Auditors; Agents; Enterprise Groups - Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION Admin Manual

Auditors

Enterprise subsystem administrators are given enough privileges to perform operations on the
subsystems in the domain. For example, an enterprise CA administrator has the privileges to have
sub-CA certificates approved automatically during configuration. Alternatively, a security domain
administrator can restrict this right if necessary.
14.2.2. Auditors
An auditor can view the signed audit logs and is created to audit the operation of the system. The
auditor cannot administer the server in any way.
An auditor is created by adding a user to the Auditors group and storing the auditor's certificate in
the user entry. The auditor's certificate is used to encrypt the private key of the key pair used to sign
the audit log.
The Auditors group is set when the subsystem is configured. No auditors are assigned to this group
during configuration.
Auditors are authenticated into the administrative console with a simple bind using their UID and
password. Once authenticated, auditors can only view the audit logs. They cannot edit other parts of
the system.

14.2.3. Agents

Agents are users who have been assigned end-entity certificate and key-management privileges.
Agents can access the agent services interface. For a complete list of agent tasks, see the Certificate
System Agent's Guide.
Agents are created by assigning a user to the appropriate subsystem agent group and identifying
certificates that the agents must use for SSL client authentication to the subsystem for it to service
requests from the agents. Each subsystem has its own agent group:
• The Certificate Manager Agents group.
• The Data Recovery Manager Agents group.
• The Online Certificate Status Manager Agents group.
• The Token Key Service Agents group.
• The Token Processing System Agents group.
Each Certificate System subsystem has its own agents with roles defined by the subsystem. Each
subsystem must have at least one agent, but there is no limit to the number of agents a subsystem
can have.
Certificate System identifies and authenticates a user with agent privileges by checking the user's SSL
client certificate in its internal database.

14.2.4. Enterprise Groups

During subsystem configuration, every subsystem instance is joined to a security domain.
Each subsystem instance is automatically assigned a subsystem-specific role as an enterprise
administrator. These roles automatically provide trusted relationships among subsystems in the
329