set-authentication-policy¶

Description¶

Set the authentication policy for the account. Any parameters not specified in the request will be cleared, and their default values will be used for authentication. Changes to the authentication policy only affect authentications that are done after the policy has been updated.

Synopsis¶

  set-authentication-policy
[--access-key-inactivity-duration-sec <value>]
[--access-key-expiration-sec <value>]
[--session-token-inactivity-duration-sec <value>]
[--session-token-expiration-sec <value>]
[--workload-auth-token-expiration-sec <value>]
[--client-ip-addresses-allowed <value>]
[--client-ip-addresses-blocked <value>]
[--allowed-workload-subdomains <value>]
[--cli-input-json <value>]
[--generate-cli-skeleton]

Options¶

--access-key-inactivity-duration-sec (integer)

The duration of inactivity (in seconds) required to invalidate the access key. Set to 0 or leave unset to use the system’s default inactivity duration (typically 1 hour, or 15 minutes for Cloudera for Government). If set to a value greater than the value for accessKeyExpirationSec, the inactivity timeout is effectively disabled.

--access-key-expiration-sec (integer)

The lifespan (in seconds) of the access key. Set to 0 or leave unset to use the system default (12 hours for CDP).

--session-token-inactivity-duration-sec (integer)

The duration of inactivity (in seconds) required to invalidate the UI session token. Set to 0 or leave unset to use the system default (typically 1 hour, or 15 minutes for Cloudera for Government). If set to a value greater than the value for sessionTokenExpirationSec, the inactivity timeout is effectively disabled.

--session-token-expiration-sec (integer)

The lifespan (in seconds) of the UI session token. Set to 0 or leave unset to use the system default (12 hours for CDP).

--workload-auth-token-expiration-sec (integer)

The lifespan (in seconds) of the workload authentication token. Set to 0 or leave unset to use the system default (1 hour for CDP).

--client-ip-addresses-allowed (array)

The list of IP addresses and/or CIDRs used for allowing client access to the UI and API services. Duplicated values will be removed automatically. Both the allowed list and the blocked list will be used to determine whether to grant or block the client’s access. The blocked list takes precedence over the allowed list. When the list is empty or not set, client IP address will not be validated to be present in the allowed list.

Syntax:

"string" "string" ...

--client-ip-addresses-blocked (array)

The list of IP addresses and/or CIDRs used for blocking client access to the UI and API services. Duplicated values will be removed automatically. Both the allowed list and the blocked list will be used to determine whether to grant or block the client’s access. The blocked list takes precedence over the allowed list. When the list is empty or not set, client IP address will not be validated to be absent from the blocked list.

Syntax:

"string" "string" ...

--allowed-workload-subdomains (array)

The list of allowed domains from which a workload-initiated SSO is allowed. Setting it will allow workload-initiated SSO from these domains as well as Cloudera’s default workload domains.

Syntax:

"string" "string" ...

--cli-input-json (string)

Performs service operation based on the JSON string provided. The JSON string follows the format provided by --generate-cli-skeleton. If other arguments are provided on the command line, the CLI values will override the JSON-provided values.

--generate-cli-skeleton (boolean)

Prints a sample input JSON to standard output. Note the specified operation is not run if this argument is specified. The sample input can be used as an argument for --cli-input-json.

Output¶

Form Factors¶

public, private