PKI Server Subsystem ACL CLI

Overview

The pki-server <subsystem>-acl commands provide an interface to manage ACLs.

Note	This feature is still under development.

Listing ACLs

$ pki-server ca-acl-find
  ACL ID: certServer.general.configuration
  Description: Administrators, auditors, and agents are allowed to read CMS general configuration but only administrators are allowed to modify and delete

  ACL ID: certServer.policy.configuration
  Description: Administrators, agents and auditors are allowed to read policy configuration but only administrators allowed to modify

Displaying ACL

$ pki-server ca-acl-show certServer.general.configuration
  ACL ID: certServer.general.configuration
  Description: Administrators, auditors, and agents are allowed to read CMS general configuration but only administrators are allowed to modify and delete
  Operations: read, modify, delete
  Rules:
  - allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents"
  - allow (modify, delete) group="Administrators"

Modifying ACL

$ pki-server ca-acl-mod \
    --desc "Only administrators are allowed to access general configuration" \
    --operations read,modify,delete \
    certServer.general.configuration

Adding ACL Rule

$ pki-server ca-acl-rule-add \
    --type allow \
    --operations read,modify,delete \
    --expression 'group="Administrators"' \
    certServer.general.configuration

Removing ACL Rule

$ pki-server ca-acl-rule-del \
    --type allow \
    --operations read,modify,delete \
    --expression 'group="Administrators"' \
    certServer.general.configuration

See Also

• PKI Server Subsystem Authorization Plugin CLI

• PKI Server Subsystem Authorization Manager CLI