Configuring the Stormshield KMaaS

The global configuration of the Stormshield KMaaS is managed through a JSON file, config.json, which is saved by default in /etc/stormshield/cse. This file sets the specifications for authentication and authorization, as well as the port, service name and service mode.

Creating the global configuration file

A template file, config.json.template, is available to assist you.

• In RPM mode, this file is located in the directory /etc/stormshield/cse.

  • Create your own global configuration file from the copy of the template using the following command:
    # cd /etc/stormshield/cse
# cp --preserve config.json.template config.json
• In Docker mode, the file is located in the dedicated directory you have created during installation. For more information, see Installing the Stormshield KMaaS via a Docker image.
  

Assigning access privileges to the file

• Assign the read and write access privileges held by the current user to the file and read access to the current config.json group:
  # chmod u=rw,g=r,o= config.json

Do not assign any run privileges on these files, or any privileges to other users. If access privileges are too permissive, a warning log will be generated when the Stormshield KMaaS starts, but will not prevent it from launching.

During installation, the stormshield-cse user is the owner of the configuration files by default. Do not change the owner.

Editing the global configuration file

• To edit the configuration, change the default values of the config.json file template.

For more information on this file, refer to sections Installing the Stormshield KMaaS via a Docker image and Installing the Stormshield KMaaS via RPM

The tables below describe the parameters in the config.json file. The first table lists simple parameters which do not contain any sub-objects. More complex parameters have their own table.

Unless otherwise specified, in the configuration files:

• All “String” fields are restricted to 10,000 characters for security reasons,

• All ”Array” fields are limited to 500 items for security reasons.

Simple parameters

tenants parameter

Contains configuration information specific to each tenant. They are grouped by "tenant_id", which is the tenant unique identifier and is mandatory. The "tenants" object includes the following components:

authorization parameters

Array of JSON objects that describes how the KACLS authorization token generated by Google is verified. It includes the following components.

Add one entry per Google service (e.g., Meet, Drive, Calendar, Gmail). The values of these settings are provided in the Google documentation. For more information, see Example of the authorization parameter for Google services

The authorization parameter is mandatory in all configurations. When using the KACLS, it must contain the required authorization data. If you do not use the KACLS, the parameter must be an empty array ("authorization": []).

Example of the authorization parameter for Google services

This extract of the config.json file is an example of how the authorization token can be configured for the Drive, Meet, Calendar and Gmail Google services, the migration of one KACLS to another, and Gmail Send to Anyone option. You can customize the rules that allow or deny a request to the Stormshield KMaaS, using Open Policy Agent (OPA) policies. For more information, see the section Implementing the authorization rules with Open Policy Agent.

"authorization": [
    {
    "url": "https://www.googleapis.com/service_accounts/v1/jwk/gsuitecse-tokenissuer-drive@system.gserviceaccount.com",
    "issuer": "gsuitecse-tokenissuer-drive@system.gserviceaccount.com",
    "audience": "cse-authorization"
    },
    {
    "url": "https://www.googleapis.com/service_accounts/v1/jwk/gsuitecse-tokenissuer-meet@system.gserviceaccount.com",
    "issuer": "gsuitecse-tokenissuer-meet@system.gserviceaccount.com",
    "audience": "cse-authorization"
    }
    {
    "url": "https://www.googleapis.com/service_accounts/v1/jwk/gsuitecse-tokenissuer-calendar@system.gserviceaccount.com",
    "issuer": "gsuitecse-tokenissuer-calendar@system.gserviceaccount.com",
    "audience": "cse-authorization"
    }
    {
    "url": "https://www.googleapis.com/service_accounts/v1/jwk/gsuitecse-tokenissuer-gmail@system.gserviceaccount.com",
    "issuer": "gsuitecse-tokenissuer-gmail@system.gserviceaccount.com",
    "audience": "cse-authorization"
    }
    {
    "url": "https://www.googleapis.com/service_accounts/v1/jwk/apps-security-cse-kaclscommunication@system.gserviceaccount.com",
    "issuer": "apps-security-cse-kaclscommunication@system.gserviceaccount.com”",
    "audience": "cse-authorization"
    }
    {
    "url": "https://www.googleapis.com/service_accounts/v1/jwk/gsuitecse-tokenissuer-gmail-sta@system.gserviceaccount.com",
    "issuer": "gsuitecse-tokenissuer-gmail-sta@system.gserviceaccount.com",
    "audience": "cse-authorization"
    },
    ]

https parameter

JSON object that describes the HTTPS certificates. To be used when you want to run the server in secure mode. It includes the following components:

keks parameter

JSON object describing the refresh frequency of the KEKs while the Stormshield KMaaS is running. It includes the following components:

kmip_configuration parameters

JSON object that describes the KMS configuration. It is mandatory if "persistence_type": "kms". It includes the following objects:

In order to use a KMS domain, the certificate of the KMS client must have a common name that conforms with the KMS_DOMAIN_NAME>||<KMS_USER_NAME> format.
For instance, if your user is Jane and your domain is JaneDomain, the common name must be: JaneDomain||Jane.
For more information, refer to the KMS KMIP documentation.

If using a KMs domain, the domain_id values of all the tenant configurations must imperatively be the same and match the domain used by the KMIP configuration. For more information, refer to section crypto_backends.

WARNING
Stormshielddoes not guarantee the proper functioning of the product if you do not follow these instructions.

NOTE:
The maximum number of simultaneous connections to the KMS server depends on your infrastructure and the KMS configuration.

cache parameter

JSON object that describes the configuration of the cache. Set the values according to your configuration, e.g., available memory. It includes the following objects:

logs parameters

JSON object that allows configuring how to display the logs in the new format. If the object is missing in the config.json file, only the logs with the old format are displayed. It includes the following objects.

For more information, see the section Managing logs.