Change Service Account Role

Coverity on Polaris
Version
latest
You can assign a new role to an existing service account whenever it makes sense to do so.

About Service Accounts

Every service account has a specific purpose and the necessary permissions. The most common use cases are:

  • A management account that can create, update and delete other service accounts.
  • A project management account that has the ability to create projects.
  • A view-only account that can read reports and issue metrics These accounts are being controlled by servers without human interaction.

A service account functions like any other user account in Coverity on Polaris. It can be assigned any role (administrator or contributor) on an organization or project and can perform role-appropriate actions in Coverity on Polaris using an API.

Using PATCH versus POST to Update

When updating the roles on a service account:

  1. Send a GET request first, to determine whether the service account has a role in the project using GET /api/auth/v1/role-assignments.
  2. If the account does not have a role in the project, you can create one with a POST request.
  3. If the account already has a role, you can change it with a PATCH request.

Common errors in this process include trying to create a new role with a PATCH and trying to update a role assignment with a POST. Both of these can happen if the service account already has a role in the project and you're not aware of it.

The Process for Updating a Role Assignment


Process for updating a role assignment.
  1. Get the service account.

    Request: 

    
   GET /api/auth/v1/users?filter[users][automated]=true

    Response:

    
    {
       "data": {
            "type": "users",
            "attributes": {
                    "email": "example@example.com",
                    "name": "CI Pipeline",
                    "username": "ci_pipeline",
                    "enabled": true,
                    "password-login": {
                    "password": "hunter2"
                    },
                    "automated": true,
                    "ip-whitelist": [
                    "0.0.0.0/0",
                    "::/0"
                    ]
                    },
                    "relationships": {
                    "organization": {
                    "data": {
                    "type": "organizations",
                    "id": "02d7dnqcs52f7eiptpjinp8gis"
                  }
              }
          }
       }
    }
  2. Retrieve all roles.

    Request:

    
  GET /api/auth/v1/roles

    Response: 

    
                        {
   "data": [
       {
       "type": "roles",
       "id": "ba47qfjl192or34fofmebc9ams",
         "attributes": {
            "permissions": {
               "ORGANIZATION": [
               "users.read",
               "groups.read"
               ],
                "PROJECT": [
                "projects.read"
                ]
            },
         "rolename": "Contributor"
         },
       "relationships": {},
          "links": {
          "self": {
          "href": "https://subdomain.cop.blackduck.com/api
          /auth/latest/roles/ba47qfjl192or34fofmebc9ams"
          }
          }
       },
       {
       "type": "roles",
       "id": "3iv42qg2u48uhek91ravh7rhhc",
         "attributes": {
            "permissions": {
               "ORGANIZATION": [
               "administer",
               "users.read",
               "users.readPrivate",
               "users.write",
               "groups.read",
               "groups.write",
               "projects.create"
               ],
                "PROJECT": [
                "administer",
                "projects.read",
                "projects.write"
                ]
            },
         "rolename": "Administrator"
         },
       "relationships": {},
          "links": {
           "self": {
           "href": "https://subdomain.cop.blackduck.com/api
           /auth/latest/roles/3iv42qg2u48uhek91ravh7rhhc"
           }
          }
       },
       {
       "type": "roles",
       "id": "61lbviubjl7un4pis7f0c62it8",
         "attributes": {
            "permissions": {
               "ORGANIZATION": [
               "users.read",
               "groups.read",
               "projects.create"
               ],
                "PROJECT": [
                "projects.read",
                "projects.write"
                ]
            },
         "rolename": "Contributor"
         },
       "relationships": {},
          "links": {
           "self": {
           "href": "https://subdomain.cop.blackduck.com/api
           /auth/latest/roles/61lbviubjl7un4pis7f0c62it8"
           }
          }
       }
],
"included": [ ]
}
  3. Retrieve role assignments.

    Request:

    
GET /api/auth/v1/role-assignments?filter[role-assignments][user][automated]=true

   {
       "data": {
       "type": "role-assignments",
         "attributes": {
         "expires-by": null,
         "object": "urn:x-swip:organizations:
         02d7dnqcs52f7eiptpjinp8gis"
         },
          "relationships": {
           "role": {
               "data": {
               "type": "roles",
               "id": "3iv42qg2u48uhek91ravh7rhhc"
               }
           },
           "user": {
               "data": {
               "type": "users",
               "id": "92h1av03nd27h5k5kskk8fq8og"
               }
           },
           "organization": {
               "data": {
               "type": "organizations",
               "id": "02d7dnqcs52f7eiptpjinp8gis"
               }
           }
          }
       }
}

  4. Update the existing role assignment.

    Request:

    
    PATCH /api/auth/v1/role-assignments/3iv42qg2u48uhek91ravh7rhhc

{
   "data": {
   "type": "role-assignments",
     "attributes": {
     "expires-by": null,
     "object": "urn:x-swip:organizations:
     02d7dnqcs52f7eiptpjinp8gis"
     },
      "relationships": {
       "role": {
           "data": {
           "type": "roles",
           "id": "3iv42qg2u48uhek91ravh7rhhc"
           }
       },
       "user": {
           "data": {
           "type": "users",
           "id": "92h1av03nd27h5k5kskk8fq8og"
           }
       },
       "organization": {
           "data": {
           "type": "organizations",
           "id": "02d7dnqcs52f7eiptpjinp8gis"
           }
       }
      }
}
}