StrongDM

https://docs.strongdm.com/
Admin
StrongDM is a Zero Trust Privileged Access Management (PAM) platform that extends the capabilities...
Tokens:688,769
Snippets:6,630
Trust Score:7.5
Update:3 months ago
Show doc for...
Tokens:
Raw
### Install Netcat

Source: https://docs.strongdm.com/admin/resources/datasources/amazon-es-iam.md

Example command for installing the Netcat package on systems using apt-get.

```bash
apt-get install netcat
```

--------------------------------

### Complete Post-Install Setup

Source: https://docs.strongdm.com/users/client/windows.md

Run the post-install command to finalize the setup based on the installation scope.

```bash
"C:\Program Files\SDM\resources\sdm.exe" system desktop post-install
```

```bash
"%LOCALAPPDATA%\Programs\SDM\resources\sdm.exe" system desktop post-install
```

--------------------------------

### Successful Installation Output

Source: https://docs.strongdm.com/admin/principals/service-accounts.md

Example output confirming the completion of the StrongDM listener installation.

```powershell
Installing StrongDM listener

paste the token and press ENTER:
eyJhbGciOiJ...

installation path [C:\Program Files (x86)\StrongDM]:

data path [C:\WINDOWS\system32\config\systemprofile\AppData\Local\StrongDM]:

Copying files
Installation complete
Service installed and started
```

--------------------------------

### Install and Start Splunk Universal Forwarder

Source: https://docs.strongdm.com/admin/audit/logs/scenarios/export-to-splunk.md

Downloads and installs the Splunk universal forwarder on a Linux system and initializes the service.

```bash
wget -O splunkforwarder-8.1.3-63079c59e632-linux-2.6-x86_64.rpm 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=8.1.3&product=universalforwarder&filename=splunkforwarder-8.1.3-63079c59e632-linux-2.6-x86_64.rpm&wget=true'
sudo rpm -ihv splunkforwarder-8.1.3-63079c59e632-linux-2.6-x86_64.rpm
export PATH=$PATH:/opt/splunkforwarder/bin
splunk start
```

--------------------------------

### Unzip and Install CLI

Source: https://docs.strongdm.com/users/client/linux.md

Extract the downloaded archive and run the installation command with sudo privileges.

```sh
unzip sdmcli_<VERSION_NUMBER>_linux_amd64.zip
```

```sh
sudo ./sdm install --app-domain app.strongdm.com
```

--------------------------------

### Install StrongDM CLI

Source: https://docs.strongdm.com/users/client/linux.md

Execute the installation command with sudo privileges to set up the StrongDM binary.

```sh
sudo ./sdm install --app-domain app.strongdm.com
```

--------------------------------

### Install StrongDM Gateway

Source: https://docs.strongdm.com/admin/deployment/quickstart.md

Runs the installer to register the gateway. The installation token will be requested during execution.

```bash
sudo ./sdm install --app-domain app.uk.strongdm.com --node
```

```bash
sudo ./sdm install --app-domain app.eu.strongdm.com --node
```

--------------------------------

### Install StrongDM via Command Prompt

Source: https://docs.strongdm.com/users/client/windows.md

Run the EXE installer directly from the command line.

```bash
SDM-21.58.0.exe
```

--------------------------------

### Install StrongDM Listener

Source: https://docs.strongdm.com/admin/principals/service-accounts.md

Initial prompt displayed when running the installer to input the service account token.

```powershell
Installing StrongDM listener
- paste the token and press ENTER:
```

--------------------------------

### Uninstall Output Example

Source: https://docs.strongdm.com/admin/principals/service-accounts.md

Example output generated during the uninstallation process.

```powershell
sdm32.exe uninstall
 
preparing to uninstall ...
uninstalling StrongDM listener
uninstall failed, see sdm-uninstall-1594851455.log for details
press enter to close...
```

--------------------------------

### VNM Configuration Output Example

Source: https://docs.strongdm.com/admin/clients/client-networking/virtual-networking-mode.md

Example output showing device and network configuration settings after a successful VNM update.

```text
Device Configuration:
- VNM Device IP:       100.127.255.254
- VNM Device Netmask:  255.192.0.0
- VNM Virtual DNS:     100.127.255.253:53

Network Configuration:
- Subnet:               100.64.0.0/10
- Subnet Broadcast IP:  100.127.255.255
- First Available IP:   100.64.0.1
- Last Available IP:    100.127.255.252
- Total Available IPs:  4194300
- Default to VNM:       true
```

--------------------------------

### Install StrongDM via PKG with Admin Privileges

Source: https://docs.strongdm.com/users/client/macos.md

Use the installer command to perform a system-wide installation, which is required to enable Virtual Networking Mode.

```bash
sudo installer -pkg SDM-21.58.0.universal.pkg -target /
```

--------------------------------

### Example kubectl configuration file

Source: https://docs.strongdm.com/users/connect/connect-kubernetes.md

A complete example of a kubectl configuration file configured for two StrongDM-managed clusters.

```yaml
apiVersion: v1
clusters:
- cluster:
  server: http://localhost:<port1>
  name: sdm-k8s-1
- cluster:
  server: http://localhost:<port2>
  name: sdm-k8s-2
contexts:
- context:
  cluster: sdm-k8s-1
  user: sdm-user
  name: StrongDM Kubernetes 1
- context:
  cluster: sdm-k8s-2
  user: sdm-user
  name: StrongDM Kubernetes 2
current-context: StrongDM Kubernetes 1
kind: Config
preferences: {}
users:
- name: sdm-user
  user: {}
```

--------------------------------

### Install StrongDM Gateway via Shell

Source: https://docs.strongdm.com/admin/deployment/scenarios/cloudformation.md

Commands to download, configure, and install the StrongDM binary on a Linux instance.

```bash
curl -J -O -L https://app.strongdm.com/releases/cli/linux && unzip sdmcli* && rm sdmcli*
# Generate a gateway token
export SDM_RELAY_TOKEN="$(./sdm --admin-token=${SDMAdminToken} relay create-gateway --name $SDM_GATEWAY_NAME $SDM_HOSTNAME:$SDM_LISTEN_PORT 0.0.0.0:$SDM_LISTEN_PORT)"
chown -R ec2-user:ec2-user /home/ec2-user/.sdm
# Install SDM
./sdm install --node --token=$SDM_RELAY_TOKEN --user $TARGET_USER
```

--------------------------------

### Full automation script example

Source: https://docs.strongdm.com/admin/clients/docker-clients.md

A complete script demonstrating container startup, readiness checks, database execution, and termination.

```bash
#!/usr/bin/env bash

# Start StrongDM Service Client Docker Image
/usr/bin/docker run -d \
      --name=strongdm \
      --rm \
      -p 15432:15432 \
      -e SDM_SERVICE_TOKEN=service_account_token \
      public.ecr.aws/strongdm/client:latest

# Wait for StrongDM client binary to be available
until docker exec -it strongdm sdm status &>/dev/null;
do
  sleep 1
done

# Wait for datasource connection to be ready
until psql -l -h 127.0.0.1 -p 15432  &>/dev/null;
do
  sleep 1
done

# Execute database operation
psql -h 127.0.0.1 -p 15432 <<EOF >> /var/log/etl.log
SELECT first_name,
      last_name
FROM   users u
WHERE  u.created_at > current_date - '1 day'::interval;
EOF

# Terminate container
docker kill strongdm
```

--------------------------------

### Get Group Request

Source: https://docs.strongdm.com/references/scim/groups/get.md

Example of a GET request to retrieve a specific group by its ID.

```http
GET app.strongdm.com/provisioning/generic/v2/Groups/r-0d6247fd617197d8
```

--------------------------------

### List Groups Request Examples

Source: https://docs.strongdm.com/references/scim/groups/list.md

Examples of GET requests to the SCIM Groups endpoint with and without filtering.

```http
GET app.strongdm.com/provisioning/generic/v2/Groups?filter=displayName%20eq%20%22myRole%22
```

```http
GET app.strongdm.com/provisioning/generic/v2/Groups?startIndex=1&count=5
```

--------------------------------

### GET /admin/deployment/quickstart.md

Source: https://docs.strongdm.com/admin/deployment/quickstart.md

Queries the documentation for specific information using a natural language question and an optional goal.

```APIDOC
## GET /admin/deployment/quickstart.md

### Description
Performs a dynamic query against the documentation to retrieve answers and relevant excerpts based on a provided question.

### Method
GET

### Endpoint
https://docs.strongdm.com/admin/deployment/quickstart.md

### Parameters
#### Query Parameters
- **ask** (string) - Required - The specific, self-contained natural language question.
- **goal** (string) - Optional - The broader end goal to help tailor the response.

### Response
#### Success Response (200)
- **answer** (string) - A direct answer to the question.
- **excerpts** (array) - Relevant excerpts and sources from the documentation.
```

--------------------------------

### List Users Request Examples

Source: https://docs.strongdm.com/references/scim/users/list.md

Examples of GET requests to the SCIM Users endpoint with and without filtering parameters.

```http
GET app.strongdm.com/provisioning/generic/v2/Users?filter=userName%20eq%20%22myUser@example.test%22
```

```http
GET app.strongdm.com/provisioning/generic/v2/Users?startIndex=0&count=1
```

--------------------------------

### Get User Request

Source: https://docs.strongdm.com/references/scim/users/get.md

Example request to retrieve details for a specific user ID.

```http
GET app.strongdm.com/provisioning/generic/v2/Users/a-05bcc36061716682
```

--------------------------------

### Get Group Not Found Response

Source: https://docs.strongdm.com/references/scim/groups/get.md

Example of a 404 error response when the requested group ID does not exist.

```json
{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "detail": "Resource r-0910a0945 not found.",
  "status": "404"
}
```

--------------------------------

### Add Website Resources via CLI

Source: https://docs.strongdm.com/admin/resources/websites.md

Examples of adding HTTP, HTTP Basic Auth, and HTTP Custom Auth websites using the CLI.

```sh
# Add an HTTP Website (no authentication)
sdm admin websites add http "intranet-http"
  --base-url "http://intranet.acme.internal"
  --bind-interface "default"
  --port-override -1
  --egress-filter 'field:name tag:env=prod tag:region=us-west'
  --tags "env=prod,protocol=http,team=infra"
  --timeout 30

# Add an HTTP Basic Auth Website
sdm admin websites add http-basic "admin-http-basic"
  --base-url "https://admin.acme.internal"
  --username "webadmin"
  --password "StrongPassword123!"
  --bind-interface "default"
  --port-override -1
  --proxy-cluster-id "plc_0123456789abcdef"
  --tags "env=prod,protocol=https,auth=basic,team=web"
  --timeout 30

# Add an HTTP Custom Auth Website
sdm admin websites add http-header-auth "api-http-custom"
  --base-url "https://api.acme.internal"
  --headers "Authorization: Bearer abcd1234efgh5678"
  --bind-interface "default"
  --port-override -1
  --egress-filter 'field:name tag:env=prod tag:region=us-west'
  --secret-store-id "ss_abcdef0123456789"
  --tags "env=prod,protocol=https,auth=header,team=api"
  --timeout 30
```

--------------------------------

### Get Group Success Response

Source: https://docs.strongdm.com/references/scim/groups/get.md

Example of a successful 200 OK response containing group details.

```http
(Status 200)
```

```json
{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Group"],
  "displayName": "Role",
  "id": "r-0d6247fd617197d8",
  "members": [],
  "meta": { "resourceType": "Group", "location": "Groups/r-0d6247fd617197d8" }
}
```

--------------------------------

### Get User Success Response

Source: https://docs.strongdm.com/references/scim/users/get.md

Example JSON response body returned upon a successful user retrieval.

```http
(Status 200)
```

```json
{
  "active": true,
  "displayName": "Firstname Lastname",
  "emails": [
    {
      "primary": true,
      "value": "myUser@example.test"
    }
  ],
  "groups": [
    {
      "$ref": "/Groups/aa-3d0d6e0d61716682",
      "value": "aa-3d0d6e0d61716682"
    }
  ],
  "id": "a-05bcc36061716682",
  "meta": {
    "resourceType": "User",
    "location": "Users/a-05bcc36061716682"
  },
  "name": {
    "familyName": "Lastname",
    "formatted": "Firstname Lastname",
    "givenName": "Firstname"
  },
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User"
  ],
  "userName": "myUser@example.test",
  "userType": "user"
}
```

--------------------------------

### GET /admin/clients/managed-installation.md

Source: https://docs.strongdm.com/admin/clients/managed-installation.md

Queries the documentation dynamically by providing a question and an optional goal to receive a tailored response.

```APIDOC
## GET /admin/clients/managed-installation.md

### Description
Queries the documentation dynamically to retrieve answers, excerpts, and sources based on a specific question and an optional end goal.

### Method
GET

### Endpoint
https://docs.strongdm.com/admin/clients/managed-installation.md

### Parameters
#### Query Parameters
- **ask** (string) - Required - The immediate question to ask, written in natural language.
- **goal** (string) - Optional - Describes the broader end goal to help tailor the response.

### Response
#### Success Response (200)
- **answer** (string) - A direct answer to the question.
- **excerpts** (array) - Relevant excerpts from the documentation.
- **sources** (array) - Sources used to generate the answer.
```

--------------------------------

### Start a session with the CLI

Source: https://docs.strongdm.com/admin/resources/datasources/sybase-ase.md

Initiate a connection to the specified Sybase ASE resource using the StrongDM CLI.

```bash
sdm connect sybase-prod
```

--------------------------------

### Identify Queries in JSON Format

Source: https://docs.strongdm.com/admin/audit/logs/node-log-files.md

Example of a start event log entry formatted as JSON containing query information.

```json
{
  "type": "start",
  "timestamp": "2023-01-01T13:14:15.820199164Z",
  "uuid": "01a2B3cd4Efghi567jKlMnop8qRs",
  "datasourceId": "rs-123a45678910b123",
  "datasourceName": "cli_example mysql",
  "userId": "a-0a12b34c567d89d1",
  "userName": "Jane Admin",
  "query": "/* ApplicationName=DBeaver 7.3.5 - Metadata */ SELECT * FROM information_schema.COLUMNS WHERE TABLE_SCHEMA='mysql' AND TABLE_NAME='db' ORDER BY ORDINAL_POSITION",
  "hash": "1234a56b7c891dab012ef3456g78h9i1jk2l3m45"
}
```

--------------------------------

### View Website CLI Help

Source: https://docs.strongdm.com/admin/resources/websites.md

Displays the available commands and options for adding website resources.

```sh
NAME:
   sdm admin websites add - add one or more websites

USAGE:
   sdm admin websites add command [command options] [arguments...]

COMMANDS:
   http, httpNoAuth, http-no-auth    create HTTP website
   http-basic, httpBasic, basicauth  create HTTP Basic Auth website
   http-header-auth, headerauth      create HTTP Custom Auth website

OPTIONS:
   --file value, -f value  load from a JSON file
   --stdin, -i             load from stdin
   --timeout value         set time limit for command
   --help, -h              show help
```

--------------------------------

### Identify Queries in CSV Format

Source: https://docs.strongdm.com/admin/audit/logs/node-log-files.md

Example of a start event log entry formatted as CSV containing query information.

```plaintext
`2023-03-23 18:10:54.265186636 +0000 UTC,start,af9e303c-07f7-42ee-84c4-279ca7b9de28,1333,psql-server-6,1016,Joe Admin,"SELECT name, setting FROM pg_settings WHERE source = 'session';",dc1952385fab5663c36c17579337686e71d6145f`
```

--------------------------------

### CLI Minimum Supported Version Warning

Source: https://docs.strongdm.com/users/client/version.md

Example of the warning message displayed in the CLI when the installed version is below the minimum supported threshold.

```text
Warning: sdm-cli software version <VERSION> is beneath the minimum supported version 33.17.0

Call 'sdm update' or redownload the software to address this. Some functionality may fail while not up to date
```

--------------------------------

### Create HTTP website command options

Source: https://docs.strongdm.com/references/cli/admin/websites/add.md

Configuration options for creating a standard HTTP website.

```shell
NAME:
   sdm admin websites add http - create HTTP website

USAGE:
   sdm admin websites add http [command options] <name>

OPTIONS:
   --bind-interface value     IP address on which to listen for connections to this resource on clients. Specify "default", "loopback", or "vnm" to automatically allocate an available address from the corresponding IP range configured in the organization. (default: "default")
   --default-path value       Automatically redirect to this path upon connecting.
   --egress-filter value      apply filter to select egress nodes e.g. 'field:name tag:key=value ...'
   --header value             Additional HTTP header to include in requests.
   --headers-exclusion value  Enter the header name (e.g. Authorization), and its contents will be omitted from logs.
   --health-path value        This path will be used to check the health of your site. (required)
   --host-override value      The host header will be overwritten with this field.
   --http-subdomain value     This will be used as your local DNS address. (e.g. app-prod1 would turn into http://app-prod1.<your-org-name>.sdm.network/) (required)
   --no-enforce-https         Client connections will use HTTPS instead of HTTP (disable)
   --port-override value      Port on which to listen for connections to this resource on clients. Specify "-1" to automatically allocate an available port. (default: -1)
   --proxy-cluster-id value   proxy cluster id
   --secret-header value      Additional HTTP header to include in requests. (secret)
   --secret-store-id value    secret store id
   --tags value               tags e.g. 'key=value,...'
   --template, -t             display a JSON template
   --timeout value            set time limit for command
   --url value                The base address of your website without the path. (required)
```

--------------------------------

### Locate Capture ID in Log Files

Source: https://docs.strongdm.com/admin/audit/logs/node-log-files.md

Example of a start event log entry containing a capture ID within a JSON object.

```plaintext
2023-03-23 18:10:02.970395873 +0000 UTC,start,9d880e13-f608-4fe0-b1e7-deeb35bb9f2c,1334,prod-312-test,1016,Joe Admin,"{ ""version"":1,""width"":92,""height"":25,""duration"":0,""command"":"""",""title"":null,""env"":{ ""TERM"":""xterm-256color""},""type"":""shell"",""fileName"":null,""fileSize"":0,""stdout"":null,""lastChunkId"":0}`
```

--------------------------------

### CLI Minimum Required Version Error

Source: https://docs.strongdm.com/users/client/version.md

Example of the error message displayed in the CLI when the installed version is below the organization's minimum required version.

```text
Your SDM version <VERSION> is beneath your team's minimum required version: <REQUIRED_VERSION>. Please update to proceed.
```

--------------------------------

### Entrypoint Script for StrongDM

Source: https://docs.strongdm.com/admin/clients/docker-clients.md

Initializes the StrongDM client, updates it, and starts the listener daemon.

```bash
#!/bin/sh

# logs into sdm
sdm login

# updates to latest release
sdm update

# starts listener manually
sdm listen --daemon &

# attempts sdm status until successful
until sdm status &> /dev/null;
do
  sleep 1
  echo "waiting for SDM to start"
done

/path/to/original/entrypoint
```

--------------------------------

### Example docker ps output

Source: https://docs.strongdm.com/admin/clients/docker-clients.md

Sample output showing container IDs and port mappings.

```text
CONTAINER ID        IMAGE                              PORTS
551cc9c06734        public.ecr.aws/strongdm/client     127.0.0.1:13307->13307/tcp
```

```text
CONTAINER ID        IMAGE                              PORTS
551cc9c06734        public.ecr.aws/strongdm/client     127.0.0.1:30572->30572/tcp
```

--------------------------------

### Unzip Installation Package

Source: https://docs.strongdm.com/users/client/linux.md

Extract the contents of the downloaded zip file before running the installer.

```sh
unzip sdmcli_<VERSION_NUMBER>_linux_amd64.zip
```

--------------------------------

### Install sdm-proxy Helm chart

Source: https://docs.strongdm.com/admin/networking/proxy-clusters/kubernetes-proxy-clusters.md

Add the StrongDM repository and install the proxy chart using the previously created values.yaml file.

```shell
helm repo add strongdm https://helm.strongdm.com/stable/
helm install <RELEASE_NAME> strongdm/sdm-proxy -f values.yaml
helm status <RELEASE_NAME>
```

--------------------------------

### Example mapRoles Configuration

Source: https://docs.strongdm.com/admin/resources/clusters/eks-instance-profile.md

A concrete example of a populated mapRoles entry for an EKS cluster.

```yml
data:
  mapRoles: |
    - rolearn: arn:aws:iam::123456789012:role/Example
      username: system:node:{{EC2PrivateDNSNameExample}}
      groups:
        - system:masters
```

--------------------------------

### Example krb5.conf Configuration

Source: https://docs.strongdm.com/admin/resources/datasources/microsoft-sql-server-kerberos.md

A standard configuration file for a StrongDM Microsoft SQL Server resource using Kerberos.

```ini
[libdefaults]
default_realm = AD.EXAMPLE.COM
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
forwardable = yes
default_tgs_enctypes = aes256-cts-hmac-sha1-96
default_tkt_enctypes = aes256-cts-hmac-sha1-96
permitted_enctypes = aes256-cts-hmac-sha1-96

[realms]
AD.EXAMPLE.COM = {
  kdc = ad.example.com:88
}
```

--------------------------------

### View RDP Server CLI Help

Source: https://docs.strongdm.com/admin/resources/servers/rdp.md

Displays the help text and available options for adding an RDP (Password) server via the CLI.

```bash
$ sdm admin servers add rdp --help
NAME:
   sdm admin servers add rdp - create RDP (Password) server

USAGE:
   sdm admin servers add rdp [command options] <name>

OPTIONS:
   --bind-interface value                     IP address on which to listen for connections to this resource on clients. Specify "default", "loopback", or "vnm" to automatically allocate an available address from the corresponding IP range configured in the organization. (default: "default")
   --downgrade-nla-connections                Note: when downgraded, StrongDM cannot verify usernames and passwords for Remote Desktop connections
   --egress-filter value                      apply filter to select egress nodes e.g. 'field:name tag:key=value ...'
   --hostname value                           (required)
   --lock-required                            Require a resource lock to access the resource to ensure it can only be used by one user at a time.
   --password value                           (required, secret)
   --port value                               (default: 3389)
   --port-override value                      Port on which to listen for connections to this resource on clients. Specify "-1" to automatically allocate an available port. (default: -1)
   --proxy-cluster-id value                   proxy cluster id
   --secret-store-id value                    secret store id
   --subdomain value, --bind-subdomain value  DNS subdomain through which this resource may be accessed on clients (e.g. "app-prod" allows the resource to be accessed as "app-prod.<your-org-name>.<sdm-proxy-domain>"). Only applicable to HTTP-based resources or resources using virtual networking mode.
   --tags value                               tags e.g. 'key=value,...'
   --template, -t                             display a JSON template
   --timeout value                            set time limit for command
   --username value                           (required, secret)
```

--------------------------------

### Verify CLI Installation

Source: https://docs.strongdm.com/references/cli.md

Checks the installed version of the sdm client to ensure it is correctly configured.

```bash
sdm --version
```

```bash
sdm version xx.yy.z (99a5d1a71d4eccaf171449e33bc0826132b05165 #503)
```

--------------------------------

### View Azure (Certificate) Cloud Help

Source: https://docs.strongdm.com/admin/resources/clouds/azure.md

Displays the command options for creating an Azure cloud resource using certificate-based authentication.

```bash
$ sdm admin clouds add azurecert --help
NAME:
   sdm admin clouds add azurecert - create Azure (Certificate) cloud

USAGE:
   sdm admin clouds add azurecert [command options] <name>

OPTIONS:
   --app-id value                             the application ID to authenticate with (required, secret)
   --bind-interface value                     IP address on which to listen for connections to this resource on clients. Specify "default", "loopback", or "vnm" to automatically allocate an available address from the corresponding IP range configured in the organization. (default: "default")
   --certificate value                        service Principal certificate file, both private and public key (required, secret)
   --egress-filter value                      apply filter to select egress nodes e.g. 'field:name tag:key=value ...'
   --port-override value                      Port on which to listen for connections to this resource on clients. Specify "-1" to automatically allocate an available port. (default: -1)
   --proxy-cluster-id value                   proxy cluster id
   --secret-store-id value                    secret store id
   --subdomain value, --bind-subdomain value  DNS subdomain through which this resource may be accessed on clients (e.g. "app-prod" allows the resource to be accessed as "app-prod.<your-org-name>.<sdm-proxy-domain>"). Only applicable to HTTP-based resources or resources using virtual networking mode.
   --tags value                               tags e.g. 'key=value,...'
   --template, -t                             display a JSON template
   --tenant-id value                          the tenant ID to authenticate to (required, secret)
   --timeout value                            set time limit for command
```

--------------------------------

### Create okta.yaml configuration file

Source: https://docs.strongdm.com/admin/resources/clouds/okta.md

Place this file at ~/.okta/okta.yaml on the node to define client connection settings and scopes.

```yaml
okta:
  client:
    connectionTimeout: 30 # seconds
    authorizationMode: "PrivateKey"
    scopes:
    - okta.groups.manage
    - okta.users.read
    - okta.apps.read
    - okta.roles.read
    rateLimit:
      maxRetries: 4
```

--------------------------------

### Reinstate a user example

Source: https://docs.strongdm.com/references/cli/admin/users/reinstate.md

Example command to reinstate a specific user with a defined permission level.

```shell
sdm admin users reinstate --permission-level user alice.glick@strongdm.com
```

--------------------------------

### Entities Field Example

Source: https://docs.strongdm.com/admin/audit/logs/references/authz-logs-object.md

Example of the entities array using Cedar Entities JSON syntax.

```json
"entities": [
    {
        "uid": {
            "type": "Postgres::Database",
            "id": "rs-735d634e6690718e/web"
        },
        "parents": [
            {
                "type": "StrongDM::Resource",
                "id": "rs-735d634e6690718e"
            }
        ],
        "attrs": {
            "database": "web",
            "sdm": {
                "__entity": {
                    "type": "StrongDM::Resource",
                    "id": "rs-735d634e6690718e"
                }
            }
        }
    },
    {
        "uid": {
            "type": "StrongDM::Account",
            "id": "a-66c1524e6690718e"
        },
        "parents": [
            {
                "type": "StrongDM::Role",
                "id": "r-77ed01576690718e"
            }
        ],
        "attrs": {
            "accountType": "user",
            "email": "test@example.com",
            "externalId": "",
            "isManagedUser": false,
            "permissionLevel": "admin",
            "tags": {}
        }
    },
    {
        "uid": {
            "type": "StrongDM::Resource",
            "id": "rs-735d634e6690718e"
        },
        "attrs": {
            "tags": {
                "essential": "true"
            }
        }
    }
]
```

--------------------------------

### Connect to Resource via CLI

Source: https://docs.strongdm.com/admin/resources/datasources/azure-postgresql.md

Initiates a session to the specified resource, setting necessary environment variables.

```bash
sdm connect azure-pg-prod
```

--------------------------------

### StrongDM Resource Tag Example

Source: https://docs.strongdm.com/admin/access/policies/policy-taxonomy.md

Example demonstrating how to filter policies based on resource tags.

```cedar
permit (
  principal,
  action,
  resource == StrongDM::Resource::"rs-1234"
) when {
  resource.hasTag("env") && resource.getTag("env") == "dev"
};
```

--------------------------------

### GET /references/scim/users.md

Source: https://docs.strongdm.com/references/scim/users.md

Query the documentation dynamically by asking a question via an HTTP GET request.

```APIDOC
## GET /references/scim/users.md

### Description
Perform an HTTP GET request on the current page URL to query the documentation dynamically.

### Method
GET

### Endpoint
https://docs.strongdm.com/references/scim/users.md

### Parameters
#### Query Parameters
- **ask** (string) - Required - The immediate question to ask.
- **goal** (string) - Optional - The broader end goal to tailor the answer.
```

--------------------------------

### View Kubernetes CLI Help

Source: https://docs.strongdm.com/admin/resources/clusters/kubernetes.md

Display available options and usage patterns for adding a Kubernetes cluster via the CLI.

```sh
NAME:
   sdm admin clusters add k8s - create Kubernetes cluster

USAGE:
   sdm admin clusters add k8s [command options] <name>

OPTIONS:
   --allow-resource-role-bypass                 (For legacy orgs) allows users to fallback to the existing authentication mode (Leased Credential or Identity Set) when a resource role is not provided.
   --bind-interface value                       IP address on which to listen for connections to this resource on clients. Specify "default", "loopback", or "vnm" to automatically allocate an available address from the corresponding IP range configured in the organization. (default: "default")
   --certificate-authority value                (secret)
   --client-certificate value                   (secret)
   --client-key value                           (secret)
   --discovery-enabled                          Enable discovery for the cluster.
   --discovery-username value                   The user to impersonate in the cluster when running discovery. Required if the cluster is configured for identity aliases. (conditional)
   --egress-filter value                        apply filter to select egress nodes e.g. 'field:name tag:key=value ...'
   --healthcheck-namespace default              This path will be used to check the health of your connection.  Defaults to default.
   --hostname value                             (required)
   --identity-alias-healthcheck-username value  (conditional)
   --identity-set-id value                      
   --identity-set-name value                    set the identity set by name
   --port value                                 (required) (default: 443)
   --port-override value                        Port on which to listen for connections to this resource on clients. Specify "-1" to automatically allocate an available port. (default: -1)
   --proxy-cluster-id value                     proxy cluster id
   --secret-store-id value                      secret store id
   --subdomain value, --bind-subdomain value    DNS subdomain through which this resource may be accessed on clients (e.g. "app-prod" allows the resource to be accessed as "app-prod.<your-org-name>.<sdm-proxy-domain>"). Only applicable to HTTP-based resources or resources using virtual networking mode.
   --tags value                                 tags e.g. 'key=value,...'
   --template, -t                               display a JSON template
   --timeout value                              set time limit for command
```
Tokens:
Raw