GTS Access Control

[ GTS: Administrators Guide | Developers Guide | caGrid: Documentation Guides ]

Overview

Many of the operations provided by the GTS provide a means of administrating the trust fabric and are therefore restricted to GTS administrators or to administrators of individual certificate authorities. The GTS allows for the assignment of two types of permissions: GTS Administrators and Trusted CA Administrators. GTS Administrators (TrustAdmin) are "super users" and can perform any operation on a GTS (i.e., manage certificate authorities, manage trust levels, manage permissions, etc). Trusted CA Administrator (TrustAuthorityManager) permissions corresponds to a specific CA giving a party permission to update the CRL for the corresponding CA.

Managing Permissions

The GAARDS UI allows GTS administrators to search for and manage GTS permissions, this can be accomplished by completeing the following steps:

Launch the GAARDS UI
Login as a GTS administrator.
From the Trust Fabric menu, select Access Control, this will launch the Access Control Window.
From the Service drop down select the GTS you desire to search.
Click the Search button.

After the search has completed, the permissions granted on the GTS you selected will be listed in the table below the Search button.

Access Control

Grant Permission

The GAARDS UI provides a method for GTS administrators to grant parties permissions on a GTS. This can be accomplished by completing the following steps:

Launch the GAARDS UI
Login as a GTS administrator.
From the Trust Fabric menu, select Access Control, this will launch the Access Control Window.
From the Service drop down select the GTS you wish to grant a permission for.
Click the Add button, this will launch the Add Permission Window.
In the Grid Identity text box, enter the grid identity of the party being granted the permission.
From the Trusted Authority drop down, select the certificate authority to which the permission applies. If you select *, a TrustAdmin permission will be granted to the specified party, granting them full administrative access to the GTS. If a specific certificate authority is chosen, a TrustAuthorityManager permission will be granted to the party allowing them to publish the CRL to the GTS for the specified certificate authority.
Click the Add button, this will add the permission to the GTS.

Grant Permission

Revoke Permission

The GAARDS UI provides a method for GTS administrators to revoke permissions from the GTS. This can be accomplished by completing the following steps:

Launch the GAARDS UI
Login as a GTS administrator.
From the Trust Fabric menu, select Access Control, this will launch the Access Control Window.
From the Service drop down select the GTS you wish to revoke a permission from.
Click the Search button, this will list all the permissions granted on the selected GTS in the table below.
Select the permission to revoke.
Click the Remove button.