Secret Templates permission issue

[chrisallennc]

We're currently working on switching over from using the SOAP API/in-house built PowerShell module to the REST API/this module and run into an issue. When attempting to create a secret we need to get the template to provide the ID. Using "Search-TssSecretTemplate" as shown in the example we get "{ "errorCode": "API_AccessDenied", "message": "Access Denied" }". Using "Invoke-WebRequest "$secretServerUrl/winauthwebservices/api/v1/secret-templates" yields the same error.

The SOAP API function "GetSecretTemplates" returns the templates without error. This is going to the same server with same user and both using Windows Authentication.

If I directly provide the template ID it'll return the template. "Get-TssSecretTemplate -TssSession $tssSession -id 6034" runs without error. But that's not really scalable since we have quite a few templates as the IDs can change between environments but the name always stays the same. Also our users are used to referring to the templates by name.

Is there an additional permission the user needs inside the application? Or perhaps is this a bug with permissions not being properly applied?

[wsmelton]

Are you limiting permissions for Secret Templates?

Meaning, did you modify the Everyone group to not have permission to all templates:

[chrisallennc]

I checked with our application admin and they confirmed that our permissions are what your screenshot shows. Should we file a ticket with support?

[wsmelton]

Other thing to verify is your role assigned for the account used on the module session, needs View Secret Templates as a minimum.

[chrisallennc]

I'm checking that now and will let you know. I would assume so because my account can enumerate them through the SOAP API. And I can choose the template from a list of template names on the GUI when creating a secret.

[chrisallennc]

This was resolved by granting View Secret Templates to the role assigned, thanks!