Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION, Руководство администратора

Страница: 350 / 564

Chapter 14. Managing Certificate System Users and Groups
328
•
Auditors.
This group is given access to view the signed audit logs. This group does not have any
other privileges.
•
Enterprise administrators.
Each subsystem instance is automatically assigned a subsystem-specific
role as an enterprise administrator when it is joined to a security domain during configuration. These
roles automatically provide trusted relationships among subsystems in the security domain, so that
each subsystem can efficiently carry out interactions with other subsystems.
14.2.1. Administrators
Administrators have permissions to perform all administrative tasks. A user is designated or identified
as being an administrator by being added to the
Administrators
group for the group. Every
member of that group has administrative privileges for that instance of Certificate System.
At least one administrator must be defined for each Certificate System instance, but there is no limit to
the number of administrators an instance can have. The first administrator entry is created when the
instance is configured.
Administrators are authenticated with a simple bind using their Certificate System user ID and
password.
Role Description
Security Domain
Administrators • Add and modify users in the security domain's user and group database.
• Manage the shared trust policies.
• Manage the access controls on the domain services.
By default, the CA administrator of the CA hosting the domain is assigned as the security domain administrator.
Enterprise CA Administrators • Automatically approve any sub-CA, server, and subsystem certificate from any CA in the domain.
• Register and unregister CA subsystem information in the security domain.
Enterprise DRM
Administrators • Automatically approve any transport, storage, server, and subsystem certificate from any CA in the domain.
• Register and unregister DRM subsystem information in the security domain.
• Push KRA connector information to any CA.
Enterprise OCSP
Administrators • Automatically approve any OCSP, server, and subsystem certificate from any CA in the domain.
• Register and unregister OCSP subsystem information in the security domain.
• Push CRL publishing information to any CA.
Enterprise TKS Administrators • Automatically approve any server and subsystem certificate from any CA in the domain.
• Register and unregister TKS subsystem information in the security domain.
Enterprise TPS Administrators • Automatically approve any server and subsystem certificate from any CA in the domain.
• Register and unregister TPS subsystem information in the security domain.
Table 14.1. Security Domain User Roles
As necessary, the security domain administrator can manage access controls on the security domain
and on the individual subsystems. For example, the security domain administrator can restrict access
so that only finance department DRM administrators can set up finance department DRMs.