Creating Auditor

Overview

This page describes the process to set up a system user for the auditor to access the audit logs.

Creating Auditor User

As the admin of the subsystem create a new system user for the auditor, for example:

$ pki \
    -n caadmin \
    ca-user-add \
    --fullName "Auditor" \
    --password Secret.123 \
    auditor

Adding Auditor User to Auditors Group

Add the auditor user into the Auditors group, for example:

$ pki \
    -n caadmin \
    ca-group-member-add \
    Auditors \
    auditor

Creating Auditor Password

To allow the auditor to authenticate with a password the admin needs to create the password for the auditor, for example:

$ pki \
    -n caadmin \
    ca-user-mod \
    --password Secret.123 \
    auditor

Then the auditor can access the audit logs with the username and password, for example:

$ pki \
    -u auditor \
    -w Secret.123 \
    ca-audit-file-find

Creating Auditor Certificate

To allow the authenticator to authenticate a certificate the auditor needs to generate a certificate request, for example:

$ pki nss-cert-request \
    --subject UID=auditor \
    --csr auditor.csr

Then the CA agent needs to issue the certificate, for example:

$ pki \
    -n caadmin \
    ca-cert-issue \
    --profile caUserCert \
    --csr-file auditor.csr \
    --subject UID=auditor \
    --output-file auditor.crt

Once the certificate is issued, the admin needs to assign it to the auditor user, for example:

$ pki \
    -n caadmin \
    ca-user-cert-add \
    --input auditor.crt \
    auditor

The auditor will also need to import the certificate to the client, for example:

$ pki nss-cert-import \
    --cert auditor.crt \
    auditor

Then the auditor can access the audit logs with the certificate, for example:

$ pki \
    -n auditor \
    ca-audit-file-find

See Also

• Adding System User

• Accessing Audit Logs