Security Role Permissions

Users can access the Management Portal areas and API endpoints to:

• View orchestrators, including filtering the orchestrator management grid
• View orchestrator jobs, including status, schedules, failures and warnings

This permission has been deprecated and may be removed in a future release.

This permission has been deprecated and may be removed in a future release.

Users can modify the application settings.

Users can modify certificate authority and revocation monitoring settings to:

• Import, add, edit, and delete certificate authorities.
• Configure CA health monitor and threshold alert recipients.
• Import CAs.

• Add, edit, delete, and test revocation monitoring endpoints.

  For access in the Management Portal, this also requires the Monitoring > Alerts > Read permission.

• Configure revocation monitoring schedules and recipients.

  For access in the Management Portal, this also requires the Monitoring > Alerts > Read permission.

Users with the Modify role permission for either Certificate Stores or an application (#) can view the certificate stores grid and the applications grid and use the following operations on these pages (in addition to those available with Read and Schedule permissions):

• Add (Certificate Stores tab): Add new certificate stores.

• Edit (Certificate Stores tab): Edit existing certificate stores.

• Delete (Certificate Stores tab): Delete certificate stores.

• Set New Password (Certificate Stores tab): For certificate stores with a store password, set a new store password.

• Assign Application (Certificate Stores tab): Assign a certificate store to a certificate store application.

• Add (Applications tab): Add a new certificate store application. This permission cannot be granted at the application level.

• Edit (Application tab): Edit a certificate store application.

• Delete (Application tab): Delete a certificate store application.

• Permissions (Application tab): View and modify certificate store application permissions from the applications tab. Keyfactor recommended best practice is to manage permissions as part of the overall permission configuration on the Security Roles and Claims page, as additional system-wide configuration settings are available there that cannot be viewed or modified from this page.

• Discover tab: View certificate store discover job results on the Discover tab. Schedule discovery jobs. Approved or delete discovered certificate stores. This permission cannot be granted at the application level.

  Important:  Scheduling discovery jobs also requires Agents > Management > Read (see Agents).

Users with the Read global role permission for either Certificate Stores or a specific application (#) can view the certificate stores grid and the applications grid and use the following operations on these pages:

• View (Certificate Stores tab): For users without the Modify permission, see a read-only view of the certificate store configuration details.

  Important:  This option also requires Agents > Management > Read (see Agents).

• View Inventory (Certificate Stores tab): Open a subpage under Certificate Stores to view all certificates found in the certificate store on an inventory job.

• Query Certificate Store (Certificate Stores tab): Redirect to Certificate Search to view all certificates found in the certificate store on an inventory job. The search is opened in a new tab.

  Important:  This option also requires global Certificates > Read (see Certificates).

• View (Applications tab): For users without the Modify permission, see a read-only view of the application configuration details.

Users can perform no operations on the certificate stores or applications.

Users with the Schedule and Read role permission for either Certificate Stores or an application (#) can view the certificate stores grid and the applications grid and use the following operations on these pages:

• ODKG (Certificate Stores tab): For certificate store types that support it, perform a certificate enrollment using on-device key generation (formerly reenrollment).

  Important:  This option also requires CSR enrollment permissions (Certificates > Enrollment > Csr).

• Schedule Inventory (Certificate Stores tab): On the Certificate Stores tab, set an inventory job for a certificate store.

• Schedule Inventory (Applications tab): On the Container tab, set an inventory job for am application.

• Add to Certificate Store (Certificate Search page): On the Certificate Search page or in a certificate collection, add a certificate to the certificate store.

  Important:  To use the add, remove, and renew/reissue certificate options, users must have either global Certificates > Collections > Read or have been granted access to one or more certificate collections via collection-level permissions (see Certificate Collection Permissions).

• Remove from Certificate Store (Certificate Search page): On the Certificate Search page or in a certificate collection, remove a certificate from the certificate store.

• Renew/Reissue (Certificate Search page): Renew or reissue a certificate and deliver it to the certificate store.

  Important:  To renew/reissue certificates, users must have Certificates > Enrollment permissions (PFX and/or CSR) and Agents > Management > Read (see Certificates and Agents).

Users with the Change Owner and Read role permission for either Certificate Stores or an application (#) can change the certificate owner (a security role) assigned to a certificate found in a certificate store from the View Inventory subpage to the Certificate Stores page. Users will only be able to change the owner to a security role of which they are a member (see Change Owner).

Users with the Private Key Read and Read role permission for either Certificate Stores or an application (#) can download a certificate found in a certificate store with its private key from the View Inventory subpage to the Certificate Stores page.

Users with the Metadata Modify and Read role permission for either Certificate Stores or an application (#) can edit the metadata fields for a certificate found in a certificate store from the View Inventory subpage to the Certificate Stores page.

Users with the Revoke and Read role permission for either Certificate Stores or an application (#) can revoke a certificate found in a certificate store from the View Inventory subpage to the Certificate Stores page.

Users can modify certificate template settings to import, edit, and configure system settings for certificate templates.

Users can change the certificate owner to any role within the permission sets of which the acting user is a member. The Change Owner dialog presents a search select dropdown containing all the allowed roles. This list will be disabled if the acting user is not a member of the original certificate owner's security role permission set.

This permission setting overrides the Certificates > Collections > Change Owner permission at both the global and collection levels when both permissions are set.

To utilize the Expanded Change Owner permission, a user must hold at least one security role within a permission set and have either Security or Security > Read permissions on that role in order to access all security roles within the permission set.

For more details, see Change Owner.

Users can use the Pending CSRs page in the Management Portal and the equivalent API functions.

Users can use the CSR Generation page in the Management Portal and the equivalent API functions.

Users can delete AND exclude certificates and, if applicable, the private keys of the certificates for any certificates in the specified certificate collection, which will permanently delete a certificate from the Keyfactor Command database, excluding it from all product functionality.Excluded Certificates.

Users can delete certificates and, if applicable, the private keys of the certificates from the Keyfactor Command database for certificates in the specified certificate collection.

Only users with both delete, and delete and exclude permissions will be able to delete certificates with or without excluding them.

Users can modify certificate metadata for certificates in the Certificate Details dialog (only information on the metadata tab can be edited) and the equivalent API functions for certificates in the specified certificate collection (see Certificate Details).

Users can save the private key for the certificate in the Keyfactor Command database.

Users with this role can add a certificate with an associated private key through the Add Certificate option under the Certificate Locations menu (see Add Certificate) and the private key will be stored in the Keyfactor Command database. Users must also be granted the Import role in order to be able to use the Add Certificate feature.

Users can view certificates in the specified certificate collection, including certificate history, and can download certificates. Users who also have Read permissions for Certificate Store Management or certificate store application permissions can add the certificates in the collection to certificate stores from Certificate Search and Certificate Collections.

The certificate operations possibly available to users with this permission are:

• Add to Certificate Store (Also requires the Certificate Stores > Schedule permission at either the global or application level)
• Display
• Download
• Get CSV
• Identity Audit (Also requires the Security > Read permission)
• Include Revoked checkbox
• Include Expired checkbox
• Renew (Also requires the Certificates > Enrollment > Pfx permission and Certificate Stores > Schedule permission at either the global or application level)
• Remove from Certificate Store (Also requires the Certificate Stores > Schedule permission at either the global or application level)

Users with collection-level Read role permissions on a collection will see the collections to which they have been granted access appear on the Certificate Collections menu (if they have been configured to appear on the menu—see Certificate Collection Management). The users will be able to view all the certificates in the collections and open the details of the certificates.

Users can view the panels on their personalized legacy dashboard.

Users can view the enrollment pattern settings.

Users can view the pending, issued, and denied certificate request alerts.

Users can schedule the revocation monitoring alerts.

Users can modify the event handler registration settings.

Users can select any PAM providers to provide credentials within Keyfactor Command for:

• Certificate Stores

• Certificate Authorities

• Workflow Definitions

Users can modify the delivery schedule for reports in Report Manager in the Management Portal and the equivalent API functions and add, edit, and delete custom reports.

Users can add, edit, and delete scripts used in alert event handlers and workflows.

Users can modify the settings for Security Roles and Security Claims.

Users can modify the SSL Discovery settings:

• Create, edit, and delete networks, including scan schedules and notification recipients
• Add, edit, and delete network ranges for networks
• Add, edit, and delete agent pools
• Add and remove discovered endpoints from monitoring

Users can modify the System Settings for:

• Update SMTP Configuration for email delivery of reports and alerts

• Installed components, including removing servers from use

• Licensing, including the option to replace the existing license file

Users can view the configured workflow definitions.

Users can manage initiated workflow instances, including stopping, restarting, and deleting them.

Users can view the workflow instances that have been initiated by them (e.g., because they enrolled for a certificate).