Roles

In EJBCA, a role is assigned certain access rules, and users are assigned a role. All users assigned to a role will have the access privileges defined by the access rules in the role.

The EJBCA Role and Rule handling has been improved as of 6.8.0 with simplified rules administration and clearer role capabilities.

EJBCA Access Rules inherit the state from their parent rule by default, unless individually specified. Each access rule consists of the states Allow, Deny and Inherit.

The following sections cover a listing of available access rules, provide an overview of default Role Templates, and include a step-by-step guide on creating a new Administrator:

Default Super Administrator Role

The default Super Administrator Role, created during EJBCA installation, has the following access rights:

  • Has overall access to EJBCA

  • Can edit system configuration

  • Can manage CAs

  • Can manage publishers (LDAP, AD, custom)

  • Can create CA administrators

Advanced Access Rules

When editing access rules, select Advanced mode to access the advanced access rule configuration. The Advanced mode displays all available access rules and allows you to accept or reject specific rules for the role you are editing. By using advanced access rules you can define you own roles and construct a role set suitable for most auditing schemes.

Note that rules not available to the current Administrator will be disabled and rules pertaining to CA's and Crypto Tokens that the Administrator does not have access to will be hidden.