How to change MCApiUser 's email setting

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

On PAM Client:

We want to change the user account 'MCApiUser' 's email, but when we try to do that, we got error message as below:

"PAM-CMN-4814: The PAM Management Console API User may not have its role changed."

 

Environment

Release : All versions

Component : PRIVILEGED ACCESS MANAGEMENT

Resolution

Unfortunately, we cannot change the account email address on PAM Client directly.

However, we can change the account email address using REST API.

The steps are as follows.

API key name(apiadm) is a sample name.

[STEPS]

- login to PAM server via PAM Clientusing super user

- [Configuration]->[Security]->[Access]

  External TEST API : Enabled

- close PAM client(logoff)

- login to PAM server via PAM Client again

- [Settings]

  "API doc" menu will be showed.

- Prepare API user

  [Users]->[Manage Users]

  select "super" user and click "Update".

  clikc "API key" tab.

  add an API key by selecting the plus sign (+) in the API Keys row.

  specify a name for the API key. The name cannot contain white space.

  a checkbox across from the key name is selected, indicating the key is active.

- check the API user(apiadm)

  [Credentials]->[Manage Targets]->[Target Accounts]

  you will see "apiadm-1" and click "Update".

  set the password

- check MCApiUser's UID

  [Settings]->[API doc]

  select "USERS"

  select "GET /api.php/v1/users.json".

  click "Try it out!" under the screen.

  User name : apiadm-1

  Password : XXXX(the password which you set)

  from Response Body, search "MCApiUser".

  {

      "userId": "1001",

      "userName": "MCApiUser",

- update the email address

  select "PUT /api.php/v1/users.json".

  [Parameters]->[body]

  remove all contents and copy the following contents.

  {

    "userId": "1001",

    "email": "XXX@XXXXXXX"

  }

  userId field is MCApiUser's UID

  set new email address in email": "XXX@XXXXXXX".

  click "Try it out!" under the screen.

- check if the new email address is defined.

That's all.