChoices": {
"allScopesSelected": false,
"choices": [
{
"name": "300adc84-286b-8cc4-29bd-36a0e7bb87b4",
"displayName": "Test scope",
"checkable": {
"value": true,
"canChangeValue": true
}
}
]
}
}
// ... other permissions
]
}
<!--NeedCopy-->
Full Access Example:
{
"type": "AdministratorUser",
"providerType": "CitrixSts",
"email": "alice@example.com",
"firstName": "Alice",
"lastName": "Roberts",
"accessType": "Full"
}
<!--NeedCopy-->
Update an existing administrator with DaaS Roles and Scopes
- Fetch all administrators
Get all administrators by calling GET /administrators to retrieve the userId or ucOid of the target administrator
- Fetch the available DaaS roles and scopes
Get the DaaS policies (roles and scopes) available for assignment by calling GET /administrators/{id}/access where {id} is the id of the target administrator.
- For User Administrators, use
userId. - For Group Administrators, use url-encoded
ucOid.
This will fetch all available policies for the target administrator.
- Update the existing administrator’s access
Call [PUT /administrators/access?id=
-
checkable.valueindicates whether the permission is granted or not. You may omit policies and scopes wherecheckable.value := false. - For
accessType := "Full", set policies to null.
Custom access example:
{
"accessType": "Custom",
"policies": [
// DaaS permissions
{
"name": "R-3a45035c-a260-4b4a-88a9-64461cba5a",
"serviceName": "XenDesktop",
"displayName": "Cloud Administrator",
"checkable": {
"value": true,
"canChangeValue": true
},
"scopeChoices": {
"allScopesSelected": false,
"choices": [
{
"name": "XenDesktop-FullAdmin",
"displayName": "All",
"checkable": {
"value": true,
"canChangeValue": true
}
}
]
}
},
{
"name": "R-ac0b54e3-6e8a-473f-9713-139218ed4e",
"serviceName": "XenDesktop",
"displayName": "Delivery Group Administrator",
"checkable": {
"value": true,
"canChangeValue": true
},
"scopeChoices": {
"allScopesSelected": false,
"choices": [
{
"name": "300adc84-286b-8cc4-29bd-36a0e7bb87b4",
"displayName": "Test scope",
"checkable": {
"value": true,
"canChangeValue": true
}
}
]
}
}
]
}
<!--NeedCopy-->
Full access example:
{
"accessType": "Full"
}
<!--NeedCopy-->