Security Role Permissions

The Security Role Permissions that are available to be assigned to security roles within Keyfactor Command are documented below.

Table 29: Agent Auto-Registration Security Role Permissions

UI Permission API Permission Description
Read AgentAutoRegistration: Read

Users can view the orchestrator auto-registration settings; users must also have Read permissions for Agent Management to access this page in the Management Portal.

Modify

 AgentAutoRegistration: Modify

Users can modify the orchestrator auto-registration settings.

Table 30: Agent Management Security Role Permissions

UI Permission API Permission Description

Read

 AgentManagement: Read

Users can:

  • View orchestrators, including filtering the Orchestrator Management grid
  • View orchestrator jobs, including status, schedules, failures and warnings

Modify

 AgentManagement: Modify

Users can:

  • Manage orchestrators, including approving and disapproving them
  • Unschedule and reschedule orchestrator jobs

Table 31: Alerts Security Role Permissions

UI Permission API Permission Description

Read

 WorkflowManagement: Read

Users can view the pending, issued, and denied workflow alerts.

Modify

 WorkflowManagement: Modify

Users can modify the pending, issued, and denied workflow alerts, including the alert text, recipients, and event handlers. Users can also add new alerts, delete alerts, and configure the pending alert delivery schedule.
Test WorkflowManagement: Test

Users can test the pending alerts, including sending email to recipients. Users must also have Read permissions for Alerts.

Table 32: API Security Role Permissions

UI Permission API Permission Description

Read

 API: Read

Users can call the Classic (CMS) API endpoints. This permission is not needed to use the Keyfactor API endpoints.

Table 33: Application Settings Security Role Permissions

UI Permission API Permission Description

Read

 ApplicationSettings: Read

Users can view the application settings.

Modify

 ApplicationSettings: Modify

Users can modify the application settings.

Table 34: Auditing Security Role Permissions

UI Permission API Permission Description

Read

 Auditing: Read

Users can access the Audit Log page in the Management Portal, and will be able to make API requests to obtain data from the audit log (query, etc.). The System Settings dropdown menu will display the Audit Log option to users with the Auditing Read permission.

Table 35: Certificate Collections Security Role Permissions

UI Permission API Permission Description

Modify

 CertificateCollections: Modify

Users can add or edit Certificate Collections. See Certificate Permissions for more information.

Table 36: Certificate Enrollment Security Role Permissions

UI Permission API Permission Description

Enroll PFX

 CertificateEnrollment: EnrollPFX

Users can use the PFX Enrollment page in the Management Portal and the equivalent API functions.

Enroll CSR

 CertificateEnrollment: EnrollCSR

Users can use the CSR Enrollment page in the Management Portal and the equivalent API functions.

CSR Generation

 CertificateEnrollment: CsrGeneration

Users can use the CSR Generation page in the Management Portal and the equivalent API functions.

Manage Pending CSRs

 CertificateEnrollment: PendingCsr

Users can use the Pending CSRs page in the Management Portal and the equivalent API functions.

Table 37: Certificate Metadata Types Security Role Permissions

UI Permission API Permission Description

Read

 CertificateMetadataTypes: Read

Users can read custom metadata attribute definitions on the Certificate Metadata page in the Management Portal and the equivalent API functions.

Modify

 CertificateMetadataTypes: Modify

Users can add, edit, and delete custom metadata attribute definitions on the Certificate Metadata page in the Management Portal and the equivalent API functions.

Table 38: Certificate Requests Security Role Permissions

UI Permission API Permission Description
Manage WorkflowManagement: Participate

Users can participate in the pending, issued, and denied alerts by approving or denying certificate requests from the Certificate Requests page, from the individual pages reached from links included in alerts, or using the Keyfactor API /Workflow/Certificates endpoints.

Note:  In previous versions of Keyfactor Command, this permission was Workflow Management: Participate.

Table 39: Certificate Store Management Security Role Permissions

See Container Permissions, Certificate Operations, Certificate Store Types and Certificate Store Operations for more information.

UI Permission API Permission Description

Read

 CertificateStoreManagement: Read

Users can view the certificate stores and containers tabs on the Locations > Certificate Stores menu, and view certificate store types.

Schedule CertificateStoreManagement: Schedule

Users can add certificates to certificate stores, renew/reissue certificates, schedule and remove certificates from certificate stores.

Modify

 CertificateStoreManagement: Modify

Users can manage all operations regarding certificate stores—including the stores, containers, and discovery process—and certificate store types.

Table 40: Certificates Security Role Permissions

UI Permission API Permission Description

Read

 Certificates: Read

Users can view certificates, including certificate history, and can download certificates. Users who also have Read permissions for Certificate Store Management or container permissions can add certificates to certificate stores from Certificate Search and Certificate Collections. See Certificate Permissions for more information.

Edit Metadata

 Certificates: EditMetadata

Users can modify certificate metadata for certificates accessed through Certificate Search and Certificate Collections in the Management Portal and the equivalent API functions.
Import Certificates: Import

Users can import certificates using the Management Portal Add Certificate page or the Keyfactor API POST /Certificates/Import method. Users who also have Read permissions for Certificate Store Management or container permissions can add certificates to certificate stores from Add Certificate.

Download with Private Key

 Certificates: Recover

Users can download the certificates with their private key.
Revoke Certificates: Revoke Users can revoke certificates through Keyfactor Command.
Delete Certificates: Delete Users can delete certificates and, if applicable, the private keys of the certificates from the Keyfactor Command database.

Import Private Key

 Certificates: ImportPrivateKey

Users can save the private key for the certificate in the Keyfactor Command database.

Table 41: Dashboard Security Role Permissions

UI Permission API Permission Description

Read

 Dashboard: Read

Users can view the panels on their personalized dashboard and add and remove them.
Risk Header Dashboard: RiskHeader Users can view the risk header at the top of the dashboard.

Table 42: Event Handler Registration Security Role Permissions

UI Permission API Permission Description

Read

 EventHandlerRegistration: Read

Users can view the event handler registration settings.

Modify

 EventHandlerRegistration: Modify

Users can modify the event handler registration settings.

Table 43: Mac Auto-Enroll Management Security Role Permissions

UI Permission API Permission Description

Read

 MacAutoEnrollManagement: Read

Users can view the Mac Auto-Enroll Management settings.

Modify

 MacAutoEnrollManagement: Modify

Users can modify the Mac Auto-Enroll Management settings.

Table 44: Management Portal Security Role Permissions

UI Permission API Permission Description

Read

 AdminPortal: Read

Users can access the Management Portal. This permission must be enabled for all roles that will access the Management Portal.

Table 45: Monitoring Security Role Permissions

UI Permission API Permission Description

Read

 Monitoring: Read

Users can view the expiration alerts in the Certificate Alerts in the Management Portal and the equivalent API functions, including the alert schedule.

Modify

 Monitoring: Modify

Users can modify the expiration alerts, including the alert text, recipients and event handlers. Users can also add new alerts, delete alerts and configure the expiration alert delivery schedule.
Test Monitoring: Test

Users can test the expiration alerts, including sending email to recipients. Users must also have Read permissions for Monitoring to access this in the Management Portal.

Table 46: PKI Management Security Role Permissions

UI Permission API Permission Description

Read

 PkiManagement: Read

Users can view PKI management settings within:

  • Certificate Authorities
  • Certificate Templates
  • Revocation Monitoring

Modify

 PkiManagement: Modify

Users can modify PKI management settings to:

  • Import, add, edit, and delete certificate authorities
  • Import and edit certificate templates
  • Add, edit, delete, and test revocation monitoring endpoints
  • Configure revocation monitoring schedule
  • Configure revocation monitoring recipients

Table 47: Privileged Access Management Security Role Permissions

UI Permission API Permission Description

Read

 PrivilegedAccessManagement: Read

Users can view PAM providers.

Modify

 PrivilegedAccessManagement: Modify

Users can add, edit, and delete PAM providers.

Table 48: Reports Security Role Permissions

UI Permission API Permission Description

Read

 Reports: Read

Users can generate and view reports.

Modify

 Reports: Modify

Users can modify the delivery schedule for reports in Report Manager in the Management Portal and the equivalent API functions and add, edit, and delete custom reports.

Note:   Report scheduling is limited by collection permissions. Users in roles that have Reports: Read and Modify permissions will also need to have Read collection permissions on individual collections to have the ability to add, edit, and delete schedules associated with collections. The user will not have access to add, edit, and delete schedules for any collections for which they do not have collection Read permissions in addition to Reports permissions.

Table 49: Security Settings Security Role Permissions

UI Permission API Permission Description

Read

 SecuritySettings: Read

Users can view the settings for Security Roles and Security Identities. Users must also have the Read permission for System Settings to access this in the Management Portal.

Modify

 SecuritySettings: Modify

Users can modify the settings for Security Roles and Security Identities.

Table 50: SSH Security Role Permissions

UI Permission API Permission Description

User

 SSH: User

Users can generate their own SSH keys.

Server Admin

 SSH: ServerAdmin

Users can use all SSH functions, except creating server groups and assigning server group owners. Users have limited access to some functions based on server group ownership (see SSH Permissions).
Enterprise Admin SSH: EnterpriseAdmin Users can use all SSH functions (see SSH Permissions).

Table 51: SSL Management Security Role Permissions

UI Permission API Permission Description

Read

 SslManagement: Read

Users can view the SSL Discovery pages in the Management Portal and the equivalent API functions, including defined networks and the network ranges configured for them, agent pools, and scan results. Users can use the query tool on the Results tab to find discovered endpoints and then view the discovered endpoints, including the details for the endpoints.

Modify

 SslManagement: Modify

Users can modify the SSL Discovery settings:

  • Create, edit, and delete networks, including scan schedules and notification recipients
  • Add, edit, and delete network ranges for networks
  • Add, edit, and delete agent pools
  • Add and remove discovered endpoints from monitoring

Table 52: System Settings Security Role Permissions

UI Permission API Permission Description

Read

 SystemSettings: Read

Users can view the orchestrator auto-registration settings; users must also have Read permissions for Agent Management to access this in the Management Portal. Users can view the System Settings for:

  • SMTP Configuration for email delivery of reports and alerts
  • Installed components
  • Licensing
  • General Alerts and Warnings about the health of the Keyfactor Command system (not related to a specific area of the product)

Modify

 SystemSettings: Modify

Users can modify the System Settings for:

  • Update SMTP Configuration for email delivery of reports and alerts
  • Installed components, including removing servers from use
  • Licensing, including the option to replace the existing license file

Table 53: Workflow Definitions Security Role Permissions

UI Permission API Permission Description

Read

 WorkflowDefinitions: Read

Users can view the configured workflow definitions.

Modify

 WorkflowDefinitions: Modify

Users can modify both the built-in and any custom workflow definitions, including the name and description and the configuration for the steps. Users can also add new workflow definitions, delete workflow definitions, publish workflow definitions, and import and export workflow definitions.

Table 54: Workflow Instances Security Role Permissions

UI Permission API Permission Description

ReadAll

 WorkflowInstances: ReadAll

Users can view all the workflow instances that have been initiated.

Read - Assigned To Me

 WorkflowInstances: ReadAssignedToMe

Users can view the workflow instances that have been initiated and are awaiting input from them.

Tip:  There is not a security permission at this level that controls whether users can provide input (a signal) to a workflow instance. This is controlled using the security roles configured on the specific workflow definition. Any user who holds one of the roles configured in the workflow step that requires a signal may provide the necessary input. The user does not need to hold the Read - Assigned To Me Workflow Instances permission in order to provide the input.
Read - Started By Me WorkflowInstances: ReadMy

Users can view the workflow instances that have been initiated by them (e.g. because they enrolled for a certificate).
Manage WorkflowInstances: Manage

Users can manage initiated workflow instances, including stopping, restarting, and deleting them.