TKS ACL

Overview

The default TKS ACL is defined in /usr/share/pki/tks/database/ds/acl.ldif. When TKS is installed, the ACL will be stored in the following entry which can be customized as needed:

dn: cn=aclResources,dc=tks,dc=pki,dc=example,dc=com
objectClass: top
objectClass: CertACLS
cn: aclResources
resourceACLS: ...
...

certServer.general.configuration

Administrators, auditors, and agents are allowed to read CMS general configuration but only administrators are allowed to modify and delete.

Operations:

• read

• modify

• delete

Rules:

• allow (read) group="Administrators" || group="Auditors" || group="Token Key Service Manager Agents"

• allow (modify,delete) group="Administrators"

certServer.acl.configuration

Administrators, agents and auditors are allowed to read ACL configuration but only administrators allowed to modify.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Auditors" || group="Token Key Service Manager Agents"

• allow (modify) group="Administrators"

certServer.log.configuration

Administrators, Agents, and auditors are allowed to read the log configuration but only administrators are allowed to modify.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Auditors" || group="Token Key Service Manager Agents"

• allow (modify) group="Administrators"

certServer.log.configuration.fileName

Nobody is allowed to modify a fileName parameter.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Auditors" || group="Token Key Service Manager Agents"

• deny (modify) user=anybody

certServer.log.configuration.signedAudit.expirationTime (DISABLED)

Nobody is allowed to modify an expirationTime parameter.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Auditors" || group="Token Key Service Manager Agents"

• deny (modify) user=anybody

certServer.log.content.signedAudit

Only auditor is allowed to read the signed audit log.

Operations:

• read

Rules:

• allow (read) group="Auditors"

certServer.log.content.system

Administrators, auditors, and agents are allowed to read the log content.

Operations:

• read

Rules:

• allow (read) group="Administrators" || group="Auditors" || group="Token Key Service Manager Agents"

certServer.log.content.transactions

Administrators, auditors, and agents are allowed to read the log content.

Operations:

• read

Rules:

• allow (read) group="Administrators" || group="Auditors" || group="Token Key Service Manager Agents"

certServer.auth.configuration

Administrators, agents, and auditors are allowed to read authentication configuration but only administrators allowed to modify.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Auditors" || group="Token Key Service Manager Agents"

• allow (modify) group="Administrators"

certServer.registry.configuration

This ACL is shared by all admin servlets.

Operations:

• read

• modify

Rules:

• allow (read) group="Administrators" || group="Auditors" || group="Token Key Service Manager Agents"

• allow (modify) group="Administrators"

certServer.admin.certificate

Any user may import a certificate.

Operations:

• import

Rules:

• allow (import) user="anybody"

certServer.admin.request.enrollment

Anybody may submit an enrollment request.

Operations:

• submit

• read

• execute

Rules:

• allow (submit) user="anybody"

certServer.tks.systemstatus

Token Key Service Manager agents may view statistics.

Operations:

• read

Rules:

• allow (read) group="Token Key Service Manager Agents"

certServer.tks.group

Only administrators are allowed to modify groups.

Operations:

• read

• modify

Rules:

• allow (modify,read) group="Administrators"

• allow (read) group="Token Key Service Manager Agents"

certServer.tks.encrypteddata

Token Key Service Manager agents may execute encrypted data information servlet.

Operations:

• execute

Rules:

• allow (execute) group="Token Key Service Manager Agents"

certServer.tks.keysetdata

Token Key Service Manager agents may execute key set data information servlet.

Operations:

• execute

Rules:

• allow (execute) group="Token Key Service Manager Agents"

certServer.tks.sessionkey

Token Key Service Manager agents may execute session key servlet.

Operations:

• execute

Rules:

• allow (execute) group="Token Key Service Manager Agents"

certServer.tks.randomdata

Token Key Service Manager agents may execute random data servlet.

Operations:

• execute

Rules:

• allow (execute) group="Token Key Service Manager Agents"

certServer.tks.registerUser

Only Enterprise Administrators are allowed to register a new agent.

Operations:

• read

• modify

Rules:

• allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators"

certServer.tks.importTransportCert

Only Enterprise Administrators are allowed to import transport certificate.

Operations:

• read

• modify

Rules:

• allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators"

certServer.clone.configuration

Only Enterprise Administrators are allowed to clone the configuration.

Operations:

• read

• modify

Rules:

• allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators"

certServer.tks.account

Anybody can login and logout.

Operations:

• login

• logout

Rules:

• allow (login,logout) user="anybody"

certServer.tks.groups

Admins may execute group operations.

Operations:

• execute

Rules:

• allow (execute) group="Administrators"

certServer.tks.selftests

Only admins can access selftests.

Operations:

• read

• execute

Rules:

• allow (read,execute) group="Administrators"

certServer.tks.users

Admins may execute user operations.

Operations:

• execute

Rules:

• allow (execute) group="Administrators"