Netscape Certificate Management System 6.1, Руководство администратора

Страница: 327 / 840

About Authorization
Chapter 8 Authorization 327
Administrators. This group is given full access to all of the tasks available in the
administrative interface.
Agents. This group is given full access to all of the tasks available in the agent
services interface.
Note: There is more than one agent group. A separate agent group is created for
each of the subsystem with a different name. Be careful to use the correct agent
group name when modifying ACLs. See “Groups for Agents,” on page 328.
Auditors. This group is given access to view the signed audit logs. This group does
not have any other privileges.
Trusted Managers. A trusted manager is a subsystem that has a trusted
relationship with another subsystem. This group is given access to connect with
and submit requests to the subsystem in which it is a trusted manager.
Administrators
Administrators have permissions to perform all the administrative tasks. You
create administrators by creating a user entry for the administrator and adding
them to the group called
Administrators
, every member of this group has
administrative privileges for this instance of CMS.
At least one administrator must be defined for each CMS instance, there is no limit
to the number of administrators an instance can have. You specify the user ID and
password of the first administrator during installation.
Authentication of Administrators
Administrators are authenticated using their CMS user ID and password.
You can change the method of authentication for an administrator to SSL client
authentication. See “Setting up Certificate Authentication for the CMS Console,”
on page 249 for complete details.
Auditors
An auditor can view the signed audit logs. An auditor is set up to audit the
operation of the system. The auditor cannot administer the server in any way
except to view the audit logs.
You set up an auditor by creating a user, adding them to the
Auditors
group, and
storing the auditors certificate. The auditors certificate is used to encrypt the
private key of the key pair used to sign the audit log.
An auditor group is set up when you configure a subsystem. No auditors are
assigned to this group during configuration.