Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 414 / 554

Chapter 17. User and Group Authorization
392
•
Auditors.
This group is given access to view the signed audit logs. This group does not have any
other privileges.
•
Enterprise administrators.
Each subsystem instance is automatically assigned a subsystem-specific
role as an enterprise administrator when it is joined to a security domain during configuration. These
roles automatically provide trusted relationships among subsystems in the security domain, so that
each subsystem can efficiently carry out interactions with other subsystems.
•
Trusted managers.
A trusted manager is a subsystem that has a trusted relationship with another
subsystem. This group is given access to connect with and submit requests to the subsystem for
which it is a trusted manager.
17.1.2.1. Administrators
Administrators have permissions to perform all administrative tasks. A user is an administrator
by being added to the
Administrators
group. Every member of this group has administrative
privileges for this instance of Certificate System.
At least one administrator must be defined for each Certificate System instance, but there is no limit to
the number of administrators an instance can have. The first administrator entry is created when the
instance is configured.
Administrators are authenticated using their Certificate System user ID and password. It is possible to
change the authentication method to SSL client authentication. See
Section 3.2, “Enabling SSL Client
Authentication for the Certificate System Console”
for more information.
17.1.2.2. Auditors
An auditor can view the signed audit logs and is created to audit the operation of the system. The
auditor cannot administer the server in any way.
An auditor is created by adding a user to the
Auditors
group and storing the auditor's certificate in
the user entry. The auditor's certificate is used to encrypt the private key of the key pair used to sign
the audit log.
The
Auditors
group is set when the subsystem is configured. No auditors are assigned to this group
during configuration.
Auditors are authenticated into the administrative console with their UID and password. The
authentication method can be changed to SSL client authentication. See
Section 3.2, “Enabling SSL
Client Authentication for the Certificate System Console”
for more information. Once authenticated,
auditors can only view the audit logs. They cannot edit other parts of the system.
17.1.2.3. Agents
Agents are users who have been assigned end-entity certificate and key-management privileges.
Agents can access the agent services interface. For a complete list of agent tasks, see the
Certificate
System Agent's Guide
.
Agents are created by assigning a user to the appropriate subsystem agent group and identifying
certificates that the agents must use for SSL client authentication to the subsystem for it to service
requests from the agents. Each subsystem has its own agent group:
• The Certificate Manager Agents group.