Skip to content

Allow or forbid algorithms

Decide which algorithms a tenant may create keys with, import and rotate to, by giving the tenant an algorithm availability template of its own or by letting it follow the deployment policy.

Who can do it

A platform super administrator. Two decisions make up the task, and only the platform super administrator holds both: whether the tenant may choose its own policies, and which template the tenant carries.

A tenant administrator or tenant key manager holds the permission to apply and reset templates on the tenant's own Policies screen, but the server admits it only after the platform super administrator has let the tenant change its policies. Until then the tenant's Algorithm Availability card still offers Change template, and applying is refused with You don't have permission to perform this action. Follow deployment policy is not offered at all. A tenant member without the write permission sees the card read-only, with This policy is managed by your platform administrator. Contact them to request changes.

Before you start

  • The deployment has an algorithm availability policy. A tenant policy can never admit an algorithm the deployment policy does not admit.
  • Decide who will choose the template: you, for the tenant, or the tenant's own administrators.
  • The template catalog is fixed: you choose a template, you do not write a policy by hand.

Steps

  1. To let the tenant's administrators choose their own template, or to stop them:
    1. Open Tenants and select the tenant's name to open its detail.
    2. On the Details tab, in Policies, turn Let the tenant admin change these policies on or off. The switch covers the algorithm policy, the rotation policy and the rotation schedule together.
  2. To assign a template to the tenant yourself:
    1. Open Platform Policies, tab Policies, and find the tenant in Per-Tenant Policies.
    2. Select the tenant's cell in the Algorithm column. The cell is a button only while the tenant holds a policy of its own; a tenant that follows the deployment policy shows a badge instead. Turning on the switch in step 1 gives the tenant a policy of its own that follows the deployment.
    3. In Select Algorithm Availability template, select a template card. Preview details shows its full content, and Currently applied marks the template in effect.
    4. Select Apply. It is enabled only once you select a template other than the current one.
  3. Once the tenant may change its policies, a tenant administrator or key manager does the same from the tenant's side: open Policies, select Change template on the Algorithm Availability card, choose a template and select Apply. Follow deployment policy on the same card gives up the tenant's own template.

What you see when it worked

  • The switch confirms Override setting updated, or No change — the setting was already that way.
  • Applying a template closes the dialog with Algorithm policy updated, and the cell or card names the new template.
  • Following the deployment policy reports which policy the tenant now follows: the deployment's template by name, or the deployment's custom policy.

The next key creation, import or rotation in the tenant is checked against the new policy. Keys and data that already exist are not changed; the Conformance column of the tenant's key inventory marks keys whose algorithm the policy no longer admits.

When quorum approval gates the change, nothing changes yet: the console shows Waiting for approval with a link to the request, and the change runs once the request is approved.

If it fails

What you see Cause What to do
You don't have permission to perform this action. on the tenant's Policies screen The platform super administrator has not let the tenant change its policies, or the person lacks the write permission A platform super administrator turns on the switch, or assigns the template from Platform Policies
You do not have permission to change this setting. beside the switch You are not a platform super administrator Ask a platform super administrator
Policy violates deployment subset on: … The template admits algorithms or values the deployment policy does not Choose a narrower template, or widen the deployment policy first
The switch is refused because there is no deployment policy to follow The installation has no active deployment algorithm policy Set the deployment policy on Platform Policies, then retry
Could not load templates You lack the permission to read policy templates Ask for a role that holds it
Waiting for approval Quorum approval gates this change The request runs once its approvers approve it

Without the console

Surface How
Key management CLI No command
Admin SDK Not available
API PATCH /api/v3/admin/tenants/{tenantId}/policies/override-flag with allowsTenantOverride (operation patchOverrideFlag); PUT /api/v3/admin/tenants/{tenantId}/policies/algorithm-availability with templateId (operation setAlgorithmPolicy); DELETE /api/v3/admin/tenants/{tenantId}/policies/algorithm-availability to follow the deployment policy (operation deleteAlgorithmPolicy)