KRA ACL

Overview

The default KRA ACL is defined in /usr/share/pki/kra/database/ds/acl.ldif. When KRA is installed, the ACL will be stored in the following entry which can be customized as needed:

dn: cn=aclResources,dc=kra,dc=pki,dc=example,dc=com
objectClass: top
objectClass: CertACLS
cn: aclResources
resourceACLS: ...
...

certServer.general.configuration

Administrators, auditors, and agents are allowed to read CMS general configuration but only administrators are allowed to modify and delete.

Operations:

• read

• modify

• delete

Rules:

• allow (read) group="Administrators" || group="Auditors" || group="Data Recovery Manager Agents"

• allow (modify,delete) group="Administrators"

certServer.acl.configuration

Administrators, agents and auditors are allowed to read ACL configuration but only administrators allowed to modify.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Data Recovery Manager Agents" || group="Auditors"

• allow (modify) group="Administrators"

certServer.log.configuration

Administrators, Agents, and auditors are allowed to read the log configuration but only administrators are allowed to modify.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Auditors" || group="Data Recovery Manager Agents"

• allow (modify) group="Administrators"

certServer.securitydomain.domainxml

Anybody is allowed to read domain.xml but only Subsystem group and Enterprise Administrators are allowed to modify the domain.xml.

Operations:

• read

• modify

Rules:

• allow (read) user="anybody"

• allow (modify) group="Subsystem Group" || group="Enterprise KRA Administrators"

certServer.log.configuration.fileName

Nobody is allowed to modify a fileName parameter.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Auditors" || group="Data Recovery Manager Agents"

• deny (modify) user=anybody

certServer.log.configuration.signedAudit.expirationTime (DISABLED)

Nobody is allowed to modify an expirationTime parameter.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Auditors" || group="Data Recovery Manager Agents"

• deny (modify) user=anybody

certServer.log.content.signedAudit

Only auditor is allowed to read the signed audit log.

Operations:

• read

Rules:

• allow (read) group="Auditors"

certServer.log.content.system

Administrators, auditors, and agents are allowed to read the log content.

Operations:

• read

Rules:

• allow (read) group="Administrators" || group="Data Recovery Manager Agents" || group="Auditors"

certServer.log.content.transactions

Administrators, auditors, and agents are allowed to read the log content.

Operations:

• read

Rules:

• allow (read) group="Administrators" || group="Data Recovery Manager Agents" || group="Auditors"

certServer.auth.configuration

Administrators, agents, and auditors are allowed to read authentication configuration but only administrators allowed to modify.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Data Recovery Manager Agents" || group="Auditors"

• allow (modify) group="Administrators"

certServer.registry.configuration

This ACL is shared by all admin servlets.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Data Recovery Manager Agents" || group="Auditors"

• allow (modify) group="Administrators"

certServer.job.configuration

Administrators, agents, and auditors are allowed to read job configuration but only administrators allowed to modify.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Data Recovery Manager Agents" || group="Auditors"

• allow (modify) group="Administrators"

certServer.kra.configuration

Administrators, auditors, and agents are allowed to read DRM configuration but only administrators allowed to modify.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Auditors" || group="Data Recovery Manager Agents"

• allow (modify) group="Administrators"

certServer.kra.key

Only data recovery manager agents retrieve key information.

Operations:

• read

• recover

• download

Rules:

• allow (read,recover,download) group="Data Recovery Manager Agents"

certServer.kra.request

Data Recovery Manager Agents may read request.

Operations:

• read

Rules:

• allow (read) group="Data Recovery Manager Agents"

certServer.kra.keys

Only data recovery manager agents list keys and execute key operations.

Operations:

• list

• execute

Rules:

• allow (list,execute) group="Data Recovery Manager Agents"

certServer.kra.requests

Only data recovery manager agents list key archival requests.

Operations:

• list

Rules:

• allow (list) group="Data Recovery Manager Agents"

certServer.admin.certificate

Any user may import a certificate.

Operations:

• import

Rules:

• allow (import) user="anybody"

certServer.admin.request.enrollment

Anybody may submit an enrollment request.

Operations:

• submit

• read

• execute

Rules:

• allow (submit) user="anybody"

certServer.kra.connector

Only Trusted Managers submit requests.

Operations:

• submit

Rules:

• allow (submit) group="Trusted Managers"

certServer.kra.systemstatus

Data Recovery Manager agents may view statistics.

Operations:

• read

Rules:

• allow (read) group="Data Recovery Manager Agents"

certServer.kra.certificate.transport

Anybody is allowed to read transport certificate.

Operations:

• read

Rules:

• allow (read) user="anybody"

certServer.kra.request.status

Only data recovery manager agents retrieve the remote key recovery approval status.

Operations:

• read

Rules:

• allow (read) group="Data Recovery Manager Agents"

certServer.kra.group

Only administrators are allowed to read and modify groups.

Operations:

• read

• modify

Rules:

• allow (modify,read) group="Administrators"

certServer.kra.GenerateKeyPair

Only Data Recovery Manager Agents are allowed to execute requests.

Operations:

• execute

Rules:

• allow (execute) group="Data Recovery Manager Agents"

certServer.kra.TokenKeyRecovery

Only Data Recovery Manager Agents are allowed to submit requests.

Operations:

• submit

Rules:

• allow (submit) group="Data Recovery Manager Agents"

certServer.kra.registerUser

Only Enterprise Administrators are allowed to register a new agent.

Operations:

• read

• modify

Rules:

• allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators"

certServer.kra.getTransportCert

Only Enterprise Administrators are allowed to retrieve the transport cert.

Operations:

• read

Rules:

• allow (read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators"

certServer.clone.configuration

Only Enterprise Administrators are allowed to clone the configuration.

Operations:

• read

• modify

Rules:

• allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators"

certServer.kra.account

Anybody can login and logout.

Operations:

• login

• logout

Rules:

• allow (login,logout) user="anybody"

certServer.kra.groups

Admins may execute group operations.

Operations:

• execute

Rules:

• allow (execute) group="Administrators"

certServer.kra.keyrequests

Agents may execute key request operations.

Operations:

• execute

Rules:

• allow (execute) group="Data Recovery Manager Agents"

certServer.kra.selftests

Only admins can access selftests.

Operations:

• read

• execute

Rules:

• allow (read,execute) group="Administrators"

certServer.kra.users

Admins may execute user operations.

Operations:

• execute

Rules:

• allow (execute) group="Administrators"