CA ACL

Overview

The default CA ACL is defined in /usr/share/pki/ca/database/ds/acl.ldif. When CA is installed, the ACL will be stored in the following entry which can be customized as needed:

dn: cn=aclResources,dc=ca,dc=pki,dc=example,dc=com
objectClass: top
objectClass: CertACLS
cn: aclResources
resourceACLS: ...
...

certServer.general.configuration

Administrators, auditors, and agents are allowed to read CMS general configuration but only administrators are allowed to modify and delete.

Operations:

• read

• modify

• delete

Rules:

• allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents"

• allow (modify,delete) group="Administrators"

certServer.policy.configuration

Administrators, agents and auditors are allowed to read policy configuration but only administrators allowed to modify.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors"

• allow (modify) group="Administrators"

certServer.acl.configuration

Administrators, agents and auditors are allowed to read ACL configuration but only administrators allowed to modify.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors"

• allow (modify) group="Administrators"

certServer.log.configuration

Administrators, Agents, and auditors are allowed to read the log configuration but only administrators are allowed to modify.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents"

• allow (modify) group="Administrators"

certServer.securitydomain.domainxml

Anybody is allowed to read domain.xml but only Subsystem group and Enterprise Administrators are allowed to modify the domain.xml.

Operations:

• read

• modify

Rules:

• allow (read) user="anybody"

• allow (modify) group="Subsystem Group" || group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators" || group="Enterprise EST Administrators"

certServer.log.configuration.fileName

Nobody is allowed to modify a fileName parameter.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents"

• deny (modify) user=anybody

certServer.log.configuration.signedAudit.expirationTime (DISABLED)

Nobody is allowed to modify an expirationTime parameter.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents"

• deny (modify) user=anybody

certServer.log.content.signedAudit

Only auditor is allowed to read the signed audit log.

Operations:

• read

Rules:

• allow (read) group="Auditors"

certServer.log.content.system

Administrators, auditors, and agents are allowed to read the log content.

Operations:

• read

Rules:

• allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors"

certServer.log.content.transactions

Administrators, auditors, and agents are allowed to read the log content.

Operations:

• read

Rules:

• allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors"

certServer.ca.configuration

Administrators, auditors, and agents are allowed to read CA configuration but only administrators allowed to modify.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors"

• allow (modify) group="Administrators"

certServer.auth.configuration

Administrators, agents, and auditors are allowed to read authentication configuration but only administrators allowed to modify.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors"

• allow (modify) group="Administrators"

certServer.ocsp.configuration

Administrators, Agents, and auditors are allowed to read ocsp configuration but only administrators allowed to modify.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors"

• allow (modify) group="Administrators"

certServer.registry.configuration

This ACL is shared by all admin servlets.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors"

• allow (modify) group="Administrators"

certServer.profile.configuration

Administrators, agents, and auditors are allowed to read profile configuration but only administrators allowed to modify.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors"

• allow (modify) group="Administrators"

certServer.job.configuration

Administrators, agents, and auditors are allowed to read job configuration but only administrators allowed to modify.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Certificate Manager Agents" || group="Registration Manager Agents" || group="Auditors"

• allow (modify) group="Administrators"

certServer.publisher.configuration

Administrators, auditors, and agents are allowed to read publisher configuration but only administrators allowed to modify.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents"

• allow (modify) group="Administrators"

certServer.kra.configuration

Administrators, auditors, and agents are allowed to read DRM configuration but only administrators allowed to modify.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents"

• allow (modify) group="Administrators"

certServer.ra.configuration

Administrators, auditors, and agents are allowed to read RA configuration but only administrators allowed to modify.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents"

• allow (modify) group="Administrators"

certServer.ca.directory

Certificate Manager agents may update directory.

Operations:

• update

Rules:

• allow (update) group="Certificate Manager Agents"

certServer.ca.certificate

Certificate Manager agents may import, unrevoke, revoke, read a certificate.

Operations:

• import

• unrevoke

• revoke

• read

Rules:

• allow (import,unrevoke,revoke,read) group="Certificate Manager Agents"

certServer.ca.certificates

Only certificate and registration manager agents revoke, list certificates.

Operations:

• revoke

• list

Rules:

• allow (revoke,list) group="Certificate Manager Agents" || group="Registration Manager Agents"

certServer.ca.requests

Only certificate and registration manager agents list requests.

Operations:

• list

Rules:

• allow (list) group="Certificate Manager Agents" || group="Registration Manager Agents"

certServer.ca.request.enrollment

Anybody may submit an enrollment request, Certificate Manager Agents may read, execute, assign or unassign request.

Operations:

• submit

• read

• execute

• assign

• unassign

Rules:

• allow (submit) user="anybody"

• allow (read,execute,assign,unassign) group="Certificate Manager Agents"

certServer.ca.ocsp

Certificate Manager agents may read ocsp information.

Operations:

• read

Rules:

• allow (read) group="Certificate Manager Agents"

certServer.ee.request.ocsp

Any clients can submit ocsp requests.

Operations:

• submit

Rules:

• allow (submit) ipaddress=".*"

certServer.ca.crl

Certificate Manager agents may read or update crl.

Operations:

• read

• update

Rules:

• allow (read,update) group="Certificate Manager Agents"

certServer.ee.certificate

Anybody may renew, import, revoke, read a certificate.

Operations:

• renew

• revoke

• read

• import

Rules:

• allow (renew,revoke,read,import) user="anybody"

certServer.ee.certificates

Anybody may revoke, list certificates.

Operations:

• revoke

• list

Rules:

• allow (revoke,list) user="anybody"

certServer.ee.certchain

Anybody may download a certificate chain.

Operations:

• download

• read

Rules:

• allow (download,read) user="anybody"

certServer.ee.crl

Anybody may add or retrieve CRL.

Operations:

• read

• add

Rules:

• allow (read,add) user="anybody"

certServer.ee.request.enrollment

Anybody may submit an enrollment request.

Operations:

• submit

Rules:

• allow (submit) user="anybody"

certServer.ee.requestStatus

Anybody may read request status.

Operations:

• read

Rules:

• allow (read) user="anybody"

certServer.ee.request.revocation

Anybody may submit a revocation request.

Operations:

• submit

Rules:

• allow (submit) user="anybody"

certServer.admin.certificate

Any user may import a certificate.

Operations:

• import

Rules:

• allow (import) user="anybody"

certServer.admin.request.enrollment

Anybody may submit an enrollment request, Certificate Manager Agents may read or execute request.

Operations:

• submit

• read

• execute

Rules:

• allow (submit) user="anybody"

• allow (read,execute) group="Certificate Manager Agents"

certServer.ca.request.profile

Certificate Manager agents may approve profile.

Operations:

• approve

• read

Rules:

• allow (approve,read) group="Certificate Manager Agents"

certServer.ca.profiles

Certificate Manager agents may list profiles.

Operations:

• list

Rules:

• allow (list) group="Certificate Manager Agents"

certServer.ca.profile

Certificate Manager agents may read profile.

Operations:

• read

• approve

Rules:

• allow (read,approve) group="Certificate Manager Agents"

certServer.ee.profile

Anybody may submit certificate profiles.

Operations:

• submit

• read

Rules:

• allow (submit,read) user="anybody"

certServer.ee.profiles

Anybody may list certificate profiles.

Operations:

• list

Rules:

• allow (list) user="anybody"

certServer.ca.connector

Only Trusted Managers submit requests.

Operations:

• submit

Rules:

• allow (submit) group="Trusted Managers"

certServer.ca.clone

Certificate Manager Agents are allowed to submit request to the master CA.

Operations:

• submit

Rules:

• allow (submit) group="Certificate Manager Agents"

certServer.ca.systemstatus

Certificate Manager agents may view statistics.

Operations:

• read

Rules:

• allow (read) group="Certificate Manager Agents"

certServer.ca.group

Only administrators are allowed to read and modify users and groups.

Operations:

• read

• modify

Rules:

• allow (modify,read) group="Administrators"

certServer.ca.connectorInfo

Only Enterprise Administrators and Subsystem Group are allowed to update the connector information.

Operations:

• read

• modify

Rules:

• allow (read) group="Enterprise KRA Administrators"

• allow (modify) group="Enterprise KRA Administrators" || group="Subsystem Group"

certServer.ca.registerUser

Only Enterprise Administrators are allowed to register a new agent.

Operations:

• read

• modify

Rules:

• allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators" || group="Enterprise EST Administrators"

certServer.clone.configuration

Only Enterprise Administrators are allowed to clone the configuration.

Operations:

• read

• modify

Rules:

• allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators"

certServer.admin.ocsp

Only Enterprise Administrators are allowed to read or update the OCSP configuration.

Operations:

• read

• modify

Rules:

• allow (modify,read) group="Enterprise OCSP Administrators"

certServer.ca.account

Anybody can login and logout.

Operations:

• login

• logout

Rules:

• allow (login,logout) user="anybody"

certServer.ca.certrequests

Agents may execute cert request operations.

Operations:

• execute

Rules:

• allow (execute) group="Certificate Manager Agents"

certServer.ca.certs

Agents may execute cert operations.

Operations:

• execute

Rules:

• allow (execute) group="Certificate Manager Agents"

certServer.ca.groups

Admins may execute group operations.

Operations:

• execute

Rules:

• allow (execute) group="Administrators"

certServer.ca.selftests

Only admins can access selftests.

Operations:

• read

• execute

Rules:

• allow (read,execute) group="Administrators"

certServer.ca.users

Admins may execute user operations.

Operations:

• execute

Rules:

• allow (execute) group="Administrators"

certServer.ca.authorities

Anybody may list and read lightweight authorities. Administrators may create, modify, and delete lightweight authorities.

Operations:

• list

• read

• create

• modify

• delete

Rules:

• allow (list,read) user="anybody"

• allow (create,modify) group="Administrators"

• allow (delete) group="Administrators"