Access Key Authentication - IBM Aspera HST Admin Manual

Access Key Authentication

Access key authentication provides an alternative to entering the security credentials of a Node API user or system
user. Because an access key is restricted to its own storage (local or cloud), it allows access control and usage
reporting to be segregated by storage. This offers significant benefits to multi-tenant service providers and enterprise
installations with multiple departments.
Access Key Support:
Access key authentication can by used by Aspera client products such as IBM Aspera Desktop Client, HST Server,
HST Endpoint, and IBM Aspera Drive. It can also be used by IBM Aspera Faspex, IBM Aspera Shares, and AIBM
Aspera on Cloud transfer service. For details about using access key authentication with these products, see their
documentation.
Access Key Restrictions:
• The transfer user must have a file restriction configured in aspera.conf, rather than a docroot. If a docroot is
configured, access key creation and use fails.
• Access keys must specify the storage path. Although they can be created with no storage specified, transfers using
these keys fail.
Access Key Creation:
1. Configure the system user with a restriction and ensure that no docroot is configured:
# asconfigurator -x
"set_user_data;user_name,username;absolute,AS_NULL;file_restriction,|restriction"
The format of the restriction depends on the storage type (these examples allow access to the entire storage):
Storage Type
local storage
Amazon S3 and IBM Cloud Object Storage - S3
Azure
Azure Files
Azure Data Lake Storage
Alibaba Cloud
Google Cloud
HDFS
For example, to configure the system user xfer with a restriction that allows full access to local storage:
# asconfigurator -x
"set_user_data;user_name,xfer;absolute,AS_NULL;file_restriction,|
file:////*"
Format Example
For Unix-like OS:
• specific folder: file:////folder/*
• drive root: file:////*
For Windows OS:
• specific folder: file:///c%3A/folder/*
• drive root: file:///c*
s3://*
azu://*
azure-files://*
adl://*
oss://*
gs://*
hdfs://*
| Authentication and Authorization | 296