Use shareKey to grant another Cryptographic User (CU) access to one of your keys, or to revoke that access.
Only the key owner can share and unshare a key. Keys can also be shared during key creation.
Before running this command, start hsm_mgmt_tool and log in to the HSM. The logged-in user must be a Cryptographic User (CU).
Prerequisites
Before you begin, ensure that you have:
Started
hsm_mgmt_toolLogged in to the HSM as a Cryptographic User (CU)
User type
Only the following user type can run this command. For details, see HSM User Permission Table.
Cryptographic User (CU)
Syntax
shareKey <key handle> <user id> <(share/unshare key?) 1/0>This command has no named parameters, so enter arguments in the exact order shown.
Parameters
| Parameter | Description | Required | Valid values |
|---|---|---|---|
<key handle> | Key handle | Yes | No special requirements |
<user id> | User ID | Yes | No special requirements |
<(share/unshare key?) 1/0> | Whether to share the key | Yes | 1 — share; 0 — unshare |
Examples
The following examples show how to share and unshare a key.
Share a key
List HSM users with the listUsers command to find the target user ID.
cloudmgmt>listUsers Users on server 0(172.16.0.2): Number of users found:4 User Id User Type User Name MofnPubKey LoginFailureCnt 2FA 1 CO admin NO 0 NO 2 AU app_user NO 0 NO 3 CU crypto_user NO 0 NO 4 CU crypto_user1 NO 0 NOLog in to the HSM as a Cryptographic User with loginHSM.
cloudmgmt>loginHSM CU crypto_user user123 loginHSM success on server 0(172.16.0.2)Share key 6 with
crypto_user1(user ID 4).cloudmgmt>shareKey 6 4 1 *************************CAUTION******************************** This is a CRITICAL operation, should be done on all nodes in the cluster. Cav server does NOT synchronize these changes with the nodes on which this operation is not executed or failed, please ensure this operation is executed on all nodes in the cluster. **************************************************************** Do you want to continue(y/n)?y shareKey success on server 0(172.16.0.2)ImportantThis is a critical operation. Run it on every node in the cluster. The server does not synchronize the change to nodes where the operation was not run or failed.
Unshare a key
To revoke crypto_user1's access to key 6, run shareKey with the same arguments but set the last parameter to 0.
cloudmgmt>shareKey 6 4 0
*************************CAUTION********************************
This is a CRITICAL operation, should be done on all nodes in the
cluster. Cav server does NOT synchronize these changes with the
nodes on which this operation is not executed or failed, please
ensure this operation is executed on all nodes in the cluster.
****************************************************************
Do you want to continue(y/n)?y
shareKey success on server 0(172.16.0.2)This is a critical operation. Run it on every node in the cluster. The server does not synchronize the change to nodes where the operation was not run or failed.