OCSP ACL

Overview

The default OCSP ACL is defined in /usr/share/pki/ocsp/database/ds/acl.ldif. When OCSP is installed, the ACL will be stored in the following entry which can be customized as needed:

dn: cn=aclResources,dc=ocsp,dc=pki,dc=example,dc=com
objectClass: top
objectClass: CertACLS
cn: aclResources
resourceACLS: ...
...

certServer.general.configuration

Administrators, auditors, and agents are allowed to read CMS general configuration but only administrators are allowed to modify and delete.

Operations:

• read

• modify

• delete

Rules:

• allow (read) group="Administrators" || group="Auditors" || group="Online Certificate Status Manager Agents"

• allow (modify,delete) group="Administrators"

certServer.acl.configuration

Administrators, agents and auditors are allowed to read ACL configuration but only administrators allowed to modify.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Online Certificate Status Manager Agents" || group="Auditors"

• allow (modify) group="Administrators"

certServer.log.configuration

Administrators, Agents, and auditors are allowed to read the log configuration but only administrators are allowed to modify.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Auditors" || group="Online Certificate Status Manager Agents"

• allow (modify) group="Administrators"

certServer.securitydomain.domainxml

Anybody is allowed to read domain.xml but only Subsystem group and Enterprise Administrators are allowed to modify the domain.xml.

Operations:

• read

• modify

Rules:

• allow (read) user="anybody"

• allow (modify) group="Subsystem Group" || group="Enterprise OCSP Administrators"

certServer.log.configuration.fileName

Nobody is allowed to modify a fileName parameter.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Auditors" || group="Online Certificate Status Manager Agents"

• deny (modify) user=anybody

certServer.log.configuration.signedAudit.expirationTime (DISABLED)

Nobody is allowed to modify an expirationTime parameter.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Auditors" || group="Online Certificate Status Manager Agents"

• deny (modify) user=anybody

certServer.log.content.signedAudit

Only auditor is allowed to read the signed audit log.

Operations:

• read

Rules:

• allow (read) group="Auditors"

certServer.log.content.system

Administrators, auditors, and agents are allowed to read the log content.

Operations:

• read

Rules:

• allow (read) group="Administrators" || group="Online Certificate Status Manager Agents" || group="Auditors"

certServer.log.content.transactions

Administrators, auditors, and agents are allowed to read the log content.

Operations:

• read

Rules:

• allow (read) group="Administrators" || group="Online Certificate Status Manager Agents" || group="Auditors"

certServer.auth.configuration

Administrators, agents, and auditors are allowed to read authentication configuration but only administrators allowed to modify.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Online Certificate Status Manager Agents" || group="Auditors"

• allow (modify) group="Administrators"

certServer.ocsp.configuration

Administrators, Agents, and auditors are allowed to read ocsp configuration but only administrators allowed to modify.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Online Certificate Status Manager Agents" || group="Auditors"

• allow (modify) group="Administrators"

certServer.registry.configuration

This ACL is shared by all admin servlets.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Online Certificate Status Manager Agents" || group="Auditors"

• allow (modify) group="Administrators"

certServer.ocsp.info

Online Certificate Status Manager agents may read ocsp information.

Operations:

• read

Rules:

• allow (read) group="Online Certificate Status Manager Agents"

certServer.ee.request.ocsp

Any clients can submit ocsp requests.

Operations:

• submit

Rules:

• allow (submit) ipaddress=".*"

certServer.ee.crl

Anybody may add or retrieve CRL.

Operations:

• read

• add

Rules:

• allow (read,add) user="anybody"

certServer.ocsp.crl

Online Certificate Status Manager agents and Trusted Managers may add CRL.

Operations:

• add

Rules:

• allow (add) group="Online Certificate Status Manager Agents" || group="Trusted Managers"

certServer.ocsp.ca

Online Certificate Status Manager agents may add Certificate Authority.

Operations:

• add

Rules:

• allow (add) group="Online Certificate Status Manager Agents"

certServer.ocsp.cas

Online Certificate Status Manager agents may list Certificate Authorities.

Operations:

• list

Rules:

• allow (list) group="Online Certificate Status Manager Agents"

certServer.ocsp.certificate

Online Certificate Status Manager agents may validate certificate status.

Operations:

• validate

Rules:

• allow (validate) group="Online Certificate Status Manager Agents"

certServer.ocsp.group

Only administrators are allowed to read and modify groups.

Operations:

• read

• modify

Rules:

• allow (modify,read) group="Administrators"

certServer.clone.configuration

Only Enterprise Administrators are allowed to clone the configuration.

Operations:

• read

• modify

Rules:

• allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators"

certServer.ocsp.account

Anybody can login and logout.

Operations:

• login

• logout

Rules:

• allow (login,logout) user="anybody"

certServer.ocsp.groups

Admins may execute group operations.

Operations:

• execute

Rules:

• allow (execute) group="Administrators"

certServer.ocsp.selftests

Only admins can access selftests.

Operations:

• read

• execute

Rules:

• allow (read,execute) group="Administrators"

certServer.ocsp.users

Admins may execute user operations.

Operations:

• execute

Rules:

• allow (execute) group="Administrators"